Edit tour

Windows Analysis Report
0438.pdf.exe

Overview

General Information

Sample name:	0438.pdf.exe renamed because original name is a hash value
Original sample name:	.pdf.exe
Analysis ID:	1545741
MD5:	2d11dba46735af1cb1c0a42e9564e20d
SHA1:	b2e17960c6d080f7aba7df87f57c08b4bc2e7051
SHA256:	e19477a56b247e6cc435fee367abcf6e0c3db21de91ae2514b4a6b1807233c53
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension File Execution

Connects to many ports of the same IP (likely port scanning)

Enables network access during safeboot for specific services

Enables remote desktop connection

Initial sample is a PE file and has a suspicious name

Uses an obfuscated file name to hide its real file extension (double extension)

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file contains strange resources

Queries disk information (often used to detect virtual machines)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

0438.pdf.exe (PID: 2488 cmdline: "C:\Users\user\Desktop\0438.pdf.exe" MD5: 2D11DBA46735AF1CB1C0A42E9564E20D)

msiexec.exe (PID: 7064 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\pdf.msi" /qn MD5: E5DA170027542E25EDE42FC54C929077)

Acrobat.exe (PID: 6488 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Doc.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4328 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7180 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1736,i,7783600837662025009,4322504478347230784,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

msiexec.exe (PID: 2496 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

ROMFUSClient.exe (PID: 8080 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall MD5: 63D0964168B927D00064AA684E79A300)

ROMServer.exe (PID: 7248 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall MD5: F3D74B072B9697CF64B0B8445FDC8128)

ROMFUSClient.exe (PID: 4072 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall MD5: 63D0964168B927D00064AA684E79A300)

ROMServer.exe (PID: 7636 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall MD5: F3D74B072B9697CF64B0B8445FDC8128)

ROMFUSClient.exe (PID: 5588 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start MD5: 63D0964168B927D00064AA684E79A300)

ROMServer.exe (PID: 8096 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start MD5: F3D74B072B9697CF64B0B8445FDC8128)

svchost.exe (PID: 2300 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

ROMServer.exe (PID: 8036 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" MD5: F3D74B072B9697CF64B0B8445FDC8128)

ROMFUSClient.exe (PID: 3608 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 2324 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 6672 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 8172 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 5196 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 8068 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 7616 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 8060 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 6436 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

ROMFUSClient.exe (PID: 5144 cmdline: "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray MD5: 63D0964168B927D00064AA684E79A300)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000000.2234439109.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000C.00000000.2252577316.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
11.0.ROMFUSClient.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
12.0.ROMServer.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\0438.pdf.exe", CommandLine: "C:\Users\user\Desktop\0438.pdf.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\0438.pdf.exe, NewProcessName: C:\Users\user\Desktop\0438.pdf.exe, OriginalFileName: C:\Users\user\Desktop\0438.pdf.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Users\user\Desktop\0438.pdf.exe", ProcessId: 2488, ProcessName: 0438.pdf.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 111.90.140.76, DestinationIsIpv6: false, DestinationPort: 465, EventID: 3, Image: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, Initiated: true, ProcessId: 8036, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49788

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2300, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 0438.pdf.exe

ReversingLabs: Detection: 44%

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf

Jump to behavior

Source: 0438.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 0438.pdf.exe

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DAB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF655DAB190
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D940BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF655D940BC
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DBFCA0 FindFirstFileExA,	0_2_00007FF655DBFCA0

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 111.90.140.76 ports 5651,8080,1,465,5,6,80

Enables network access during safeboot for specific services

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Registry value created: NULL Service

Source: global traffic	TCP traffic: 192.168.2.6:49785 -> 111.90.140.76:5651
Source: global traffic	TCP traffic: 192.168.2.6:49790 -> 65.21.245.7:5555

Source: Joe Sandbox View	IP Address: 96.7.168.138 96.7.168.138
Source: Joe Sandbox View	IP Address: 65.21.245.7 65.21.245.7

Source: Joe Sandbox View

ASN Name: SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.168.138
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.76

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: AledensoftIpcServer.dll.4.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: svchost.exe, 00000006.00000002.3404980914.00000152CDA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.6.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: ROMFUSClient.exe, 00000015.00000002.3396748932.00000000027CC000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.3396748932.00000000026CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://litemanager.com/
Source: ROMFUSClient.exe, 00000015.00000002.3396748932.00000000027D3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://litemanager.com/03
Source: ROMServer.exe, 00000012.00000002.3395697625.000000000165C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://litemanager.com/03f
Source: ROMFUSClient.exe, 0000000B.00000000.2240253019.00000000008E4000.00000002.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.2255406199.00000000009FE000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://litemanager.ru/
Source: ROMServer.exe, 0000000C.00000000.2252577316.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ROMServer.exe.4.dr	String found in binary or memory: http://litemanager.ru/noip.txtU
Source: AledensoftIpcServer.dll.4.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://sv.symcd.com0&
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: ROMFUSClient.exe, 0000000B.00000003.2259126135.0000000002807000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000000B.00000000.2234439109.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.2252577316.0000000000951000.00000020.00000001.01000000.0000000C.sdmp, ROMServer.exe, 0000000C.00000003.2257147255.0000000002A67000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000000D.00000003.2277324013.0000000002917000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 0000000E.00000003.2275541366.0000000002A17000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000000F.00000003.2316937821.0000000002907000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 00000011.00000003.2312303381.0000000002907000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 00000012.00000002.3395697625.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000014.00000002.3395273674.00000000027B7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.3396748932.0000000002737000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000016.00000003.2313692708.0000000002677000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000017.00000003.2327332686.00000000027A7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000018.00000003.2336010144.00000000027D7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000019.00000003.2345721402.00000000027F7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001A.00000003.2356406295.0000000002727000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001B.00000003.2379336714.0000000002877000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001D.00000003.3132372949.00000000028C7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe.4.dr	String found in binary or memory: http://www.indyproject.org/
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: 2D85F72862B55C4EADD9E66E06947F3D0.5.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: qmgr.db.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000006.00000003.2167957236.00000152CD900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: ROMFUSClient.exe, 0000000B.00000000.2234439109.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.2252577316.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ROMServer.exe.4.dr	String found in binary or memory: https://litemanager.com/romversion.txt
Source: ROMFUSClient.exe, 0000000B.00000000.2234439109.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.2252577316.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ROMServer.exe.4.dr	String found in binary or memory: https://litemanager.com/soft/pro/ROMServer.zip

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: 0438.pdf.exe

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF655D8C2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF655D8C2F0

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\533823.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{71FFA475-24D5-44FB-A51F-39B699E3D82C}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3BEC.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\533826.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\533826.msi	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\533826.msi

Jump to behavior

Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D8F930	0_2_00007FF655D8F930
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D94928	0_2_00007FF655D94928
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DB0754	0_2_00007FF655DB0754
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DAB190	0_2_00007FF655DAB190
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D9A4AC	0_2_00007FF655D9A4AC
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DA3484	0_2_00007FF655DA3484
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DA1F20	0_2_00007FF655DA1F20
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DACE88	0_2_00007FF655DACE88
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D85E24	0_2_00007FF655D85E24
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D876C0	0_2_00007FF655D876C0
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DC2550	0_2_00007FF655DC2550
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DBC838	0_2_00007FF655DBC838
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D84840	0_2_00007FF655D84840
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D8A310	0_2_00007FF655D8A310
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D8C2F0	0_2_00007FF655D8C2F0
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D87288	0_2_00007FF655D87288
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D9126C	0_2_00007FF655D9126C
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DA21D0	0_2_00007FF655DA21D0
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D9F180	0_2_00007FF655D9F180
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D9B534	0_2_00007FF655D9B534
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DA53F0	0_2_00007FF655DA53F0
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D9AF18	0_2_00007FF655D9AF18
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DA8DF4	0_2_00007FF655DA8DF4
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DB0754	0_2_00007FF655DB0754
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DA2D58	0_2_00007FF655DA2D58
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DC2080	0_2_00007FF655DC2080
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DC5AF8	0_2_00007FF655DC5AF8
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D81AA4	0_2_00007FF655D81AA4
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DA2AB0	0_2_00007FF655DA2AB0
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DBFA94	0_2_00007FF655DBFA94
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D91A48	0_2_00007FF655D91A48
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DB89A0	0_2_00007FF655DB89A0
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DA3964	0_2_00007FF655DA3964
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D9C96C	0_2_00007FF655D9C96C
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DB8C1C	0_2_00007FF655DB8C1C
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DA4B98	0_2_00007FF655DA4B98
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D9BB90	0_2_00007FF655D9BB90
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D95B60	0_2_00007FF655D95B60

Source: ROMViewer.exe.4.dr	Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: ROMServer.exe.4.dr	Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: ROMServer.exe0.4.dr	Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: ROMServer.exe.4.dr	Static PE information: Number of sections : 11 > 10
Source: ROMFUSClient.exe.4.dr	Static PE information: Number of sections : 11 > 10
Source: ROMServer.exe0.4.dr	Static PE information: Number of sections : 11 > 10
Source: ROMViewer.exe.4.dr	Static PE information: Number of sections : 11 > 10

Source: ROMViewer.exe.4.dr

Static PE information: Resource name: RT_RCDATA type: Delphi compiled form 'TfmEditBinaryValue'

Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSetAllUsers.dll< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2153671361.000001D84EE2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAcrobat.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2153805384.000001D854283000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAcrobat.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000002.2158391585.000001D854283000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAcrobat.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000002.2157778409.000001D84EE2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAcrobat.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2157020100.000001D84EE2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAcrobat.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2153945402.000001D84EE2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAcrobat.exe< vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameISRegSvr.dll vs 0438.pdf.exe
Source: 0438.pdf.exe, 00000000.00000003.2142040479.000001D852E62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs 0438.pdf.exe

Source: classification engine

Classification label: mal76.troj.evad.winEXE@51/93@1/4

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF655D8B6D8 GetLastError,FormatMessageW,LocalFree,

0_2_00007FF655D8B6D8

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF655DA8624 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00007FF655DA8624

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\LiteManager Pro - Server

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ROMFUSLocal
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ROMFUSTray

Source: C:\Users\user\Desktop\0438.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_5451828

Jump to behavior

Source: Yara match	File source: 11.0.ROMFUSClient.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.ROMServer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.2234439109.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.2252577316.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe, type: DROPPED

Source: 0438.pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\0438.pdf.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\0438.pdf.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 0438.pdf.exe

ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\0438.pdf.exe

File read: C:\Users\user\Desktop\0438.pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\0438.pdf.exe "C:\Users\user\Desktop\0438.pdf.exe"
Source: C:\Users\user\Desktop\0438.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\pdf.msi" /qn
Source: C:\Users\user\Desktop\0438.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Doc.pdf"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1736,i,7783600837662025009,4322504478347230784,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start
Source: unknown	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe"
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe"
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Users\user\Desktop\0438.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\pdf.msi" /qn	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Doc.pdf"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1736,i,7783600837662025009,4322504478347230784,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe"
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray

Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: pcacli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: pcacli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: fwbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: pcacli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: avifil32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: dsound.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iccvid.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: iyuv_32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msrle32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msvidc32.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: tsbyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: msyuv.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Section loaded: avicap32.dll

Source: C:\Users\user\Desktop\0438.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Start LM-Server.lnk.4.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Source: Uninstall LiteManager - Server.lnk.4.dr	LNK file: ..\..\..\..\..\..\Windows\SysWOW64\msiexec.exe
Source: Stop LM-Server.lnk.4.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Source: Settings for LM-Server.lnk.4.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 0438.pdf.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 0438.pdf.exe

Static file information: File size 11654747 > 1048576

Source: 0438.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 0438.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 0438.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 0438.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 0438.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 0438.pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 0438.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 0438.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 0438.pdf.exe

Source: 0438.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 0438.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 0438.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 0438.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 0438.pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\0438.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_5451828

Jump to behavior

Source: 0438.pdf.exe	Static PE information: section name: .didat
Source: 0438.pdf.exe	Static PE information: section name: _RDATA
Source: ROMViewer.exe.4.dr	Static PE information: section name: .didata
Source: ROMFUSClient.exe.4.dr	Static PE information: section name: .didata
Source: ROMwln.dll.4.dr	Static PE information: section name: .didata
Source: ROMServer.exe.4.dr	Static PE information: section name: .didata
Source: HookDrv.dll.4.dr	Static PE information: section name: .didata
Source: ROMServer.exe0.4.dr	Static PE information: section name: .didata

Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DC5156 push rsi; retf		0_2_00007FF655DC5157
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DC5166 push rsi; retf		0_2_00007FF655DC5167

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf

Jump to behavior

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\romserver.exe

Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Start LM-Server.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Uninstall LiteManager - Server.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Stop LM-Server.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Settings for LM-Server.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.exe

Static PE information: 0438.pdf.exe

Source: C:\Windows\System32\msiexec.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\LiteManager\v3.4\Server\Parameters NoIPSettings

Jump to behavior

Source: C:\Users\user\Desktop\0438.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Window / User API: threadDelayed 3225
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Window / User API: threadDelayed 6579

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	Jump to dropped file

Source: C:\Windows\System32\svchost.exe TID: 4364	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe TID: 8080	Thread sleep time: -60000s >= -30000s
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe TID: 8028	Thread sleep count: 208 > 30
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe TID: 7384	Thread sleep time: -1612500s >= -30000s
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe TID: 7384	Thread sleep time: -3289500s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DAB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF655DAB190
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655D940BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF655D940BC
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DBFCA0 FindFirstFileExA,	0_2_00007FF655DBFCA0

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF655DB16A4 VirtualQuery,GetSystemInfo,

0_2_00007FF655DB16A4

Source: ROMFUSClient.exe, 0000000D.00000002.2278363197.0000000000B5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: ROMFUSClient.exe, 0000000D.00000002.2278363197.0000000000B5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: ROMFUSClient.exe, 0000001D.00000002.3134326476.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll/
Source: ROMFUSClient.exe, 00000014.00000002.3393245652.0000000000D18000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 00000016.00000002.2316974063.0000000000B88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp
Source: svchost.exe, 00000006.00000002.3400883318.00000152C842B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3405086246.00000152CDA40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3405187560.00000152CDA53000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ROMFUSClient.exe, 0000000D.00000002.2278363197.0000000000B5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: ROMFUSClient.exe, 0000000F.00000003.2318499997.0000000000BF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\|
Source: ROMFUSClient.exe, 0000000B.00000002.2261534094.0000000000D09000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BL
Source: ROMFUSClient.exe, 00000017.00000002.2329035587.0000000000D78000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 00000018.00000002.2337206079.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]
Source: ROMServer.exe, 00000012.00000002.3392369050.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.3393174730.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 00000019.00000002.2352309440.0000000000D38000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001A.00000002.2358537336.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001B.00000002.2380622367.0000000000C28000.00000004.00000020.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001E.00000002.3336564501.0000000000B58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF655DB76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF655DB76D8

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF655DC0D20 GetProcessHeap,

0_2_00007FF655DC0D20

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Process token adjusted: Debug

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start

Jump to behavior

Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DB76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF655DB76D8
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DB3170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF655DB3170
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DB2510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF655DB2510
Source: C:\Users\user\Desktop\0438.pdf.exe	Code function: 0_2_00007FF655DB3354 SetUnhandledExceptionFilter,	0_2_00007FF655DB3354

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF655DAB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF655DAB190

Source: C:\Users\user\Desktop\0438.pdf.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\pdf.msi" /qn	Jump to behavior
Source: C:\Users\user\Desktop\0438.pdf.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Doc.pdf"	Jump to behavior
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Process created: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe "C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF655DC58E0 cpuid

0_2_00007FF655DC58E0

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00007FF655DAA2CC

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF655DB0754 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF655DB0754

Source: C:\Users\user\Desktop\0438.pdf.exe

Code function: 0_2_00007FF655D951A4 GetVersionExW,

0_2_00007FF655D951A4

Remote Access Functionality

Enables remote desktop connection

Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server AllowRemoteRPC

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Windows Service	1 DLL Side-Loading	11 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Windows Service	1 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Process Injection	1 DLL Side-Loading	NTDS	65 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 File Deletion	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	122 Masquerading	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
0438.pdf.exe	45%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll	0%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll	0%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	3%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe	3%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll	0%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe	3%	ReversingLabs
C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe	3%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe	0%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe	0%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe	0%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe	0%	ReversingLabs
C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://x1.i.lencr.org/	0%	URL Reputation	safe
https://g.live.com/odclientsettings/Prod1C:	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV21C:	0%	URL Reputation	safe
http://www.indyproject.org/	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.37	true	false	unknown
x1.i.lencr.org	unknown	unknown	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://litemanager.ru/	ROMFUSClient.exe, 0000000B.00000000.2240253019.00000000008E4000.00000002.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.2255406199.00000000009FE000.00000002.00000001.01000000.0000000C.sdmp	false		unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.5.dr	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.6.dr	false	URL Reputation: safe	unknown
https://litemanager.com/soft/pro/ROMServer.zip	ROMFUSClient.exe, 0000000B.00000000.2234439109.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.2252577316.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ROMServer.exe.4.dr	false		unknown
http://litemanager.com/03	ROMFUSClient.exe, 00000015.00000002.3396748932.00000000027D3000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://litemanager.com/03f	ROMServer.exe, 00000012.00000002.3395697625.000000000165C000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://litemanager.com/romversion.txt	ROMFUSClient.exe, 0000000B.00000000.2234439109.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.2252577316.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ROMServer.exe.4.dr	false		unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	false	URL Reputation: safe	unknown
http://www.symauth.com/rpa00	0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	false	URL Reputation: safe	unknown
http://ocsp.thawte.com0	0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	false	URL Reputation: safe	unknown
http://litemanager.ru/noip.txtU	ROMServer.exe, 0000000C.00000000.2252577316.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, ROMServer.exe.4.dr	false		unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000006.00000003.2167957236.00000152CD900000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000006.00000002.3404980914.00000152CDA00000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://litemanager.com/	ROMFUSClient.exe, 00000015.00000002.3396748932.00000000027CC000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.3396748932.00000000026CC000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.indyproject.org/	ROMFUSClient.exe, 0000000B.00000003.2259126135.0000000002807000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000000B.00000000.2234439109.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, ROMServer.exe, 0000000C.00000000.2252577316.0000000000951000.00000020.00000001.01000000.0000000C.sdmp, ROMServer.exe, 0000000C.00000003.2257147255.0000000002A67000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000000D.00000003.2277324013.0000000002917000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 0000000E.00000003.2275541366.0000000002A17000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000000F.00000003.2316937821.0000000002907000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 00000011.00000003.2312303381.0000000002907000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe, 00000012.00000002.3395697625.00000000015C0000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000014.00000002.3395273674.00000000027B7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000015.00000002.3396748932.0000000002737000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000016.00000003.2313692708.0000000002677000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000017.00000003.2327332686.00000000027A7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000018.00000003.2336010144.00000000027D7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 00000019.00000003.2345721402.00000000027F7000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001A.00000003.2356406295.0000000002727000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001B.00000003.2379336714.0000000002877000.00000004.00001000.00020000.00000000.sdmp, ROMFUSClient.exe, 0000001D.00000003.3132372949.00000000028C7000.00000004.00001000.00020000.00000000.sdmp, ROMServer.exe.4.dr	false	URL Reputation: safe	unknown
http://www.symauth.com/cps0(	0438.pdf.exe, 00000000.00000003.2142040479.000001D852E3C000.00000004.00000020.00020000.00000000.sdmp, 0438.pdf.exe, 00000000.00000003.2142040479.000001D852DFE000.00000004.00000020.00020000.00000000.sdmp, pdf.msi.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
96.7.168.138	unknown	United States	262589	INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR	false
111.90.140.76	unknown	Malaysia	45839	SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	true
65.21.245.7	unknown	United States	199592	CP-ASDE	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545741
Start date and time:	2024-10-30 22:36:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0438.pdf.exe renamed because original name is a hash value
Original Sample Name:	.pdf.exe
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@51/93@1/4
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 71 Number of non-executed functions: 92
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 54.227.187.23, 52.202.204.11, 23.22.254.206, 52.5.13.197, 162.159.61.3, 172.64.41.3, 2.23.197.184, 184.28.90.27, 88.221.110.91, 2.16.100.168, 2.19.126.143, 2.19.126.149, 2.22.242.123, 2.22.242.11
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, geo2.adobe.com
Execution Graph export aborted for target ROMServer.exe, PID 8036 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 0438.pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
17:37:32	API Interceptor	2x Sleep call for process: svchost.exe modified
17:37:40	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
17:37:44	API Interceptor	20x Sleep call for process: ROMServer.exe modified
17:37:47	API Interceptor	400440x Sleep call for process: ROMFUSClient.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
96.7.168.138	401K .pdf	Get hash	malicious	HTMLPhisher	Browse
	http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdf	Get hash	malicious	Unknown	Browse
	Oakville_Service_Update_d76b33a1-3420-40be-babd-e82e253ad25c.pdf	Get hash	malicious	HTMLPhisher	Browse
	2025+Policies_645622_929-5.pdf	Get hash	malicious	Unknown	Browse
	https://dl.dropboxusercontent.com/scl/fi/95is2w1ywjvorzayt88dp/DKM-0192PDF.zip?rlkey=svoej4s4tb5lwbnvthtgrmokl&st=d99zdn1k&dl=0	Get hash	malicious	Abobus Obfuscator	Browse
	Sars Urgent Notice.pdf	Get hash	malicious	Unknown	Browse
	tue.bat	Get hash	malicious	Unknown	Browse
	https://dl.dropboxusercontent.com/scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0	Get hash	malicious	Unknown	Browse
	bc3c228ad2c13f96cb14375c3860e802.pdf	Get hash	malicious	HTMLPhisher	Browse
111.90.140.76	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse
65.21.245.7	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	FPPhfkcDCh.exe	Get hash	malicious	Remcos	Browse
	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse
	044f.pdf.scr	Get hash	malicious	RMSRemoteAdmin	Browse
	3e#U043c.scr	Get hash	malicious	RMSRemoteAdmin	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	67JPbskewt.exe	Get hash	malicious	Unknown	Browse	84.201.210.35
	https://jpm-ghana-2024-election-conversation-with-oct-24.open-exchange.net/join-the-call?ml_access_token=eyJjb250ZW50Ijp7ImV4cGlyYXRpb25EYXRlIjoiMjAyNC0xMC0zMVQxNToyMDo1OS4wMDZaIiwiZW1haWwiOiJyZGVpdHpAdnItY2FwaXRhbC5jb20iLCJldmVudElkIjo0MjY3Mn0sInNpZ25hdHVyZSI6Ik1FVUNJQzhaMDJJblVZd0syUk9WRkdjL1pMNHRBbWo4RmwxdW9mQjhwZzRmSjZsMkFpRUE5d25HUFFoa3ZrdkM2MlJkQ3lkM09YbnFJZ0xlQTAwMDIxNlRWbG9Hb0ZjPSJ9	Get hash	malicious	Unknown	Browse	217.20.57.34
	https://cosiosos.com.de/7i2ko/	Get hash	malicious	HTMLPhisher	Browse	217.20.57.18
	https://www.leadsonline.ca	Get hash	malicious	Unknown	Browse	217.20.57.34
	PRESUPUEST.exe	Get hash	malicious	AsyncRAT	Browse	217.20.57.19
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	217.20.57.34
	scan1738761_rsalinas@wcctxlaw.com.pdf	Get hash	malicious	HTMLPhisher	Browse	84.201.210.37
	https://forms.office.com/Pages/ShareFormPage.aspx?id=w0PqEzPG80GlVpQ2KYlCgotli86l81ZCgGQV0R07kYhUMDlNVzY4TDhNS0pGV0pGVENBVVNGTURFTi4u&sharetoken=3AKcsZjmxuGhgr7rDwU0	Get hash	malicious	Unknown	Browse	84.201.210.21
	https://deedayoshayoatmetoback.me/whatever/toni/kross/hala/mbappe/sanchez/mark/tremble/awee/rgguuu/us/invite/	Get hash	malicious	Unknown	Browse	217.20.57.26
	https://workdrive.zohoexternal.com/file/d3qaw4673940b54374623b165953068c580b5	Get hash	malicious	HTMLPhisher	Browse	217.20.57.25
bg.microsoft.map.fastly.net	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://pub-6838e3dd185d4df89d3bb3eabe6469a4.r2.dev/index.html#	Get hash	malicious	Unknown	Browse	199.232.214.172
	https:/click.mailchimp.com/track/click/30010842/docsend.com?p=eyJzIjoiT2RaN0hwNHlyY2E3VXl5TWcwMlA2eFpHVlN3IiwidiI6MSwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2RvY3NlbmQuY29tXFxcL3ZpZXdcXFwvZzZnYzZjazdtNHlkYTRpa1wiLFwiaWRcIjpcImNhZDg3NzI1Y2UzMjRiMzI4Yzk1ZGVkYWUyMzc4ZTZjXCIsXCJ1cmxfaWRzXCI6W1wiYzE5ZWU5NGJiMzA5YmZhOGQ2MDU3OGI1Mjk5NTFmOWE4NDQ0ODNhYVwiXX0ifQ#steven.davis@tu.edu	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	https://jksvb.jnkpavers.com/?tZbf66=Tyw6/shhfkanxgsdff/&c=E,1,NSDuZCxGQc6fw5XDGugSpFh6vhsurKgNKuRtQYEvQblaeko7ktmOqkToectUm_5S_qV7IGwrOynGYnQ5TFSCJymAV2tc5TeuFegn96UyDZPOEKOyHYw,&typo=1	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3	Get hash	malicious	Mamba2FA	Browse	199.232.214.172
	https://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5	Get hash	malicious	Unknown	Browse	199.232.210.172
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse	199.232.210.172
	819614 - Midways Freight Ltd.xlsm	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://jpm-ghana-2024-election-conversation-with-oct-24.open-exchange.net/join-the-call?ml_access_token=eyJjb250ZW50Ijp7ImV4cGlyYXRpb25EYXRlIjoiMjAyNC0xMC0zMVQxNToyMDo1OS4wMDZaIiwiZW1haWwiOiJyZGVpdHpAdnItY2FwaXRhbC5jb20iLCJldmVudElkIjo0MjY3Mn0sInNpZ25hdHVyZSI6Ik1FVUNJQzhaMDJJblVZd0syUk9WRkdjL1pMNHRBbWo4RmwxdW9mQjhwZzRmSjZsMkFpRUE5d25HUFFoa3ZrdkM2MlJkQ3lkM09YbnFJZ0xlQTAwMDIxNlRWbG9Hb0ZjPSJ9	Get hash	malicious	Unknown	Browse	199.232.214.172
	Complete with Docusign_ Remittance Advice .pdf(1).eml	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse	111.90.140.34
	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse	111.90.140.34
	FPPhfkcDCh.exe	Get hash	malicious	Remcos	Browse	101.99.93.169
	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse	111.90.140.76
	b.cmd	Get hash	malicious	Unknown	Browse	101.99.92.203
	rrwzOU7A9F.exe	Get hash	malicious	XWorm	Browse	101.99.92.203
INTERNEXABRASILOPERADORADETELECOMUNICACOESSABR	401K .pdf	Get hash	malicious	HTMLPhisher	Browse	96.7.168.138
	http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdf	Get hash	malicious	Unknown	Browse	96.7.168.138
	Oakville_Service_Update_d76b33a1-3420-40be-babd-e82e253ad25c.pdf	Get hash	malicious	HTMLPhisher	Browse	96.7.168.138
	2025+Policies_645622_929-5.pdf	Get hash	malicious	Unknown	Browse	96.7.168.138
	https://dl.dropboxusercontent.com/scl/fi/95is2w1ywjvorzayt88dp/DKM-0192PDF.zip?rlkey=svoej4s4tb5lwbnvthtgrmokl&st=d99zdn1k&dl=0	Get hash	malicious	Abobus Obfuscator	Browse	96.7.168.138
	Sars Urgent Notice.pdf	Get hash	malicious	Unknown	Browse	96.7.168.138
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	200.220.206.173
	tue.bat	Get hash	malicious	Unknown	Browse	96.7.168.138
	https://dl.dropboxusercontent.com/scl/fi/kzw07ghqs05mfyhu8o3ey/BestellungVRG020002.zip?rlkey=27cmmjv86s5ygdnss2oa80i1o&st=86cnbbyp&dl=0	Get hash	malicious	Unknown	Browse	96.7.168.138
CP-ASDE	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse	65.21.245.7
	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse	65.21.245.7
	FPPhfkcDCh.exe	Get hash	malicious	Remcos	Browse	65.21.245.7
	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse	65.21.245.7
	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
	iQPxJrxxaj.exe	Get hash	malicious	PikaBot	Browse	65.20.66.218

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\533825.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	25222
Entropy (8bit):	5.137779369916245
Encrypted:	false
SSDEEP:	384:8S75t8t+CqZ+oNbynfBytjj3I6LgLVOVb:8S1t8t+CqZ+oNbynfEtI6cpMb
MD5:	72AB5CEA21A964F96CE96D06D6D80544
SHA1:	9727166227557EA1C55AC2BF2C149A286D0FA18A
SHA-256:	03A2D50F37B41C876AF14F981F86CDECFF54D2BCAD9A84A09F478B1D61BBF61B
SHA-512:	297C047F4ED5F197F13289FB3EBE6BEEC6CCECD776B1A9A33E79807FC5158D768D91013BE1C748B80A4E0FA0D33F1E6BDD83C56112D08EAD27B0216D73255A8A
Malicious:	false
Preview:	...@IXOS.@.....@..^Y.@.....@.....@.....@.....@.....@......&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}..LiteManager Pro - Server..pdf.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}.....@.....@.....@.....@.......@.....@.....@.......@......LiteManager Pro - Server......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{3244CDE6-6414-4399-B0D5-424562747210}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{4D4D18AA-F74D-4291-B5A9-93C3CC48B75F}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{641F154A-FEEF-4FA7-B5BF-414DB1DB8390}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{00000000-0000-0000-0000-000000000000}.@......&.{A3DC5A2F-2249-4674-B

C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	132032
Entropy (8bit):	6.10195829980833
Encrypted:	false
SSDEEP:	3072:sh/1J7RYdzZU4Z5tegH1q888888888888W888888888882zgP:sh/jIZPZ5tJ8888888888888W888888s
MD5:	C40455A478E0B76521130D9DAAAADC4B
SHA1:	42DE923D5E36A9F56B002DD66DB245BC44480089
SHA-256:	308085BC357BF3A3BEE0D662FCC01628E9EE2FFD478AE0F1E7140939AD99B892
SHA-512:	76ED6D763F603BCAA7FE186C0A7449E614DCDB18036F7587C6E5A11C3F3269E400E3D2062856CC280AC20C094617924783B6C360F25AF66767DCC53C2F3045C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: gBYz86HSwI.msi, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....xK............................p........ ..........................................................................\.......\...............................x#...................................................................................text...$........................... ..`.itext.............................. ..`.data...0.... ......................@....bss....xN...@...........................idata..\...........................@....edata..\............&..............@..@.reloc..x#.......$...(..............@..B.rsrc................L..............@..@....................................@..@........................................................................................................................................

C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default language ID 1049
Category:	dropped
Size (bytes):	58679
Entropy (8bit):	4.738446173390891
Encrypted:	false
SSDEEP:	768:bkJC7UF9eVWSlBY8Aq9CBGDtD8gX1ZDCZjewbAsCw1vPDQuJPQzusxxeCNHnPPsT:htwqueMZYU
MD5:	BAED4E7AF33F77350D454B69317EE63B
SHA1:	2B598774F0C73850A36117F29EA8DAC57BE1C138
SHA-256:	671D65183C39E53FC1759C45B105A0FBE2D3A216E4099B66D5FCF274EA625E07
SHA-512:	E740997BDECB8F907A000D01BF3E823898A1289D1DBFAE5BF342D4BCB6FF09D258317955F4FD858FF6B239E5BA08E49E90CDEC06E24DABDB18C1CF2D8943590C
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1251\uc1\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049{\fonttbl{\f0\froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}..{\f1\fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}..{\f10\fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f211\froman\fcharset0\fprq2 Times New Roman{\\falt Times New Roman};}..{\f209\froman\fcharset238\fprq2 Times New Roman CE{\\falt Times New Roman};}{\f212\froman\fcharset161\fprq2 Times New Roman Greek{\\falt Times New Roman};}{\f213\froman\fcharset162\fprq2 Times New Roman Tur{\\falt Times New Roman};}..{\f214\froman\fcharset177\fprq2 Times New Roman (Hebrew){\\falt Times New Roman};}{\f215\froman\fcharset178\fprq2 Time

C:\Program Files (x86)\LiteManager Pro - Server\English.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	89220
Entropy (8bit):	3.469297258214741
Encrypted:	false
SSDEEP:	768:YvozCzKUNNfMnuQhgdXT0Z2BPshK+4aCWpQJ3OEInKDcbztlXnpQbbMv3PI:Yvoz4TXTI2pQCWOJvgXnpQbS3PI
MD5:	B1C96EF24061BF294CAC6C4C9CBF7757
SHA1:	5D1B1934091E257B5F1C69B13F5FC1E424348584
SHA-256:	20DB884523DA62C20F80B8A3BB71E11091B90A443B83C06D8FE2A1BBC00C1C33
SHA-512:	6E90562FD804F91DDADEF2310551063D34B859FF1CC6E58A41667E9CDA062DCA851C8455882EF47CF3E1A8EC21EBD9F0761F15E54174CC4A95427238CB39BA14
Malicious:	false
Preview:	..[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d.=.1.0.3.3.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...c.o.m./.....q.u.e.s.t.i.o.n. .=. .Q.u.e.s.t.i.o.n.....e.r.r.o.r. .=. .E.r.r.o.r.....i.n.f.o.r.m.a.t.i.o.n. .=. .I.n.f.o.r.m.a.t.i.o.n.....n.o.t.i.f.i.c.a.t.i.o.n. .=. .N.o.t.i.f.i.c.a.t.i.o.n.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. .C.a.n. .n.o.t. .r.e.a.d. .s.e.r.v.i.c.e. .c.o.n.f.i.g.u.r.a.t.i.o.n...\.n.;.R.e.i.n.s.t.a.l.l. .L.i.t.e.M.a.n.a.g.e.r. .s.e.r.v.i.c.e.?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. .C.a.n. .n.o.t. .s.e.t. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r. .s.e.r.v.i.c.e. .s.t.a.r.t.u.p. .m.o.d.e.......f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. .C.a.n. .n.o.t. .s.e.t. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r. .s.e.r.v.i.c.e. .s.t.a.r.t.u.p. .m.o.d.e...\.n.;.R.e.b.o.o.t. .s.y.s.t.e.m.,. .p.l.e.a.s.e.......

C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	201728
Entropy (8bit):	6.3607488106285075
Encrypted:	false
SSDEEP:	3072:rmqdVRkbN1G3OKtVLqKc3IuQquARCASmShKJ:rmyTmNw3zqKcFLRs
MD5:	1D4F8CFC7BBF374CCC3AAE6045B2133D
SHA1:	802EDF0B0ED1D0305BCD6688EE3301366FEC1337
SHA-256:	C04885562F17BAEEFBCD2D4FC29F054EB8A66C44BD015750498C69A912D94C1F
SHA-512:	68643A30FEA87B2B61AF546F42BF32A25459152C1BCCE5A8A881714139CE828DFE4237874FF1E9CC3B78D6CDBEF7DD45C9F3459C3337D83693C704C274AFFF3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: gBYz86HSwI.msi, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...\|..[.................\...........v............@.................................................................. ...................@...................@...G..................................................$................................text....S.......T.................. ..`.itext..D....p.......X.............. ..`.data...<............`..............@....bss....<Y...............................idata...............z..............@....didata.............................@....edata....... ......................@..@.rdata..E....0......................@..@.reloc...G...@...H..................@..B.rsrc....@.......@..................@..@....................................@..@........................................................

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Taiwan.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	61034
Entropy (8bit):	4.429529654892776
Encrypted:	false
SSDEEP:	768:nebbtdP4XFsh6HWiIZTYp7JtMLG54ttg2kGPyWtvQTznCKDMlV2f:ne3KOhTTocL8HnMlV2f
MD5:	7303B5AE0B8911CEB238DC01419695BE
SHA1:	22B89BDB8FAEC62BA3E66639E38E6271B593944A
SHA-256:	88155FB3F0E198AA4A24F9CFECBB83C5A4E081C6EA362BC50294410CB2FB5C50
SHA-512:	8AE802616AF60BAF214E254F6A55D312DC46B6E3F8BEE5F50E30E372FF38103776278B5FB07A562C2149EEA58107CB427A03B1629F72044AB69D3507E5DFAB15
Malicious:	false
Preview:	[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d.=.1.0.2.8.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...c.o.m./.....q.u.e.s.t.i.o.n. .=. .OUL.....e.r.r.o.r. .=. ./.......i.n.f.o.r.m.a.t.i.o.n. .=. ........n.o.t.i.f.i.c.a.t.i.o.n. .=. ....w....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. .!q.l...S.g.RD}Ka.0\.n.;...e.[. .L.i.t.e.M.a.n.a.g.e.r. ..g.R?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. .!q.l-..[ .L.i.t.e.M.a.n.a.g.e.r. .:O.ghV.g.R_U.R!j._.0....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. .!q.l-..[ .L.i.t.e.M.a.n.a.g.e.r. .:O.ghV.g.R_U.R!j._.0\.n.;....e.._j.\|q}.0....f.m._.s.e.t.t.i.n.g.s._.r.e.s.t.a.r.t._.s.e.r.v.i.c.e._.t.o._.a.p.p.l.y. .=. ....e_U.R .L.M. .:O.ghV.a(u.z._.NWY(u...f.0....f.m._.s.e.c.u.r.i.t.y._.f.o.r.c.e._.g.u.e.s.t. .=. .7_6R.O.(Wdk.\|q}.N-..[.....asTW.@b.g.}..O(u.....S.g.O.X[.S.kP..0 .!q.l.O(u.07_

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Turkish.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	58794
Entropy (8bit):	3.642324420313977
Encrypted:	false
SSDEEP:	768:D+XPobz4qFlRiiXc0HwgHSSxnrKT7nke7GShFBy/x97fuTLY57aC7I/Fj:yPQMw1ZOT7kef1y/X7fuTq4j
MD5:	606DC375E898D7221CCB7CEB8F7C686B
SHA1:	26DCF93876C89283623B8150C1B79EDB24B6A7EC
SHA-256:	F442E440580EA35040E35BF1D85A118E7C182FDE0B9BA2A3C1816DEAB5F822BB
SHA-512:	9FBC42165B51A2020D2DA2FFE33287A4F3AA33639126813B290D329D47C4F4DA8F297A47AF3C1F63AF6F9E1BA47ACE840BC1660D603E17589E5DB6DDA0E1E5B1
Malicious:	false
Preview:	..[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d.=.1.0.5.5.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...c.o.m./.....q.u.e.s.t.i.o.n. .=. .S.o.r.u.....e.r.r.o.r. .=. .H.a.t.a.....i.n.f.o.r.m.a.t.i.o.n. .=. .B.i.l.g.i.....n.o.t.i.f.i.c.a.t.i.o.n. .=. .B.i.l.d.i.r.i.m.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. .H.i.z.m.e.t. .y.a.p.1.l.a.n.d.1.r.m.a.s.1. .o.k.u.n.a.m.1.y.o.r...\.n.;.L.i.t.e.M.a.n.a.g.e.r. .h.i.z.m.e.t.i.n.i. .y.e.n.i.d.e.n. .y...k.l.e.m.e.k. .m.i. .i.s.t.i.y.o.r.s.u.n.u.z.?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. .L.i.t.e.M.a.n.a.g.e.r. .h.i.z.m.e.t. .b.a._.l.a.n.g.1... .m.o.d.u.n.u. .a.y.a.r.l.a.y.a.m.1.y.o.r.......f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. .L.i.t.e.M.a.n.a.g.e.r. .h.i.z.m.e.t. .b.a._.l.a.n.g.1... .m.o.d.u.n.u. .a.y.a.r.l.a.y.a.m.1.y.o.r...\.n.;.S.i.s.t.e.m.i. .y.e.n.i.d.e.n. .b.a._.l.

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Ukrainian.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (305), with CRLF line terminators
Category:	dropped
Size (bytes):	87912
Entropy (8bit):	4.303374267443204
Encrypted:	false
SSDEEP:	768:VUlHxa/yEOYEJNHWjlUu1pZ26ER2nkUTbfk74Q:aNxWREb4lUu1P29R2JbfC4Q
MD5:	3FC082E8F516EAD9FC26AC01E737F9EF
SHA1:	3B67EBCE4400DDCF6B228E5668F3008561FB8F21
SHA-256:	3DC0CEAE11F445B57B17B7C35A90B5133E313CF6B61550AB418252C5B8089C99
SHA-512:	9A9D20AF2F8C27056F58AB5A9C687F5124CE5F6D563E396C9558331FB8BE48E88E148B1FDC548A5EBDEDB451E3D89F2F96856F3BBFD695691D5687599F376421
Malicious:	false
Preview:	..[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d. .=. .1.0.5.8.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...r.u./.....q.u.e.s.t.i.o.n. .=. ...8.B.0.=.=.O.....e.r.r.o.r. .=. ...>.<.8.;.:.0.....i.n.f.o.r.m.a.t.i.o.n. .=. ...=.D.>.@.<.0.F.V.O.....n.o.t.i.f.i.c.a.t.i.o.n. .=. ...>.2.V.4.>.<.;.5.=.=.O.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. ...5.<.>.6.;.8.2.>. .?.@.>.G.8.B.0.B.8. .:.>.=.D.V.3.C.@.0.F.V.N. .A.;.C.6.1.8...\.n.;...5.@.5.2.A.B.0.=.>.2.8.B.8. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. ...5.<.>.6.;.8.2.>. .2.A.B.0.=.>.2.8.B.8. .@.5.6.8.<. .7.0.?.C.A.:.C. .A.;.C.6.1.8. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.......f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. ...5.<.>.6.;.8.2.>. .2.A.B.0.=.>.2.8.B.8. .@.5.6.8.<. .7.0.?.C.A.:.C. .A.;.C.6.1.8. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.

C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6307408
Entropy (8bit):	6.5944937257467116
Encrypted:	false
SSDEEP:	98304:NwiA/GmKEt3LQ7V8z3uHWkd49GMdqOxaB:NOGmKEt31kd2dqwaB
MD5:	63D0964168B927D00064AA684E79A300
SHA1:	B4B9B0E3D92E8A3CBE0A95221B5512DED14EFB64
SHA-256:	33D1A34FEC88CE59BEB756F5A274FF451CAF171A755AAE12B047E678929E8023
SHA-512:	894D8A25E9DB3165E0DAAE521F36BBD6F9575D4F46A2597D13DEC8612705634EFEA636A3C4165BA1F7CA3CDC4DC7D4542D0EA9987DE10D2BC5A6ED9D6E05AECB
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: gBYz86HSwI.msi, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f..................C..F........C.......C...@.......................... i.......`..........@................... N.......M..A...@T...............`.P"...PN.<............................@N.......................M.......N......................text.....C.......C................. ..`.itext...0....C..2....C............. ..`.data... 3....C..4....C.............@....bss........0E..........................idata...A....M..B....E.............@....didata.......N......LE.............@....edata....... N......ZE.............@..@.tls....X....0N..........................rdata..]....@N......\E.............@..@.reloc..<....PN......^E.............@..B.rsrc........@T......DK.............@..@............. i.......`.............@..@................

C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7753808
Entropy (8bit):	6.615075046955521
Encrypted:	false
SSDEEP:	98304:D4/WZQ7lc63BJGS1VFeIEll251o7+YcMBk2VVyN/RTfCAFIqOx9N:DXQ7SIEXeMBk2V4N/Nq2Iqw9N
MD5:	F3D74B072B9697CF64B0B8445FDC8128
SHA1:	8408DA5AF9F257D12A8B8C93914614E9E725F54C
SHA-256:	70186F0710D1402371CE2E6194B03D8A153443CEA5DDB9FC57E7433CCE96AE02
SHA-512:	004054EF8CDB9E2FEFC3B7783574BFF57D6D5BF9A4624AD88CB7ECCAE29D4DFD2240A0DC60A14480E6722657132082332A3EC3A7C49D37437644A31E59F551AF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...w#.f.................ZU... ......qU.......U...@.......................... ........v..........@...................._......`_..K....g.. ............v.P"...._.4............................._..................... m_.\|....._......................text....&U......(U................. ..`.itext..$1...@U..2...,U............. ..`.data....@....U..B...^U.............@....bss....0.....V..........................idata...K...`_..L....V.............@....didata......._.......V.............@....edata........_.......V.............@..@.tls....`....._..........................rdata..]....._.......V.............@..@.reloc..4....._.......V.............@..B.rsrc.... ....g.. ....^.............@..@............. ........v.............@..@................

C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	999944
Entropy (8bit):	6.626732213066839
Encrypted:	false
SSDEEP:	12288:SA9+TVJdg0YMgqAahyv0jKdTq4lrBhqSq/rt8VwGFrt:SRho0lgqA6yvnrBhq/rQDt
MD5:	ED32E23322D816C3FE2FC3D05972689E
SHA1:	5EEA702C9F2AC0A1AADAE25B09E7983DA8C82344
SHA-256:	7F33398B98E225F56CD287060BEFF6773ABB92404AFC21436B0A20124919FE05
SHA-512:	E505265DD9D88B3199EB0D4B7D8B81B2F4577FABD4271B3C286366F3C1A58479B4DC40CCB8F0045C7CD08FD8BF198029345EEF9D2D2407306B73E5957AD59EDF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...`.-\.................J...........X.......`....@.................................................................. ...................@...........0.......@.. O...................................................................................text...0?.......@.................. ..`.itext..8....P.......D.............. ..`.data....:...`...<...N..............@....bss.....]...............................idata..............................@....didata.............................@....edata....... ......................@..@.rdata..E....0......................@..@.reloc.. O...@...P..................@..B.rsrc....@.......@..................@..@.....................0..............@..@........................................................

C:\Program Files (x86)\LiteManager Pro - Server\Russian.lg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	94772
Entropy (8bit):	4.284840986247552
Encrypted:	false
SSDEEP:	768:r1kyTyZFOTb6QeZGJXYbFAMrKARuZk7FRwZoFTa2n:rn+2iZGhYbK4KARpAoFTa2n
MD5:	0E204FABE68B4B65ED5E0834651FB732
SHA1:	B338A6E54AA18F3F8A573580520F16C74A51F3D2
SHA-256:	302373D81F0AE15589206420CB01A266804C9FD1C1FF0D6E09CE6BA3FEF92B64
SHA-512:	AAD76F6A76DC693D959389CE471BC585D0DA72737FED99F42F219FDC7C71617C00E8003A467092E12820A359D672C6FB80D99772F3F6433923B2ABB7EEA40F08
Malicious:	false
Preview:	..[._.s.y.s.t.e.m.].....l.a.n.g.u.a.g.e._.i.d.=.1.0.4.9.........[._.m.e.s.s.a.g.e.s.].....w.e.b._.s.i.t.e. .=. .h.t.t.p.:././.l.i.t.e.m.a.n.a.g.e.r...r.u./.....q.u.e.s.t.i.o.n. .=. ...>.?.@.>.A.....e.r.r.o.r. .=. ...H.8.1.:.0.....i.n.f.o.r.m.a.t.i.o.n. .=. ...=.D.>.@.<.0.F.8.O.....n.o.t.i.f.i.c.a.t.i.o.n. .=. ...?.>.2.5.I.5.=.8.5.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.r.e.a.d._.c.o.n.f.i.g.u.r.a.t.i.o.n. .=. ...5.2.>.7.<.>.6.=.>. .?.@.>.G.8.B.0.B.L. .:.>.=.D.8.3.C.@.0.F.8.N. .A.;.C.6.1.K...\.n.;...5.@.5.C.A.B.0.=.>.2.8.B.L. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.?.....f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e. .=. ...5.2.>.7.<.>.6.=.>. .C.A.B.0.=.>.2.8.B.L. .@.5.6.8.<. .7.0.?.C.A.:.0. .A.;.C.6.1.K. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r.......f.m._.s.e.t.t.i.n.g.s._.u.n.a.b.l.e._.s.e.t._.s.t.a.r.t.u.p._.m.o.d.e._.r.e.s.t.a.r.t. .=. ...5.2.>.7.<.>.6.=.>. .C.A.B.0.=.>.2.8.B.L. .@.5.6.8.<. .7.0.?.C.A.:.0. .A.;.C.6.1.K. .L.i.t.e.M.a.n.a.g.e.r. .S.e.r.v.e.r...\.n.

C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7752272
Entropy (8bit):	6.615186281886958
Encrypted:	false
SSDEEP:	98304:y4/WZQ7lc63BJGS1VFeIEll251o7+YcMBk2VVyN/RTfCEFIqOxJn:yXQ7SIEXeMBk2V4N/NqiIqwJn
MD5:	84FB34E529BEDE393A3F604EAA8137B2
SHA1:	195EA03B7BD086454A13C0D8357E0A9E447D9EC9
SHA-256:	1E396C4066AC8F421A54893442A0D76C4F8D4146E63825D67DFC0DA782E73EE5
SHA-512:	A48A80D62E588667B4C891CDED279BABFFA5FB4FDF092F345212F81D29A9ACAA06E6DB27B49DC601909409A3C82AA9272BCDF90D0AE1738E83E80D9FCA4D93E6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f.................ZU... ......qU.......U...@.......................... ........v..........@...................._......`_..K....g..............(v.P"...._.4............................._..................... m_.\|....._......................text....&U......(U................. ..`.itext..$1...@U..2...,U............. ..`.data....@....U..B...^U.............@....bss....0.....V..........................idata...K...`_..L....V.............@....didata......._.......V.............@....edata........_.......V.............@..@.tls....`....._..........................rdata..]....._.......V.............@..@.reloc..4....._.......V.............@..B.rsrc.........g.......^.............@..@............. .......(v.............@..@................

C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11361360
Entropy (8bit):	6.496049600782297
Encrypted:	false
SSDEEP:	98304:AshiRp5hPI7N9sSA5wbZXJOu/0uOXZYfmQYanSjS+cWuNOlQpgfYLyPsd+QgBBP5:Al5hPwgvyAjDjS+igfgym+bHJxmK
MD5:	B0E355EC3453C8FFAEE08CD4257E96F2
SHA1:	0FA023CA8F1C1ECDADDE3DD3BD551870C2D965E2
SHA-256:	60248BA026064B116E4F94020DABB74DF519F5B4C41379CA19A38D725692CA8E
SHA-512:	B6004F83FD78EED84BF21611EFA45F2FFADF3625E0A2FDCDAE531B4734A4B886EBFE5EBE990DA42302B7368282D83DFFEF19E71DA8EC4C155EE5C8619AD028DD
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......f..................v..67.......v...... v...@..........................0...................@...................p...........L...p....+..........:..P"...................................................................`.......................text.....u.......u................. ..`.itext...6....u..8....u............. ..`.data....R... v..T....v.............@....bss.........w..........................idata...L.......N...Xw.............@....didata......`........w.............@....edata.......p........w.............@..@.tls....`................................rdata..].............w.............@..@.reloc................w.............@..B.rsrc.....+..p....+.................@..@.............0.......:..............@..@................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263314484439825
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0q:9JZj5MiKNnNhoxuz
MD5:	1E2FF4CF80E012EAA009B71753577CF6
SHA1:	49EA58617A6879EBD7DCD6495CCB66B5EA7E2714
SHA-256:	47F5B233797D7FF9B374AF6AFA348DEC654AD53AC32F85F4074569560F3E8F61
SHA-512:	4600AB86435E8A3D0518C09AEA2BA9BFC87D4DA10C062DF3DCABB8781FBC1FB044C950459AE36EC053B0B309072BD8996863F8C43E29A95D829F7FDCC2ED0B0E
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x05ca8312, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7556235518796398
Encrypted:	false
SSDEEP:	1536:tSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:tazaSvGJzYj2UlmOlOL
MD5:	96102E831474275454D9086E7779BFD3
SHA1:	38FD965FD81216B29EA3323ABDA6A27FB34FA228
SHA-256:	41CBF407B5D9DECEDCA987BBFB69C25A68529D2CD6164279D2C3C1484F6E9BF7
SHA-512:	A036B6EB5F4FF7D940E1760573E7A131F03E7D22E963675F6407554F96078A9C125BED19DAD8342517B4445FCEC054ED4D225F36F5AA0A7D1192A467987E76C7
Malicious:	false
Preview:	...... .......7.......X\...;...{......................0.e......!...{?. %...\|y.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................... %...\|...................... %...\|y..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07985720377107716
Encrypted:	false
SSDEEP:	3:FltEYeyRtENaAPaU1ltgNHaYlluxmO+l/SNxOf:f6zzNDPaUEaIgmOH
MD5:	48397126274E32321759EEF38C0ECAB3
SHA1:	FC6A9E145C530D5D0916ED25ACD544DD1A33992F
SHA-256:	FEFB049DDA4586B663D6F4FB99F011C25A68993351FD22B2EA661B51406DCA5D
SHA-512:	8A17A22A822C3F21BDE5F097E117B9F80E6D40D670758896EA42AFE44E5B972C2EF4A20786229D7B0ACB983495046BC5C384BAA5377CA9AF1D5DCA16F45EA141
Malicious:	false
Preview:	.M.......................................;...{.. %...\|y..!...{?..........!...{?..!...{?..g...!...{?..................... %...\|y.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Settings for LM-Server.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Aug 22 17:41:10 2024, mtime=Wed Oct 30 20:37:38 2024, atime=Thu Aug 22 17:41:10 2024, length=7753808, window=hide
Category:	dropped
Size (bytes):	2167
Entropy (8bit):	3.9186212068596498
Encrypted:	false
SSDEEP:	48:8z2PxadOq49EKDZd5Y+d5YsP5qoZkmrSUp8JWqoZkmtWEh:8zqIaEp9O5qoZbcJWqoZbt
MD5:	8FAF532A493D9ACCB2AA42024CA01785
SHA1:	B0137E61AF800BBB6B70D2DB42BA7929EF3A15E0
SHA-256:	A013EE9C6838FFD225AEB1C83FD0BA1CB8AF18CACBE24F93FB19C5AF9B0FD3DE
SHA-512:	A64EF60672E5E514DFEFDCBB5BD7E0D32CBD9AFA82CE3FADEB1D18395F5B6FBB1E8F8E9303844300B4580D15DBF29491E960245A40CD2909D9187B7D889B4EBA
Malicious:	false
Preview:	L..................F.@.. .....>.....Y3...+....>.....PPv..........................P.O. .:i.....+00.../C:\.....................1.....^Y....PROGRA~2.........O.I^Y......................V.....E...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....z.1.....^Y....LITEMA~1..b......^Y..^Y................................L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.....h.2.PPv..Y%. .ROMSER~1.EXE..L.......Y%.^Y................................R.O.M.S.e.r.v.e.r...e.x.e.......l...............-.......k..............q.....C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe..L.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.R.O.M.S.e.r.v.e.r...e.x.e.0.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.../.c.o.n.f.i.g.n.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.\

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Start LM-Server.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1890
Entropy (8bit):	3.1573107695942624
Encrypted:	false
SSDEEP:	48:8ddOEPLqd5Y+d5YcCP5q2DT2S0Wq2DTKX7:85LJ9cM5qUoWqUE
MD5:	5FC67E19699B3F0B2AB7B4B89B0B3F1A
SHA1:	6F6380DF2EB8C5D30452A846864F001A8B0E473A
SHA-256:	45451F933B472FA53301D46B7C072AF67E51EC60172E6E9C01E0B308DF78A2F4
SHA-512:	81C7A9F5683DB54893BD26A6EC1BCBDB17983037668CD996E03934E7708331594195DBF2CCE9EB2B0C0567A9E8B24DD629D40866D49E55C9DF77A864D15744E5
Malicious:	false
Preview:	L..................F.@...........................................................P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)..."...1...........LiteManager Pro - Server..b............................................L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r...(.h.2...........ROMServer.exe.L............................................R.O.M.S.e.r.v.e.r...e.x.e.......L.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.R.O.M.S.e.r.v.e.r...e.x.e.0.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.../.s.t.a.r.t.n.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.\.R.O.M.S.e.r.v.e.r...e.x.e._.9.D.0.9.B.2.B.C.2.5.A.2.4.1.4.C.B.D.8.4.8.E.2.B.7.5.8.9.8.6.7.6...e.x.e.........%SystemRoot%\In

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Stop LM-Server.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Aug 22 17:41:10 2024, mtime=Wed Oct 30 20:37:38 2024, atime=Thu Aug 22 17:41:10 2024, length=7753808, window=hide
Category:	dropped
Size (bytes):	2159
Entropy (8bit):	3.9055133595379576
Encrypted:	false
SSDEEP:	48:8A2PxadOF4bHDZd5Y+d5Ys5qcxFWT84SslWqcxFWT8cWEh:8AqHG29s5qcxYT8SWqcxYT8c
MD5:	596CF30C4C3FE957C86E1664F21611C8
SHA1:	460BA786B65CF7C3159FE91EE839508A7FE27739
SHA-256:	37041F60D546FF4E74BA3AA331CA0A2CDCB00561E7545D8BB682CF031340A5DC
SHA-512:	2BC76196F9275571B2053F2D78FFC519792093EE9D5C72A6F70DAE1B17E33E23DC40A41D2886DC90750EFADC6A86806BD42B77554BAB4D3BCF7BDA8AFCB695C5
Malicious:	false
Preview:	L..................F.@.. .....>..........+....>.....PPv..........................P.O. .:i.....+00.../C:\.....................1.....^Y....PROGRA~2.........O.I^Y......................V.....E...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....z.1.....^Y....LITEMA~1..b......^Y..^Y.............................,..L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.....h.2.PPv..Y%. .ROMSER~1.EXE..L.......Y%.^Y................................R.O.M.S.e.r.v.e.r...e.x.e.......l...............-.......k..............q.....C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe..L.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.R.O.M.S.e.r.v.e.r...e.x.e.0.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.L.i.t.e.M.a.n.a.g.e.r. .P.r.o. .-. .S.e.r.v.e.r.\.../.s.t.o.p.l.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.\.s.t

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiteManager Pro - Server\Uninstall LiteManager - Server.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Sat Dec 7 08:10:02 2019, mtime=Thu Oct 5 05:29:05 2023, atime=Sat Dec 7 08:10:02 2019, length=59904, window=hide
Category:	dropped
Size (bytes):	1953
Entropy (8bit):	3.8777721725611816
Encrypted:	false
SSDEEP:	24:8WQ6JpvlM+CbBBAhwB+sHyjv/+MTyjvejIKZDUHwGS7ke4WTyjvejIKZDUHwwck8:8WlXvob40HOn5qmjlt6ScWqmjltZ+
MD5:	74A14624ACBA1BCAC5CFAEE22E468316
SHA1:	4B3E527FB5C55622FA36AA7CF885566FD9AB11A4
SHA-256:	B613BACD48C3550F79D6C30F7FEAD2205C9A7ADA002522A51E0055B14C0CFA72
SHA-512:	22136CF3A279BCEC75F1F307E9B8A8745CCE5D2FD6633E7ACB4A9EBFB05D8CE391136B2912329B3D3A9592E4DAB8EC46E81EFF761B78D5AA97DE18CB444E4217
Malicious:	false
Preview:	L..................F.@.. ...25.....Y9==U...25.............................A....P.O. .:i.....+00.../C:\...................V.1.....EW.5..Windows.@......OwH^Y......3.......................X.W.i.n.d.o.w.s.....Z.1.....^Y....SysWOW64..B......O.I^Y......Y....................."5..S.y.s.W.O.W.6.4.....b.2......OBI .msiexec.exe.H......OBIEWf3................\|.............m.s.i.e.x.e.c...e.x.e.......N...............-.......M..............q.....C:\Windows\SysWOW64\msiexec.exe........\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.m.s.i.e.x.e.c...e.x.e.)./.x. .{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.s.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.1.F.F.A.4.7.5.-.2.4.D.5.-.4.4.F.B.-.A.5.1.F.-.3.9.B.6.9.9.E.3.D.8.2.C.}.\.U.N.I.N.S.T._.U.n.i.n.s.t.a.l.l._.L._.7.8.A.A.5.B.6.6.6.2.5.1.4.D.9.4.A.8.4.7.D.6.C.6.0.3.A.F.0.8.9.5...e.x.e.........%SystemRoot%\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C6

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.187114693798316
Encrypted:	false
SSDEEP:	6:6IbtuVlyq2PN72nKuAl9OmbnIFUt8vIbvjz1Zmw+vIbvjlRkwON72nKuAl9Ombjd:6hVIvVaHAahFUt8v+z1/+v+z5OaHAaSJ
MD5:	C915BC9E26B12B965A22652E5F99607D
SHA1:	251CCB41E475E29D4081A003F46455A9DC54E7AD
SHA-256:	D2DA8287D9CD7DF2AFAE69784A17C0E956FC5DFC119A00D3FB1B1B2713B43D39
SHA-512:	714BBF0C6817EFACDE3EB4BB599C198630883EB14F3DC68AD1863B9440BB2BB8DF641F49F797912C91175B5DEF020063D0243F3C72D7A27013C47EB71DEB1C6F
Malicious:	false
Preview:	2024/10/30-17:37:32.606 19e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/30-17:37:32.614 19e4 Recovering log #3.2024/10/30-17:37:32.614 19e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.187114693798316
Encrypted:	false
SSDEEP:	6:6IbtuVlyq2PN72nKuAl9OmbnIFUt8vIbvjz1Zmw+vIbvjlRkwON72nKuAl9Ombjd:6hVIvVaHAahFUt8v+z1/+v+z5OaHAaSJ
MD5:	C915BC9E26B12B965A22652E5F99607D
SHA1:	251CCB41E475E29D4081A003F46455A9DC54E7AD
SHA-256:	D2DA8287D9CD7DF2AFAE69784A17C0E956FC5DFC119A00D3FB1B1B2713B43D39
SHA-512:	714BBF0C6817EFACDE3EB4BB599C198630883EB14F3DC68AD1863B9440BB2BB8DF641F49F797912C91175B5DEF020063D0243F3C72D7A27013C47EB71DEB1C6F
Malicious:	false
Preview:	2024/10/30-17:37:32.606 19e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/30-17:37:32.614 19e4 Recovering log #3.2024/10/30-17:37:32.614 19e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1723822181541665
Encrypted:	false
SSDEEP:	6:6Ib0q2PN72nKuAl9Ombzo2jMGIFUt8vIbJZZmw+vIbJzkwON72nKuAl9Ombzo2jz:6XvVaHAa8uFUt8vI/+vQ5OaHAa8RJ
MD5:	A3FD99CAB3E47368C462BE91D76C9D58
SHA1:	98C3C473BA242A9FF69ED0602F01DCA21808E88D
SHA-256:	208FBAA3F8ABAE90405EEBEB2A495BFC3FC7A0D157D47538A4924EBFE1C1FA84
SHA-512:	A6D60A6A36A29ADE87D5E96C9F3F8A255C4D2553BD18DD1AC325DDF40E577B612BAB480369D479FB0F44C17026988A227CE49765B9A7AD4AB07581567AC0EC94
Malicious:	false
Preview:	2024/10/30-17:37:32.676 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/30-17:37:32.678 1c34 Recovering log #3.2024/10/30-17:37:32.678 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1723822181541665
Encrypted:	false
SSDEEP:	6:6Ib0q2PN72nKuAl9Ombzo2jMGIFUt8vIbJZZmw+vIbJzkwON72nKuAl9Ombzo2jz:6XvVaHAa8uFUt8vI/+vQ5OaHAa8RJ
MD5:	A3FD99CAB3E47368C462BE91D76C9D58
SHA1:	98C3C473BA242A9FF69ED0602F01DCA21808E88D
SHA-256:	208FBAA3F8ABAE90405EEBEB2A495BFC3FC7A0D157D47538A4924EBFE1C1FA84
SHA-512:	A6D60A6A36A29ADE87D5E96C9F3F8A255C4D2553BD18DD1AC325DDF40E577B612BAB480369D479FB0F44C17026988A227CE49765B9A7AD4AB07581567AC0EC94
Malicious:	false
Preview:	2024/10/30-17:37:32.676 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/30-17:37:32.678 1c34 Recovering log #3.2024/10/30-17:37:32.678 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\641cf2a0-bed9-457c-871f-f190488ac959.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF54649d.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b870c142-0d62-4489-8fbd-e8f8ef761c2c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.968905002143365
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqcMhsBdOg2HH8caq3QYiubcP7E4TX:Y2sRds4ydMHf3QYhbA7n7
MD5:	311C0D2435716305AB7C3FD49097CDE9
SHA1:	9E6E2E55DED649DF061E42D22B7D55764ED4A459
SHA-256:	C455A9BB6537F00C8A0E4BC0A89B039303DFB44803593F6CD4DDAD3B8213B51B
SHA-512:	17BBE0D132D3068526F344BA3CB3A471CA76DEFB4C2C9EDDB20995C57644CE7C2643DB96B3EA791439D3F355CC54E2A322201CD3C55687ACCB8A23D469E75125
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374884264380776","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":208345},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.25178179866612
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7Ljh6s:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhZ
MD5:	39D238AA7A79BD6F2231356982894883
SHA1:	30B414AAD675E6AB7D8AF454DEE04B68D22ED261
SHA-256:	A5643A8DF771214E3B2914AF20B27ABD1F3C9825A8C87FDF32BFA4A4249A264A
SHA-512:	A61F6FFA62B35357E7681BE8D34C641303C8B3EAE0B7EA8955884733278378D0F12E13CD37E2A6B9D982A3FEDEB8CFAF5BC42CCB217E5B930CE5DB4297A36D5E
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.171926039998405
Encrypted:	false
SSDEEP:	6:6IbBq2PN72nKuAl9OmbzNMxIFUt8vIbbGWZmw+vIbwFkwON72nKuAl9OmbzNMFLJ:6yvVaHAa8jFUt8vSGW/+vb5OaHAa84J
MD5:	E51B539DF956C4DB8390AC378A67332D
SHA1:	F9379800792563F43EA3B798C41EAEC13FCC05B1
SHA-256:	5295A0B6D4A42953F5DF571C17D8EF7BEBFAE38521FF9E9DC15A8D7B3D41E148
SHA-512:	9E86CAF48C4DE23D407D9FEDADEF19BAB244E709D472A07BF66588D27DCE140B814713ECC8E6A58084D6E01E658CFE48CE024FA9AB11AD56B31CBD412CB4DF9B
Malicious:	false
Preview:	2024/10/30-17:37:32.824 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/30-17:37:32.825 1c34 Recovering log #3.2024/10/30-17:37:32.826 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.171926039998405
Encrypted:	false
SSDEEP:	6:6IbBq2PN72nKuAl9OmbzNMxIFUt8vIbbGWZmw+vIbwFkwON72nKuAl9OmbzNMFLJ:6yvVaHAa8jFUt8vSGW/+vb5OaHAa84J
MD5:	E51B539DF956C4DB8390AC378A67332D
SHA1:	F9379800792563F43EA3B798C41EAEC13FCC05B1
SHA-256:	5295A0B6D4A42953F5DF571C17D8EF7BEBFAE38521FF9E9DC15A8D7B3D41E148
SHA-512:	9E86CAF48C4DE23D407D9FEDADEF19BAB244E709D472A07BF66588D27DCE140B814713ECC8E6A58084D6E01E658CFE48CE024FA9AB11AD56B31CBD412CB4DF9B
Malicious:	false
Preview:	2024/10/30-17:37:32.824 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/30-17:37:32.825 1c34 Recovering log #3.2024/10/30-17:37:32.826 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444889464478298
Encrypted:	false
SSDEEP:	384:ye6ci5tNiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mms3OazzU89UTTgUL
MD5:	154427F3E5DDF0A177197A6E3DB20175
SHA1:	189ED1CDB041E4462E2389AF3938D23A1CBA155D
SHA-256:	D970420244EF1D7EB57C74FE54B916F92C1C4BFAE895F0B89A3980331C74932A
SHA-512:	BFA433A6628D2CF1CFDDA8F8A0665BA623C9B469A957FEDE1BE445CBC645CA9936B08B38299384BDFD1E8E5A16EA685059B9CFDA1DC7AD204717808E55A479B7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7649227966652496
Encrypted:	false
SSDEEP:	48:7MIJioyVfDoioyeDdoy1C7oy16oy1MDhKOioy1noy1AYoy1Wioy1oioykioyBoyT:7LJukCNXjBiXb9IVXEBodRBkBB
MD5:	1323B0B6C2958530BD5E07A8B48901AF
SHA1:	A1E3E2ACF1FA29280D5650705B08B7BB3E465741
SHA-256:	CB7E06AFEF662706470D2085FEB2EE318EC7B0BDEB16EDB1CE5D3B2F00704CDE
SHA-512:	ADFC039CBD7B604D0F6D096E640FF34D58B7FF52E571D4163BBF76DA3A63DF9CF4C9FAC13154CAD0F8E06AF8623DC148CD16014198786DDDA6F87F3FB5500083
Malicious:	false
Preview:	.... .c.....R6.b...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7673182398396405
Encrypted:	false
SSDEEP:	3:kkFklru1kfllXlE/HT8kzl1NNX8RolJuRdxLlGB9lQRYwpDdt:kK919T8e7NMa8RdWBwRd
MD5:	4A2B1B20FB08AB1675AA76B878815D15
SHA1:	9B9FF8419742C5EBF0AFB0C9748BA0217B90FF35
SHA-256:	77D5CB314EB9799648CD05B7CF46D422AFB3CFA9F164D13DB9CE08769DEAD52A
SHA-512:	8543224F8FBF62EE152520B7D33D242E5F20EE1E2BE7482054378569F0BC63700E0E290ABE203606B6F3F2E03B07F53C132E2392DFEF21A04954B968BDBC6961
Malicious:	false
Preview:	p...... .........K...+..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1501841598665044
Encrypted:	false
SSDEEP:	6:kKnI+EF9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:osDnLNkPlE99SNxAhUe/3
MD5:	0C34E7BF39BDBFD14372E16612ABF621
SHA1:	2DD6AA9D672E186F0BEDEE752A6BBD588768498D
SHA-256:	6F618B26A4B140CC7D7177DFD020DFCA35F53E0AF0676AB98D3CF992A3C209F1
SHA-512:	234B314F9A4074DC525FDEAD5F2B0E0EDF5A623E748F96263BB70CB14EA7FF9E36D188D75A508318146E20A6F4B77E7C1EB40294B69EE095A73FE7AA774A5E43
Malicious:	false
Preview:	p...... ........RH6..+..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4544

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.352346456799572
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+FR/0nZiQ0Y6ieoAvJM3g98kUwPeUkwRe9:YvXKX+FR/0cqGMbLUkee9
MD5:	7BD70F73ED37DC70A7872DDAFFE93CFD
SHA1:	A34B05C5517C63D9AC02E9F79DBBDFD8890A6F84
SHA-256:	D8BDAC0E122F52A1B134F13B570D04B39146AC48889AD8E0FF3ACD61D394CD8E
SHA-512:	3B462327A62781A916BB74C810F2536B4D2231BF7B794CFBC73D348227738A1AE2CC94A11F7136804831240FD040B3F50254BBD435C3A3CB692C9F5C24114F85
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3256bb58-46b0-488c-b052-fa8ce20a47ad","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1730500496808,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.305993780274475
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+FR/0nZiQ0Y6ieoAvJfBoTfXpnrPeUkwRe9:YvXKX+FR/0cqGWTfXcUkee9
MD5:	A1A27CAF770408455CCE24684E61E52E
SHA1:	FE1F89EEC207022B076E74C01F79630B2682FFE9
SHA-256:	7FF51B153A2C8BA9C0D39EAADA05BC4619BF1082398C688931A02BB6F5695253
SHA-512:	C3A8648962E0F21F64EC4F05FCBBC21010876F66F73372181BEAAA862DE4B670F4355E418B115C0A01F0BF832BC3399E1C48BA48EAA5404CAD9CAD266137E9C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3256bb58-46b0-488c-b052-fa8ce20a47ad","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1730500496808,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.284253275632283
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+FR/0nZiQ0Y6ieoAvJfBD2G6UpnrPeUkwRe9:YvXKX+FR/0cqGR22cUkee9
MD5:	7DC784C42B51127954D4F8E641AB4981
SHA1:	32AAE245D5078F725332AFEECFCF37E1097AA52A
SHA-256:	13EF0176337FB53CE12523C8656E82891AA3C3CB18ED2EE3FFADD839F69E81F0
SHA-512:	87540312F5E18F8311443365ECE2B49859561D18DBA9A7EF9C7F69975D6B2CCD7517EB0F270D29A2EDD0EC4BB42268C8A63E60D04AAC1F894E7EBE6DD5E5CDA6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3256bb58-46b0-488c-b052-fa8ce20a47ad","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1730500496808,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.331982473533067
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+FR/0nZiQ0Y6ieoAvJfPmwrPeUkwRe9:YvXKX+FR/0cqGH56Ukee9
MD5:	48DF96368EB0FA5DB4928A68C6FD7F07
SHA1:	B67322D63E21A339DAC1DF1A0427ED1D76797B49
SHA-256:	975AE038022F7AB16E6D3BB8F9569E8C97DC1BE305F1F85D5B1F9721280A7248
SHA-512:	351846B92EDAB474C1A4CA47A6C94482F14F7FC5800F1886C1E5EF71298EA7BA7181C7B1766A3520C4FC80F2FF04C999EDAE4AED89EC6B8108BB5255E2BFB56F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3256bb58-46b0-488c-b052-fa8ce20a47ad","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1730500496808,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1055
Entropy (8bit):	5.658876450057217
Encrypted:	false
SSDEEP:	12:YvXKX+FR/0cqGBS8Ukee1hSkLEJ1KUHXcLfeoPhSOPhnlbRKRCmK8dKzOCLk9iZU:Yv6XqRnpLgEscLf7nnl0RCmK8czOCCSK
MD5:	536B129CE7DB9700EBDC2648138C97C9
SHA1:	6A38A5B2122C82F437DDEA1BFA4E8B5BD6E24204
SHA-256:	7468D870E37C78CF6266EF5ED5294DA04CE0238BCBC0AEDFBF6AE50A7755F342
SHA-512:	F455737AD5A9FAA2F4D52AC658EA2A359715E1570B94D16EF801FE30002B0E7DD4D44ED653C796A93205915B25196D93CBF35C7EA3CAC5DECBCD5BFE69EB0667
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3256bb58-46b0-488c-b052-fa8ce20a47ad","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1730500496808,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"92038_285529ActionBlock_1","campaignId":92038,"containerId":"1","controlGroupId":"","treatmentId":"eb1a4bce-8215-46f1-b44c-154b21a85d60","variationId":"285529"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNhdElkIjpudWxsfQ==","dataType":"application\/json","encodingScheme":tr

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.648906370877613
Encrypted:	false
SSDEEP:	24:Yv6XqRrVLgEF0c7sbnl0RCmK8czOCYHflEpwiVL:YvFFg6sGAh8cvYHWpwK
MD5:	E13A64EA3FA8528CAFCD37CFCA7A16AF
SHA1:	874B4EBF5ACD124625604E488C9961166B0232F4
SHA-256:	9B68D1161C9EBDFD1F7046A158CD394DBD631F29504098586B68DC0AE4F7DBD7
SHA-512:	4DEB233170AC6EEBEF1B1E9884CB1376E2CCAC1E1651A4CE6BB8259E8C247110AD74767674E386D4830F190723C294E54890D7A8C37B1F55269468FA08E72524
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3256bb58-46b0-488c-b052-fa8ce20a47ad","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1730500496808,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.286205561118061
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+FR/0nZiQ0Y6ieoAvJfQ1rPeUkwRe9:YvXKX+FR/0cqGY16Ukee9
MD5:	D98EF706F2261A37736722682D63BA42
SHA1:	845B990EDC3CD859B633F208E91FB9326B3B7BD1
SHA-256:	427743A4BDFD32AA1AFDBC2E37901905A46028ABF305DEC4B3A5B3F1FC28C5DC
SHA-512:	CCC1945524F5AB3775D9EE067AA2C34EF0E834E20C95C4EAF7AC2B6FC0A23553023C87E4E644E94B60306CE1B2E7DEF9E3271344216BC72C57B767740EF8CC0E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3256bb58-46b0-488c-b052-fa8ce20a47ad","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1730500496808,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1038
Entropy (8bit):	5.645356246627882
Encrypted:	false
SSDEEP:	24:Yv6XqR62LgEF7cciAXs0nl0RCmK8czOCAPtciBL:Yvkogc8hAh8cvAZ
MD5:	09D86F00DFCDB7CF043A4E4A2430FF85
SHA1:	C49263AD1CCD4F4CC7D03F1EE93A34116D63EDC0
SHA-256:	E81C758937D4DC2871D96D35583A585AB7EE0506892D78B5ACCC65F6CA5655A8
SHA-512:	24727E2AD5E861CF51AA5D549D333989988B1786834450616909224B9775BC612FBB2863DCCC61A1287F4B130881B3A386FD77B786B3339D0CD9094DBB834BD1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3256bb58-46b0-488c-b052-fa8ce20a47ad","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1730500496808,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_1","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"49d2f713-7aa9-44db-aa50-0a7a22add459","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1744

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.698032287157699
Encrypted:	false
SSDEEP:	24:Yv6XqRGKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5L:Yv0EgqprtrS5OZjSlwTmAfSK9
MD5:	ED4CA9A9321D8F574695D7DE44A758A7
SHA1:	5585962FB42CD2DD64A727F993480CD347E86305
SHA-256:	55B0661E7DC16C3ED07ACC59D96BF7EF2DDCE13F58C0B29BF48ECC59D5889116
SHA-512:	7A7F173A1829FB504E4C558632723DA710D613C9FAD9750981FFAA9CBA4A93FC94A4D2BAB42C894E83709F01D85448E8CF830973176DBB3F00509A98359F34ED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3256bb58-46b0-488c-b052-fa8ce20a47ad","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1730500496808,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290560899516134
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+FR/0nZiQ0Y6ieoAvJfYdPeUkwRe9:YvXKX+FR/0cqGg8Ukee9
MD5:	52A10ABA03A2E7DC9223E0ED4D198A7D
SHA1:	17286E83DA2C8992D8D82346CF21B411934039CB
SHA-256:	AEB10F4A5F21BDA16501B171BCD7AEB524AEC452A4E8DCC6FBB5AA476F8C38FC
SHA-512:	C61B293C50D4113A8BBF97D8E0FDD3F5CC97A00105137A1A2F34249C9BEB13A8572D38E06C2EB56F4017CD7B3EECFABE3F4C4C52500BD73CA510B55C9B25769E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3256bb58-46b0-488c-b052-fa8ce20a47ad","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1730500496808,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.775827445270176
Encrypted:	false
SSDEEP:	24:Yv6XqRNrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNj:YvbHgDv3W2aYQfgB5OUupHrQ9FJ9
MD5:	CAD6CFEF8699C415F643F5DB129E4A44
SHA1:	20A2F57882C252E8FC218167DE1FA45790C1BAD3
SHA-256:	013071909DFB1C14694A6574392C2C741AA77FF497EAB29DF3439C09B0892B87
SHA-512:	D1D73B463979201F321E13CA9DF429EF3F0DF53692DD0DDB1DDCEF88E0D729979386C031B3C1D1FC2CC199D2194A8AC030D9AB2C56407A999A92F3CEA4A8F561
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3256bb58-46b0-488c-b052-fa8ce20a47ad","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1730500496808,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2741728707328415
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+FR/0nZiQ0Y6ieoAvJfbPtdPeUkwRe9:YvXKX+FR/0cqGDV8Ukee9
MD5:	3500C7E4B6ADE08C8DDE494120A82117
SHA1:	1D98F55D04E489496A92D71C4744301B000E9DD2
SHA-256:	1B132937FA8E7E53FB38210F94CCD51A1277F68173D42F7B08E0DFCBEA9726ED
SHA-512:	564B0FBD96D28594531F40511B855EFC59A3DCEB39D385F9B4E1772C598862989DEF8B7EB5355BAB20C0CEE7FEACC3E6C4F6297802B0B0AC0D37F0BFF783F3A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3256bb58-46b0-488c-b052-fa8ce20a47ad","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1730500496808,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.277719405386787
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+FR/0nZiQ0Y6ieoAvJf21rPeUkwRe9:YvXKX+FR/0cqG+16Ukee9
MD5:	8043612413480FA91FB1D1430466A848
SHA1:	54E991F55A5E39DCC282082B32C982C0412974FE
SHA-256:	9A35351D3F6F772BE7CE4CA5E4D8E2F88B0A9ACB0CE68BEC3E4DB8E0D41B2343
SHA-512:	DEEDB52628600BB237A01CC596265181EAA30915367E4BE3B4F916EC42344C3C56DF638B1993EA62E0C42D834D4CAB21FD3924A98AAB6A3D5CB44BD07FC51421
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3256bb58-46b0-488c-b052-fa8ce20a47ad","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1730500496808,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	5.627936056719496
Encrypted:	false
SSDEEP:	24:Yv6XqRfamXayLgE7cMCBNaqnl0RCmK8czOC/BSK:YvlBgACBOAh8cvMK
MD5:	DFE514B0BB770BFD9555CDB3476DFE58
SHA1:	143A1C27DEFD4EAC9C3A9914AD5A864E914E8D3A
SHA-256:	95B5D556BED86078F2EAC78BFF186FF95E0CA9518B006A70CD280CC3465A13A4
SHA-512:	48363CEE1254E93D2776F7513D7C8E3B9F00780327ADB15B93BF95ADFA800A09F5ABFF22A3C862B5B269AE6EDE3EECEE9AC7C778930E483E64D10BA8E6857B6C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3256bb58-46b0-488c-b052-fa8ce20a47ad","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1730500496808,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"92038_285529ActionBlock_0","campaignId":92038,"containerId":"1","controlGroupId":"","treatmentId":"6291f52b-6cb0-4d31-bc46-37ce85e9eb25","variationId":"285529"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"application\/json","encodingScheme":true},"endDTS":1751323379000,"s

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.255020597661823
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+FR/0nZiQ0Y6ieoAvJfshHHrPeUkwRe9:YvXKX+FR/0cqGUUUkee9
MD5:	2E8E3D6D5B059174572DB260613A8D3B
SHA1:	13CC3E8E7ABCF4D93D172E397B5F9AC0C3DA7C74
SHA-256:	669B938A28EFC1C0F986A57AFCC6BF0E0AC0B77151AF7AE2DDA8FCF1F8F764EA
SHA-512:	9418AAEE18EBB8B03479A83DBD219619B0740FB082763404C85DE95F1652BAC8758FB7F3682EFBC9BF372389CB2E33B4A44ABC9F9CEAE16F2AB097A88C0D15C0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3256bb58-46b0-488c-b052-fa8ce20a47ad","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1730500496808,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.361058713965823
Encrypted:	false
SSDEEP:	12:YvXKX+FR/0cqGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWP:Yv6XqRE168CgEXX5kcIfANhK
MD5:	6B274BEBC6F155D75175D585F3F4F298
SHA1:	F6536CF61E1E0702226C75CE1523DFB49D3E7496
SHA-256:	BE12A9E2F746ECADD9AB3FFF023830300604BA292EA592005D077F43348E55A5
SHA-512:	3B720A2024CBCEF824354639BF776A56938EEB7C156AC5641ECA758B1805C4916C5CA2D4995C1B8847E215929A1B70C4BED2264290D437E4BA52E5FE71705ECE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3256bb58-46b0-488c-b052-fa8ce20a47ad","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1730500496808,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1730324261843}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2818
Entropy (8bit):	5.1284660473563495
Encrypted:	false
SSDEEP:	48:YX1d+01aNMcWGL/eAqxKDlwW7AMFF9hGC:k1wmXYzeAqxKDV7AMRN
MD5:	962F50C326FCBBB00654CF622F716C28
SHA1:	1A7A05AFE0CBF94E5264AFBCBDD114796716EC42
SHA-256:	F5E099647D16110FEEE5AB4283FACFB37B8F89ABA5A3847DA349EAC038E04972
SHA-512:	3749C7B3D3C67BA0A9ACBC2E0121D3F8738EE951B202844959BA5E0AA73EB3D809FCF554FD358EA18EE68B676039B5FC7FFE32DD8BAB69940DE989A82566B769
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"8fac37482178287737f59d7d2554729a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1730324261000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c0960843fbd68d41342f81583f5f0e57","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1730324261000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"141981174db3e2b65952662a1a10802e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1026,"ts":1730324261000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e3fae576cfeffc6f0d55e6cc3105ab27","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1055,"ts":1730324261000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"e2680222cd0d9d097c65b447e0efcc06","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1038,"ts":1730324261000},{"id":"Edit_InApp_Aug2020","info":{"dg":"04c77d24d2520016405d057ac9da12c5","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1467397457892317
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urslx7RZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudd:TFl2GL7ms3Xc+XcGNFlRYIX2v3kK
MD5:	4DBF2DEEAC995C34BD374B5338EE4BBD
SHA1:	F398507DBF4593F80B14501F6F9EC428A47BF750
SHA-256:	D4078C57C0DABE7A578AB4B974137C8245EDA265FEB520D432F47213579A70F8
SHA-512:	356BA40F00EE1B4A3FD3899424E56BBBC072EE4EC3966C33B2E0E4873D95956130505F776C5DBDF68D2C2A2AD1A847B2EF53F9FED366387E8D43A2146A8B3B00
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5527378303936723
Encrypted:	false
SSDEEP:	24:7+teFx7UXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLux5qLxx/XM:7MFXc+XcGNFlRYIX2vkqVl2GL7msO
MD5:	C302073CC5C3943C584291E96B529D53
SHA1:	37D2CD6B068C997C8E1D50844135A84F888AB203
SHA-256:	5DDDB904EB2EE8CE771A647A8634F43C0D5E45543CB7D86A42A6678D0F773E42
SHA-512:	945199973A37E2A0B92DA50D4A8597E62F1EB892E5023917FFA27EFEA3DB182366B9E380374D9AA442477F30027AAA4A83084BF378194A35E8CB4A938CF723C9
Malicious:	false
Preview:	.... .c.....;.O...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Doc.pdf

Download File

Process:	C:\Users\user\Desktop\0438.pdf.exe
File Type:	PDF document, version 1.7, 1 pages (zip deflate encoded)
Category:	dropped
Size (bytes):	125552
Entropy (8bit):	7.579988719622451
Encrypted:	false
SSDEEP:	1536:N0N5xSlECZcbZ42IlWpy67H/AvLpMpBXCF4KMvX6UkMZdEMLHMgifPdEoLIeLA+6:CNPSiJZ4xy8DlivXREMBOlEoMeLjCiQ
MD5:	7827620BA2CD12D54B41C006BA4D686C
SHA1:	F6B40CB23006AD0E1AFD4C08CA943A75258FAB34
SHA-256:	9DAA46F8D84B0E65E2D5FDF7FCD80FF6CA922278C32A2B5C9425C0C5EF7D2096
SHA-512:	9782FB4DBA6F62A589BF213AE5CCE3F66514319363F499B584DC854ACC1DCD94221102BDDAC982AA9DB36C5B7696BD1ABACF7C15771CDECC317B2F3421CCA321
Malicious:	false
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 11 0 R/MarkInfo<</Marked true>>/Metadata 22 0 R/ViewerPreferences 23 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 1/Kids[ 3 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R>>/ExtGState<</GS7 7 0 R/GS8 8 0 R>>/XObject<</Image9 9 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 188>>..stream..x.E.K..@.......R..!.4 .\|$FB.."ZH.+............x.h..!/."..f....X.Q.8M.D0aGK..+.J{x.....(.kJ.FBJ&\|.7J...H..f..%..Nory..M'...m9%g.......4.(AV&............2...H..B...Z..o.V#.c.....6k..endstream..endobj..5 0 obj..<</Type/Font/Subtype/TrueType/Name/F1/BaseFont/BCDEEE+Calibri/Encoding/WinAnsiEncoding/FontDescriptor 6 0 R/FirstChar 32/LastChar 32/Widths 20 0 R>>..endobj..6 0 obj..<</Type/FontDescriptor/FontName/BCDEEE+Calibri/Flags 3

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-30 17-37-34-836.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.341048719683436
Encrypted:	false
SSDEEP:	384:BEqBCsz9SglSEJ3onFWnuHreqpcBpO2Q3PtBv3HgYR/5/QG/9cGZFoFItqowYdtI:bvz
MD5:	FC43BCB1768E9DFDAEDA858FB84320E9
SHA1:	5A3E82FC65A69FA20954507F99F46090AB742F18
SHA-256:	221E7A774D1DD928DAEE430C3D23AAD0A78FAF8852CB2D00F15913916F55EBC5
SHA-512:	5ED5207F64A9A1BAA04F521721E33B3E52BF8E1972B880B3C5AB59B18EFE37F7E31BEDC796A000AB9E4304FF89B7151C5F1E52D0B60D828ED01C064E7C0999C8
Malicious:	false
Preview:	SessionID=96289418-a838-4aec-a8b9-ab3eea57c62d.1730324254858 Timestamp=2024-10-30T17:37:34:858-0400 ThreadID=7700 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=96289418-a838-4aec-a8b9-ab3eea57c62d.1730324254858 Timestamp=2024-10-30T17:37:34:867-0400 ThreadID=7700 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=96289418-a838-4aec-a8b9-ab3eea57c62d.1730324254858 Timestamp=2024-10-30T17:37:34:867-0400 ThreadID=7700 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=96289418-a838-4aec-a8b9-ab3eea57c62d.1730324254858 Timestamp=2024-10-30T17:37:34:867-0400 ThreadID=7700 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=96289418-a838-4aec-a8b9-ab3eea57c62d.1730324254858 Timestamp=2024-10-30T17:37:34:867-0400 ThreadID=7700 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398549207180001
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbNcb4dIblcbx:V3fOCIdJDeb6b6
MD5:	B712EED683FFCE095A62D24F961B50F9
SHA1:	1496602782F620A5D943F431EA84E9662A9A33BD
SHA-256:	92F3E822546079F2BB575958DBA43FA61B75DBC51F4E2C6B8F68867E038328F0
SHA-512:	244CBB141A997D13532C4020ACA67A2AB6ED6DBFA97A40D25EF3FD3212C1A74E0C2583FAB1424B82F04FAE9F60E69965917159D197D107416DBA110F51328903
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\61dfb46d-12b9-46b0-a89f-65f9501b32de.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\801585dc-f781-4125-83fb-131f875d10d8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\8436644c-cbef-44a9-9c93-af98e87b2a76.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZoYIGNPAIe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZW
MD5:	7569660AD84B4D0879B7218EE3F575B5
SHA1:	58BE6C40C47F0E508AA28EA187987CA9DD6498E7
SHA-256:	339782479B915684E2613D0CB9BA413B2A60C17E244A16A7120B7F518D60DAEE
SHA-512:	4C9EB20E27149F7540853C3D233B6D3C14EFDCE81C449B34DF33BFC1EEA58456E6AAEC9207912460D3C20861EB5826B277A62C329D5CAB4EA39ADB595B2A3C5A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\aa0d2b07-52df-450b-8f21-a7a03debda1e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\pdf.msi

Download File

Process:	C:\Users\user\Desktop\0438.pdf.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: LiteManager - Server 5.0 installation package, Comments: This installer contains the logic and data to install LiteManager Pro - Server 5.0, Keywords: Installer,MSI,Database, Subject: LiteManager Pro - Server, Author: LiteManagerTeam, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2015 - Premier Edition with Virtualization Pack 22, Last Saved Time/Date: Thu Aug 22 15:43:08 2024, Create Time/Date: Thu Aug 22 15:43:08 2024, Last Printed: Thu Aug 22 15:43:08 2024, Revision Number: {9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}, Code page: 0, Template: Intel;0,1033,1049
Category:	dropped
Size (bytes):	11554816
Entropy (8bit):	7.9382387394429115
Encrypted:	false
SSDEEP:	196608:9Jg0ovdgTGOk/J1yr/A9ODMlWyFISx8/191nYHiT88o8En03yEoH8WkJDFa:bAJoLA9OIlWy58/19J+iYNPEoHg0
MD5:	0C88F651EEA7EBD95DF08F6A492FCB38
SHA1:	93E622BB18056BB61DD11805D91AB1F9267CBD67
SHA-256:	A1FAAE4E2B695C7DF3846179192F4E67BD8DD05E7E5C6D0B4B72DB175F629076
SHA-512:	41F69CFCDA6EBB6DD6984D21B19E952BA25C78404B138FF25A8E16283D9080B5E2A85AF4973EC25A4F45F8D402163CCE96906F06F3FBA2068571F1F1ACBEA86C
Malicious:	false
Preview:	......................>...................................8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?...N...A...B...C...D...E...F...G...H...I...J...O...L...N...D.......P...Q...R...S...T...Z...V...W...X...Y....X..[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\533823.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: LiteManager - Server 5.0 installation package, Comments: This installer contains the logic and data to install LiteManager Pro - Server 5.0, Keywords: Installer,MSI,Database, Subject: LiteManager Pro - Server, Author: LiteManagerTeam, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2015 - Premier Edition with Virtualization Pack 22, Last Saved Time/Date: Thu Aug 22 15:43:08 2024, Create Time/Date: Thu Aug 22 15:43:08 2024, Last Printed: Thu Aug 22 15:43:08 2024, Revision Number: {9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}, Code page: 0, Template: Intel;0,1033,1049
Category:	dropped
Size (bytes):	11554816
Entropy (8bit):	7.9382387394429115
Encrypted:	false
SSDEEP:	196608:9Jg0ovdgTGOk/J1yr/A9ODMlWyFISx8/191nYHiT88o8En03yEoH8WkJDFa:bAJoLA9OIlWy58/19J+iYNPEoHg0
MD5:	0C88F651EEA7EBD95DF08F6A492FCB38
SHA1:	93E622BB18056BB61DD11805D91AB1F9267CBD67
SHA-256:	A1FAAE4E2B695C7DF3846179192F4E67BD8DD05E7E5C6D0B4B72DB175F629076
SHA-512:	41F69CFCDA6EBB6DD6984D21B19E952BA25C78404B138FF25A8E16283D9080B5E2A85AF4973EC25A4F45F8D402163CCE96906F06F3FBA2068571F1F1ACBEA86C
Malicious:	false
Preview:	......................>...................................8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?...N...A...B...C...D...E...F...G...H...I...J...O...L...N...D.......P...Q...R...S...T...Z...V...W...X...Y....X..[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\533826.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: LiteManager - Server 5.0 installation package, Comments: This installer contains the logic and data to install LiteManager Pro - Server 5.0, Keywords: Installer,MSI,Database, Subject: LiteManager Pro - Server, Author: LiteManagerTeam, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2015 - Premier Edition with Virtualization Pack 22, Last Saved Time/Date: Thu Aug 22 15:43:08 2024, Create Time/Date: Thu Aug 22 15:43:08 2024, Last Printed: Thu Aug 22 15:43:08 2024, Revision Number: {9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}, Code page: 0, Template: Intel;0,1033,1049
Category:	dropped
Size (bytes):	11554816
Entropy (8bit):	7.9382387394429115
Encrypted:	false
SSDEEP:	196608:9Jg0ovdgTGOk/J1yr/A9ODMlWyFISx8/191nYHiT88o8En03yEoH8WkJDFa:bAJoLA9OIlWy58/19J+iYNPEoHg0
MD5:	0C88F651EEA7EBD95DF08F6A492FCB38
SHA1:	93E622BB18056BB61DD11805D91AB1F9267CBD67
SHA-256:	A1FAAE4E2B695C7DF3846179192F4E67BD8DD05E7E5C6D0B4B72DB175F629076
SHA-512:	41F69CFCDA6EBB6DD6984D21B19E952BA25C78404B138FF25A8E16283D9080B5E2A85AF4973EC25A4F45F8D402163CCE96906F06F3FBA2068571F1F1ACBEA86C
Malicious:	false
Preview:	......................>...................................8........6..................}.................................................................................................................................................................................................................................................... ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5...6..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...@...M...:...;...=...........?...N...A...B...C...D...E...F...G...H...I...J...O...L...N...D.......P...Q...R...S...T...Z...V...W...X...Y....X..[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI3BEC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	294225
Entropy (8bit):	4.850949281684994
Encrypted:	false
SSDEEP:	3072:Aaoy2KjcC2jcmFDX/vjcJGUjcmFDX/rjcmFDX/dZ+oNbynfd:Aaoy25DXmNDXLDXX+oNbynfd
MD5:	00A66C8221DD38E5E31C064D05DEAA89
SHA1:	C0A8CDB173F241FA7F25521F6183C799E3D55B9B
SHA-256:	F88D682CC054607082CC9CDBD799D728161A08ED4D695554F4ADB4339ED19E05
SHA-512:	E3108FC556C451F4F49982D6AF034E04388572E24B5B93C5C97FB47D2F5E0AE92C94A30119BE1DBC7D35679C564CA1ACE88A2671C0F115AED5585BB1ECA1C36A
Malicious:	false
Preview:	...@IXOS.@.....@..^Y.@.....@.....@.....@.....@.....@......&.{71FFA475-24D5-44FB-A51F-39B699E3D82C}..LiteManager Pro - Server..pdf.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{9EF586E9-112B-4AAE-B439-5B62B7A0B1DE}.....@.....@.....@.....@.......@.....@.....@.......@......LiteManager Pro - Server......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{3244CDE6-6414-4399-B0D5-424562747210}0.C:\Program Files (x86)\LiteManager Pro - Server\.@.......@.....@.....@......&.{4D4D18AA-F74D-4291-B5A9-93C3CC48B75F}5.C:\Program Files (x86)\LiteManager Pro - Server\Lang\.@.......@.....@.....@......&.{641F154A-FEEF-4FA7-B5BF-414DB1DB8390}C.C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe.@.......@.....@.....@......&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}0.C:\Program Files (x86)\LiteManager Pro - Server\.@.......@.....@.....@......&.{596F4636-5D51-49

C:\Windows\Installer\SourceHash{71FFA475-24D5-44FB-A51F-39B699E3D82C}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.162422430012862
Encrypted:	false
SSDEEP:	12:JSbX72FjmcAGiLIlHVRpqh/7777777777777777777777777vDHFGpZl0i8Q:JJQI56dF
MD5:	06DA90CCB4343EB1C83165CCD5D9BA4F
SHA1:	C23F18E20C7AB2601332816B3639250DFC1D7B1E
SHA-256:	0E3E66E43918683B7BF9AA16CFCAE14B4053EA32722F3B39EF7E6E49C927BC59
SHA-512:	C49C478F3086C8996969FE5679886FDE98BF86EFAE8B4D58EC9502E64159D57C3E2A961BBF8D399BBD0D5A38D87F4853D0D8940A44DAC4B1FD7917BB503780F8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.7898335349700951
Encrypted:	false
SSDEEP:	48:K8PhEuRc06WXJqFT5SlbA99lPmSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YGucYSBWM:VhE1hFT08d+m0WlfPupqG0Wlfwh/
MD5:	6E31286AE68B3A5A4EF969529160F033
SHA1:	C21A5170948187896F1D9220F76D96CA35921370
SHA-256:	E24C371B4C3246E24C1F817959F018C6961A6F38C44BB7B97D5576BD899E6386
SHA-512:	764A924B5A3BE9331078B0235A8B9B765F6CA6641DE3022DB8A500E3F3C27932202D6468C2B23A523689FC1E9FCA45B9ED0575655C17291E24D2B6C0E810C619
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	4.351781833522881
Encrypted:	false
SSDEEP:	384:AvFMAyDNOdTdFCxfrwntajXjDWLi9Y+C5vy/Q1nDcZUNeLNek+vDFNe+TNy:+MAyYdTmPJbgqcnDcCNy
MD5:	CA680899D9330BEB85E6351E6DC0D27B
SHA1:	41E89E582F58FB2A4ED06FA3BF796A1DAAC5CB6C
SHA-256:	EAB5DC45781E92CD5CF953016757B1E6F2ED7A0B5A97CC0945B19A8FBC1A85F2
SHA-512:	3817BD6EC345F96631E6CBF6C8DD384ACB17D912B1EC69D959F3AA15C05226D5FE3B5E9807D42D0E63589AABCEADFBE8BD5F293D8069DF689D12498E05842286
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...................P....@.........................................................................4T..(........0...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....0.......@..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.774504587732323
Encrypted:	false
SSDEEP:	768:SMAyYdTmPJbgqcnDcZTw0gpEeO4tZZz+0pQTk/N0:S1U81cmpjDX/N0
MD5:	5EBCB54B76FBE24FFF9D3BD74E274234
SHA1:	6CD72F044F36B7A3A79B7D77AAE59F274A66CE95
SHA-256:	504AEB909BBA186D4298AA97DCD6A09CCDD42217AF1F6210BC5EBD23B3DFCCBF
SHA-512:	5FF61D724B77B6EDC67D33B0F1EE1C3CB01F2A03251D0BE83FF10A80A99DBA08E3A0E0F985DEED6358E467B2E9B6A837E894513D1B5E68AF253C0BBDD68539D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...................P....@.........................................................................4T..(.......xC...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...xC.......P..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_78AA5B6662514D94A847D6C603AF0895.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	4.31126714354722
Encrypted:	false
SSDEEP:	384:EvFMAyDNOdTdFCxfrwntajXjDWLi9Y+C5vy/Q1nDcZMwQE3vGYksuektm6yysZc8:SMAyYdTmPJbgqcnDcmwQE/RkHRRNS
MD5:	6A4AFFF2CD33613166B37A0DAB99BD41
SHA1:	FBC0F1696213B459D099A5809D79CFC01253880F
SHA-256:	53C1AE4962663E82D3AAC7C4A6CBE3D53E05D6948ADAE6391A2748396ACF98FE
SHA-512:	7B61D32E4AD38BC21E86559BFFA49A334CCB6184E595CB43F2D60A2A77C86B31D07B1A9D1F8FBE69E9AAD7E096952D765404BEBC494E73BD992642EB6B82E3A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...p...............P....@.........................................................................4T..(........+...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....+.......0..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.774504587732323
Encrypted:	false
SSDEEP:	768:SMAyYdTmPJbgqcnDcZTw0gpEeO4tZZz+0pQTk/N0:S1U81cmpjDX/N0
MD5:	5EBCB54B76FBE24FFF9D3BD74E274234
SHA1:	6CD72F044F36B7A3A79B7D77AAE59F274A66CE95
SHA-256:	504AEB909BBA186D4298AA97DCD6A09CCDD42217AF1F6210BC5EBD23B3DFCCBF
SHA-512:	5FF61D724B77B6EDC67D33B0F1EE1C3CB01F2A03251D0BE83FF10A80A99DBA08E3A0E0F985DEED6358E467B2E9B6A837E894513D1B5E68AF253C0BBDD68539D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...................P....@.........................................................................4T..(.......xC...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...xC.......P..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.774504587732323
Encrypted:	false
SSDEEP:	768:SMAyYdTmPJbgqcnDcZTw0gpEeO4tZZz+0pQTk/N0:S1U81cmpjDX/N0
MD5:	5EBCB54B76FBE24FFF9D3BD74E274234
SHA1:	6CD72F044F36B7A3A79B7D77AAE59F274A66CE95
SHA-256:	504AEB909BBA186D4298AA97DCD6A09CCDD42217AF1F6210BC5EBD23B3DFCCBF
SHA-512:	5FF61D724B77B6EDC67D33B0F1EE1C3CB01F2A03251D0BE83FF10A80A99DBA08E3A0E0F985DEED6358E467B2E9B6A837E894513D1B5E68AF253C0BBDD68539D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L...J&uU.................@...................P....@.........................................................................4T..(.......xC...........................................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...xC.......P..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362989794820237
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauS:zTtbmkExhMJCIpED
MD5:	93137A1314A1813CB9F94BE2A4B57AA1
SHA1:	8F376AA9CDA50286008B8B947DAF37333281AEA6
SHA-256:	2714861BE51621ECF03E68ACCEF41EA8DE0FA46960A1CF52C67ED4446CD8ACA5
SHA-512:	0CBB9CD5FB2463EDC558A6D33447C36A84DBDF06AC83A8F2C71F96906A4DD1AEE37EB92C9123AEED268DDAD90FDACF858BB87B4235B284A0A2A138DFED120A4E
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Temp\~DF3D91582767A218A7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.2230530511846911
Encrypted:	false
SSDEEP:	48:PHEmFSBWlOd5YpRXd5YNd5YGd5YMd5YGmSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5Y1:PHtFqG0WlfRm0WlfPuiLg
MD5:	EA4321CF232C4ECE173D34CBA0090A30
SHA1:	D7DBEC92B3CDFD83448ADF6C59D31C701B1A9228
SHA-256:	DFBDB9131E0B53A7CFCAB49E4C5B9D15283DFF9E8184ACE95A5470EB84465BB5
SHA-512:	D79BBDC4CF335E859C5C17A64B205110C6641F8590EE2330D0C0893E71C7E7E5D47BBFFA5EE319BB65DEB843F2951F21D98EA6AAF42CE9EA9FE26CF7E636CC46
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5454E4CCD4ACD113.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF547B7510C89C2D6A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.4178934848184817
Encrypted:	false
SSDEEP:	48:/lsudTO+CFXJbT55qXlbA99lPmSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YGucYSBWM:9s1DT3c8d+m0WlfPupqG0Wlfwh/
MD5:	F213A82A04BB0B648168F9C7BDF47FEF
SHA1:	21370DADBC0228A655BF082D574EADB4A761503C
SHA-256:	393CE0A09E41D8D95CFDE9E92348CFDA2949F6335F2CB618CEE9E09A5CF64F6C
SHA-512:	AA4428DB83197C7BA9D492CDD900DAB33689913E7E06B67D9DCE88B331C899732DBCC2A9F736E057C5CA77B85E5D566BDF6CBE6C24A822586EDC13D65E51B277
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF586DEB8DA5D7E8D8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.4178934848184817
Encrypted:	false
SSDEEP:	48:/lsudTO+CFXJbT55qXlbA99lPmSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YGucYSBWM:9s1DT3c8d+m0WlfPupqG0Wlfwh/
MD5:	F213A82A04BB0B648168F9C7BDF47FEF
SHA1:	21370DADBC0228A655BF082D574EADB4A761503C
SHA-256:	393CE0A09E41D8D95CFDE9E92348CFDA2949F6335F2CB618CEE9E09A5CF64F6C
SHA-512:	AA4428DB83197C7BA9D492CDD900DAB33689913E7E06B67D9DCE88B331C899732DBCC2A9F736E057C5CA77B85E5D566BDF6CBE6C24A822586EDC13D65E51B277
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF62679B009175D882.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.7898335349700951
Encrypted:	false
SSDEEP:	48:K8PhEuRc06WXJqFT5SlbA99lPmSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YGucYSBWM:VhE1hFT08d+m0WlfPupqG0Wlfwh/
MD5:	6E31286AE68B3A5A4EF969529160F033
SHA1:	C21A5170948187896F1D9220F76D96CA35921370
SHA-256:	E24C371B4C3246E24C1F817959F018C6961A6F38C44BB7B97D5576BD899E6386
SHA-512:	764A924B5A3BE9331078B0235A8B9B765F6CA6641DE3022DB8A500E3F3C27932202D6468C2B23A523689FC1E9FCA45B9ED0575655C17291E24D2B6C0E810C619
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6ECA8B580811992E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06823846717123914
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOYYbmc6Vky6lZ:2F0i8n0itFzDHFTZ
MD5:	43121AF9C0468049B811D5DE9EE986C6
SHA1:	3D65F87A3C467D0DE2BF8F07A60621B947A9CE4C
SHA-256:	592C5B6D2ADD44B5EFCE1D5A353279925147188A1C15B56B1189E89FE97374E0
SHA-512:	0B09D5648F1374083996F24FF71AE87B22F152D907C91B84567CA27B985F05C447AF27527A3E760F44817300DB8680F73F5D86A36B9DC157AA3E6C5BB6BC6831
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA661B71CD59E4965.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB0CFCC17288F5CCD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.7898335349700951
Encrypted:	false
SSDEEP:	48:K8PhEuRc06WXJqFT5SlbA99lPmSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YGucYSBWM:VhE1hFT08d+m0WlfPupqG0Wlfwh/
MD5:	6E31286AE68B3A5A4EF969529160F033
SHA1:	C21A5170948187896F1D9220F76D96CA35921370
SHA-256:	E24C371B4C3246E24C1F817959F018C6961A6F38C44BB7B97D5576BD899E6386
SHA-512:	764A924B5A3BE9331078B0235A8B9B765F6CA6641DE3022DB8A500E3F3C27932202D6468C2B23A523689FC1E9FCA45B9ED0575655C17291E24D2B6C0E810C619
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC3DAEF5E5A1F385A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD292D796AD5A3587.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE4D560E9A62CB13E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFEE3629B5C818501.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.4178934848184817
Encrypted:	false
SSDEEP:	48:/lsudTO+CFXJbT55qXlbA99lPmSvOd5YpRXd5YNd5YGd5YMd5YP6Ad5YGucYSBWM:9s1DT3c8d+m0WlfPupqG0Wlfwh/
MD5:	F213A82A04BB0B648168F9C7BDF47FEF
SHA1:	21370DADBC0228A655BF082D574EADB4A761503C
SHA-256:	393CE0A09E41D8D95CFDE9E92348CFDA2949F6335F2CB618CEE9E09A5CF64F6C
SHA-512:	AA4428DB83197C7BA9D492CDD900DAB33689913E7E06B67D9DCE88B331C899732DBCC2A9F736E057C5CA77B85E5D566BDF6CBE6C24A822586EDC13D65E51B277
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.9367051756500695
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0438.pdf.exe
File size:	11'654'747 bytes
MD5:	2d11dba46735af1cb1c0a42e9564e20d
SHA1:	b2e17960c6d080f7aba7df87f57c08b4bc2e7051
SHA256:	e19477a56b247e6cc435fee367abcf6e0c3db21de91ae2514b4a6b1807233c53
SHA512:	f053c18333c256c87492e7e74832f2ba695c1633cc80d59e4d426eda82d27d7402a22803e439bb2453f4fa12f00697de355edd61c300b7624c66723d7e54dad0
SSDEEP:	196608:tqwvI8YbsGBCEfbi57P6mCRTMFCxZ9zzvHLbax3QS+hbEPjwDhZzczDlUxMUd:ZIRwGjfbi5DCRoOPzzvfaEAPgOHm5d
TLSH:	42C6331BFF5D04EAF1AF99F899415022D7B57CC51720868F23B43E4AED736A1AA35302
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i...i.\.i...b.\.i...g.\.`.].C.\...Y.R.\...\.a.\.....a.\

File Icon


Icon Hash:	3570b080889388e1

Static PE Info

General

Entrypoint:	0x140032ee0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66409723 [Sun May 12 10:17:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	b1c5b1beabd90d9fdabd1df0779ea832

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FA198EC8318h
dec eax
add esp, 28h
jmp 00007FA198EC7CAFh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007FA198EC7133h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007FA198EC7E43h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007FA198EC9E57h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FA198EB66C3h
dec eax
lea edx, dword ptr [00025747h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FA198EC8F12h
int3
jmp 00007FA198ECF0F4h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x597a0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x597d4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0x5f334	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6a000	0x306c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd0000	0x970	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x536c0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x53780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4b3f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48000	0x508	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x588bc	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4676e	0x46800	f06bb06e02377ae8b223122e53be35c2	False	0.5372340425531915	data	6.47079645411382	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x48000	0x128c4	0x12a00	2de06d4a6920a6911e64ff20000ea72f	False	0.4499003775167785	data	5.273999097784603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5b000	0xe75c	0x1a00	0dbdb901a7d477980097e42e511a94fb	False	0.28275240384615385	data	3.2571023907881185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6a000	0x306c	0x3200	b0ce0f057741ad2a4ef4717079fa34e9	False	0.483359375	data	5.501810413666288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6e000	0x360	0x400	1fcc7b1d7a02443319f8fcc2be4ca936	False	0.2578125	data	3.0459938492946015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x6f000	0x15c	0x200	3f331ec50f09ba861beaf955b33712d5	False	0.408203125	data	3.3356393424384843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0x5f334	0x5f400	ac83509a9abddcfebcee4527be350f1a	False	0.06483503526902887	data	2.1781366278912278	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd0000	0x970	0xa00	77a9ddfc47a5650d6eebbcc823e39532	False	0.52421875	data	5.336289720085303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x70644	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x7118c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x72738	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 262144, resolution 2835 x 2835 px/m			0.023615261709619195
RT_ICON	0xb4760	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m			0.3191489361702128
RT_ICON	0xb4bc8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m			0.11867219917012448
RT_ICON	0xb7170	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m			0.17284240150093808
RT_ICON	0xb8218	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m			0.04436294806577547
RT_ICON	0xc8a40	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m			0.08644307982994803
RT_DIALOG	0xccc68	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0xccef0	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0xcd02c	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0xcd118	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0xcd248	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0xcd580	0x252	data	English	United States	0.5757575757575758
RT_STRING	0xcd7d4	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0xcd9b8	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0xcdb84	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0xcdd3c	0x146	data	English	United States	0.5153374233128835
RT_STRING	0xcde84	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0xce2f0	0x166	data	English	United States	0.49162011173184356
RT_STRING	0xce458	0x152	data	English	United States	0.5059171597633136
RT_STRING	0xce5ac	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0xce6b8	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0xce774	0x1c0	data	English	United States	0.5178571428571429
RT_STRING	0xce934	0x250	data	English	United States	0.44256756756756754
RT_GROUP_ICON	0xceb84	0x5a	data			0.7555555555555555
RT_MANIFEST	0xcebe0	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.39786666666666665

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindNextFileA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipFree, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 22:37:45.703644991 CET	49760	443	192.168.2.6	96.7.168.138
Oct 30, 2024 22:37:45.703687906 CET	443	49760	96.7.168.138	192.168.2.6
Oct 30, 2024 22:37:45.704013109 CET	49760	443	192.168.2.6	96.7.168.138
Oct 30, 2024 22:37:45.704452991 CET	49760	443	192.168.2.6	96.7.168.138
Oct 30, 2024 22:37:45.704464912 CET	443	49760	96.7.168.138	192.168.2.6
Oct 30, 2024 22:37:46.502645016 CET	443	49760	96.7.168.138	192.168.2.6
Oct 30, 2024 22:37:46.503063917 CET	49760	443	192.168.2.6	96.7.168.138
Oct 30, 2024 22:37:46.503072977 CET	443	49760	96.7.168.138	192.168.2.6
Oct 30, 2024 22:37:46.504141092 CET	443	49760	96.7.168.138	192.168.2.6
Oct 30, 2024 22:37:46.504282951 CET	49760	443	192.168.2.6	96.7.168.138
Oct 30, 2024 22:37:46.559149027 CET	49760	443	192.168.2.6	96.7.168.138
Oct 30, 2024 22:37:46.559410095 CET	443	49760	96.7.168.138	192.168.2.6
Oct 30, 2024 22:37:46.559474945 CET	49760	443	192.168.2.6	96.7.168.138
Oct 30, 2024 22:37:46.603336096 CET	443	49760	96.7.168.138	192.168.2.6
Oct 30, 2024 22:37:46.683119059 CET	49760	443	192.168.2.6	96.7.168.138
Oct 30, 2024 22:37:46.683130980 CET	443	49760	96.7.168.138	192.168.2.6
Oct 30, 2024 22:37:46.708791971 CET	443	49760	96.7.168.138	192.168.2.6
Oct 30, 2024 22:37:46.708872080 CET	49760	443	192.168.2.6	96.7.168.138
Oct 30, 2024 22:37:46.710212946 CET	49760	443	192.168.2.6	96.7.168.138
Oct 30, 2024 22:37:46.710230112 CET	443	49760	96.7.168.138	192.168.2.6
Oct 30, 2024 22:37:49.459938049 CET	49785	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:49.466033936 CET	5651	49785	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:49.466115952 CET	49785	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:49.475966930 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:49.482405901 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:49.482481956 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:49.484395981 CET	49787	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:49.490308046 CET	80	49787	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:49.492616892 CET	49787	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:49.512448072 CET	49788	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:49.517260075 CET	49789	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:49.518558025 CET	465	49788	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:49.518686056 CET	49788	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:49.523061037 CET	80	49789	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:49.523341894 CET	49789	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:49.531738043 CET	49790	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:49.537756920 CET	5555	49790	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:49.537820101 CET	49790	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:49.657874107 CET	49785	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:49.657963037 CET	49785	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:49.661169052 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:49.661206007 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:49.661247969 CET	49787	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:49.661269903 CET	49787	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:49.663999081 CET	5651	49785	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:49.664016962 CET	5651	49785	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:49.667263985 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:49.667279005 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:49.667292118 CET	80	49787	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:49.667304993 CET	80	49787	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:49.738241911 CET	49788	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:49.744905949 CET	465	49788	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:49.755219936 CET	49788	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:49.761506081 CET	465	49788	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:49.768898964 CET	49789	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:49.771640062 CET	49789	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:49.774811983 CET	80	49789	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:49.777581930 CET	80	49789	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:49.886782885 CET	49790	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:49.886881113 CET	49790	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:49.892890930 CET	5555	49790	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:49.892909050 CET	5555	49790	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:50.194875002 CET	5651	49785	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:50.194943905 CET	49785	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:50.195023060 CET	49785	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:50.200953007 CET	5651	49785	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:50.224582911 CET	80	49787	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:50.225261927 CET	49787	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:50.225364923 CET	49787	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:50.231235981 CET	80	49787	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:50.395867109 CET	80	49789	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:50.396013975 CET	49789	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:50.396044970 CET	49789	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:50.396044970 CET	49789	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:50.396059036 CET	49789	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:50.396091938 CET	49789	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:50.401933908 CET	80	49789	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:50.401957035 CET	80	49789	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:50.401973963 CET	80	49789	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:50.401987076 CET	80	49789	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:50.402548075 CET	80	49789	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:50.402607918 CET	49789	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:50.533799887 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:50.533937931 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:50.533937931 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:50.533977032 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:50.533977032 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:50.539743900 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:50.539838076 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:50.539848089 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:50.539856911 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:50.622980118 CET	49796	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:50.629075050 CET	5651	49796	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:50.629149914 CET	49796	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:50.638509035 CET	49797	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:50.644803047 CET	80	49797	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:50.644872904 CET	49797	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:50.654803038 CET	49798	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:50.660778046 CET	80	49798	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:50.660846949 CET	49798	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:50.772384882 CET	49796	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:50.772521019 CET	49796	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:50.779906988 CET	5651	49796	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:50.779918909 CET	5651	49796	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:50.795167923 CET	49797	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:50.795454025 CET	49797	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:50.798233986 CET	49798	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:50.798249960 CET	49798	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:50.800987005 CET	80	49797	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:50.801218987 CET	80	49797	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:50.804141045 CET	80	49798	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:50.804182053 CET	80	49798	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:50.987749100 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:51.183129072 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:51.363830090 CET	5651	49796	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:51.363898993 CET	49796	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:51.363980055 CET	49796	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:51.370187044 CET	5651	49796	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:51.371438980 CET	80	49797	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:51.371506929 CET	49797	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:51.371548891 CET	49797	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:51.377346039 CET	80	49797	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:51.547911882 CET	80	49798	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:51.548060894 CET	49798	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:51.548060894 CET	49798	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:51.548062086 CET	49798	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:51.548140049 CET	49798	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:51.548140049 CET	49798	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:51.554110050 CET	80	49798	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:51.554121017 CET	80	49798	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:51.554131985 CET	80	49798	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:51.554181099 CET	80	49798	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:51.554847002 CET	80	49798	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:51.554913044 CET	49798	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:51.686878920 CET	49804	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:51.692817926 CET	5651	49804	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:51.692972898 CET	49804	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:51.701059103 CET	49805	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:51.706898928 CET	80	49805	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:51.706970930 CET	49805	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:51.717190027 CET	49806	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:51.723119974 CET	80	49806	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:51.723196030 CET	49806	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:51.824069977 CET	49804	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:51.824151039 CET	49804	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:51.830158949 CET	5651	49804	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:51.830183983 CET	5651	49804	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:51.839538097 CET	49805	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:51.839561939 CET	49805	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:51.845443010 CET	80	49805	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:51.845454931 CET	80	49805	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:51.855794907 CET	49806	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:51.855808020 CET	49806	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:51.861776114 CET	80	49806	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:51.861804008 CET	80	49806	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:51.988221884 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:52.075984955 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:52.423446894 CET	5651	49804	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:52.423525095 CET	49804	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:52.423662901 CET	49804	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:52.429399014 CET	5651	49804	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:52.440408945 CET	80	49805	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:52.444602966 CET	49805	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:52.446360111 CET	49805	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:52.452137947 CET	80	49805	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:52.607168913 CET	80	49806	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:52.607296944 CET	49806	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:52.607325077 CET	49806	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:52.607331991 CET	49806	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:52.607348919 CET	49806	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:52.607420921 CET	49806	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:52.613291025 CET	80	49806	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:52.613303900 CET	80	49806	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:52.613313913 CET	80	49806	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:52.613323927 CET	80	49806	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:52.613653898 CET	80	49806	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:52.614027023 CET	49806	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:52.751302958 CET	49815	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:52.757504940 CET	5651	49815	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:52.757586002 CET	49815	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:52.764761925 CET	49816	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:52.770665884 CET	80	49816	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:52.770740032 CET	49816	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:52.780112028 CET	49817	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:52.786109924 CET	80	49817	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:52.786195993 CET	49817	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:52.886496067 CET	49815	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:52.886527061 CET	49815	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:52.892517090 CET	5651	49815	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:52.892532110 CET	5651	49815	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:52.911115885 CET	49816	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:52.911149025 CET	49816	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:52.917819977 CET	80	49816	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:52.917841911 CET	80	49816	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:52.922277927 CET	49817	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:52.922297001 CET	49817	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:52.929074049 CET	80	49817	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:52.929085016 CET	80	49817	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:53.003915071 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:53.053328991 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:53.502743006 CET	5651	49815	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:53.502768040 CET	80	49816	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:53.502851009 CET	49816	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:53.502856970 CET	49815	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:53.502914906 CET	49816	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:53.502953053 CET	49815	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:53.508766890 CET	80	49816	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:53.512837887 CET	5651	49815	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:53.671948910 CET	80	49817	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:53.672089100 CET	49817	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:53.672112942 CET	49817	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:53.672128916 CET	49817	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:53.672142982 CET	49817	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:53.672184944 CET	49817	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:53.677922010 CET	80	49817	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:53.677939892 CET	80	49817	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:53.677949905 CET	80	49817	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:53.677961111 CET	80	49817	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:53.678997993 CET	80	49817	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:53.679088116 CET	49817	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:53.811996937 CET	49823	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:53.817826033 CET	5651	49823	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:53.818001032 CET	49823	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:53.826055050 CET	49824	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:53.831933022 CET	80	49824	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:53.832024097 CET	49824	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:53.842405081 CET	49825	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:53.848274946 CET	80	49825	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:53.848355055 CET	49825	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:53.949949026 CET	49823	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:53.949981928 CET	49823	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:53.955821991 CET	5651	49823	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:53.955842018 CET	5651	49823	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:53.965255976 CET	49824	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:53.965312004 CET	49824	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:53.971355915 CET	80	49824	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:53.971366882 CET	80	49824	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:53.981199980 CET	49825	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:53.981199980 CET	49825	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:53.987306118 CET	80	49825	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:53.987333059 CET	80	49825	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:54.019845963 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:54.073749065 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:54.522191048 CET	5651	49823	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:54.522275925 CET	49823	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:54.522344112 CET	49823	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:54.528213024 CET	5651	49823	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:54.530208111 CET	49828	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:54.536267996 CET	5651	49828	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:54.536370993 CET	49828	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:54.562997103 CET	80	49824	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:54.563137054 CET	49824	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:54.563219070 CET	49824	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:54.569238901 CET	80	49824	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:54.639642000 CET	49829	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:54.645828009 CET	80	49829	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:54.645932913 CET	49829	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:54.667741060 CET	49828	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:54.667757988 CET	49828	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:54.675843954 CET	5651	49828	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:54.675875902 CET	5651	49828	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:54.699486971 CET	80	49825	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:54.699615002 CET	49825	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:54.699640989 CET	49825	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:54.700037956 CET	49825	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:54.700097084 CET	49825	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:54.700097084 CET	49825	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:54.705606937 CET	80	49825	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:54.705638885 CET	80	49825	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:54.705907106 CET	80	49825	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:54.705935001 CET	80	49825	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:54.706151962 CET	80	49825	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:54.706212997 CET	49825	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:54.782145977 CET	49829	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:54.782231092 CET	49829	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:54.788326979 CET	80	49829	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:54.788403034 CET	80	49829	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:55.035377979 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:55.073739052 CET	49833	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:55.076714039 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:55.079631090 CET	80	49833	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:55.079706907 CET	49833	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:55.083396912 CET	49833	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:55.083478928 CET	49833	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:55.089199066 CET	80	49833	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:55.089390993 CET	80	49833	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:55.262378931 CET	5651	49828	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:55.262474060 CET	49828	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:55.262526035 CET	49828	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:55.268327951 CET	5651	49828	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:55.364918947 CET	80	49829	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:55.365030050 CET	49829	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:55.365109921 CET	49829	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:55.372514963 CET	80	49829	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:55.965658903 CET	80	49833	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:55.965800047 CET	49833	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:55.965830088 CET	49833	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:55.965862989 CET	49833	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:55.965862989 CET	49833	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:55.965899944 CET	49833	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:55.971837997 CET	80	49833	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:55.971857071 CET	80	49833	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:55.971865892 CET	80	49833	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:55.971896887 CET	80	49833	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:55.972397089 CET	80	49833	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:55.972445965 CET	49833	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:56.036190033 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:56.089387894 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:56.093314886 CET	49840	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:56.099347115 CET	5651	49840	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:56.099422932 CET	49840	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:56.107642889 CET	49841	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:56.113924026 CET	80	49841	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:56.114001036 CET	49841	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:56.123055935 CET	49842	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:56.129015923 CET	80	49842	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:56.129095078 CET	49842	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:56.230140924 CET	49840	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:56.230165958 CET	49840	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:56.236099005 CET	5651	49840	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:56.236145973 CET	5651	49840	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:56.245887041 CET	49841	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:56.246076107 CET	49841	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:56.251799107 CET	80	49841	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:56.251935005 CET	80	49841	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:56.261514902 CET	49842	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:56.261600018 CET	49842	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:56.267600060 CET	80	49842	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:56.267832041 CET	80	49842	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:56.821238995 CET	5651	49840	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:56.821311951 CET	49840	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:56.821397066 CET	49840	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:56.826469898 CET	49847	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:56.827838898 CET	5651	49840	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:56.831722021 CET	80	49841	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:56.831789970 CET	49841	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:56.831851006 CET	49841	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:56.832664013 CET	5651	49847	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:56.832741022 CET	49847	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:56.838835001 CET	80	49841	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:56.964637995 CET	49847	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:56.964662075 CET	49847	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:56.970488071 CET	5651	49847	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:56.970500946 CET	5651	49847	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:56.978071928 CET	80	49842	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:56.978203058 CET	49842	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:56.978231907 CET	49842	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:56.978301048 CET	49842	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:56.978324890 CET	49842	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:56.978365898 CET	49842	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:56.984277964 CET	80	49842	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:56.984288931 CET	80	49842	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:56.984297991 CET	80	49842	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:56.984307051 CET	80	49842	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:56.984788895 CET	80	49842	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:56.984843016 CET	49842	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:57.051316977 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:57.104998112 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:57.565867901 CET	5651	49847	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:57.568646908 CET	49847	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:57.569338083 CET	49847	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:57.575133085 CET	5651	49847	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:58.000407934 CET	465	49788	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:58.000497103 CET	49788	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:58.000654936 CET	49788	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:58.006419897 CET	465	49788	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:58.021920919 CET	5555	49790	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:58.022016048 CET	49790	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:58.022069931 CET	49790	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:37:58.027935028 CET	5555	49790	65.21.245.7	192.168.2.6
Oct 30, 2024 22:37:58.051868916 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:58.105024099 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:37:59.067332029 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:37:59.119690895 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:00.067977905 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:00.108500004 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:01.083415985 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:01.136265039 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:02.083523989 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:02.136250973 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:03.099292994 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:03.151912928 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:04.123553038 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:04.167506933 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:04.971599102 CET	49890	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:04.977507114 CET	5651	49890	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:04.977638006 CET	49890	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:04.983592987 CET	49891	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:04.989414930 CET	80	49891	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:04.989486933 CET	49891	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:04.998822927 CET	49892	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.006756067 CET	465	49892	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:05.007067919 CET	49892	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.013931990 CET	49894	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:05.020035982 CET	80	49894	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:05.020204067 CET	49894	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:05.030246019 CET	49895	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:05.036268950 CET	5555	49895	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:05.036469936 CET	49895	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:05.106406927 CET	49890	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.106432915 CET	49890	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.112268925 CET	5651	49890	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:05.112368107 CET	5651	49890	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:05.116585016 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:05.120965958 CET	49891	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.121052980 CET	49891	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.126902103 CET	80	49891	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:05.127058983 CET	80	49891	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:05.137255907 CET	49892	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.137342930 CET	49892	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.143134117 CET	465	49892	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:05.143609047 CET	465	49892	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:05.152194023 CET	49894	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:05.152211905 CET	49894	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:05.158102989 CET	80	49894	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:05.158281088 CET	80	49894	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:05.167512894 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.168929100 CET	49895	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:05.169178009 CET	49895	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:05.174823046 CET	5555	49895	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:05.175055027 CET	5555	49895	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:05.701668024 CET	5651	49890	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:05.701739073 CET	49890	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.701811075 CET	49890	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.702003002 CET	80	49891	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:05.702061892 CET	49891	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.702109098 CET	49891	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.707977057 CET	5651	49890	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:05.708259106 CET	80	49891	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:05.795757055 CET	49899	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.801858902 CET	5651	49899	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:05.802063942 CET	49899	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.810550928 CET	49900	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.816668987 CET	80	49900	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:05.816742897 CET	49900	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.869683981 CET	80	49894	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:05.869805098 CET	49894	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:05.869823933 CET	49894	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:05.869831085 CET	49894	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:05.869848967 CET	49894	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:05.869884014 CET	49894	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:05.875821114 CET	80	49894	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:05.875854015 CET	80	49894	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:05.875883102 CET	80	49894	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:05.875921011 CET	80	49894	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:05.876796961 CET	80	49894	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:05.876904011 CET	49894	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:05.905725002 CET	49902	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:05.914527893 CET	80	49902	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:05.914601088 CET	49902	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:05.933413029 CET	49899	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.933433056 CET	49899	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.939429998 CET	5651	49899	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:05.939479113 CET	5651	49899	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:05.949028015 CET	49900	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.949054956 CET	49900	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:05.955041885 CET	80	49900	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:05.955070019 CET	80	49900	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:06.042792082 CET	49902	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:06.042813063 CET	49902	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:06.048700094 CET	80	49902	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:06.048772097 CET	80	49902	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:06.132236958 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:06.183123112 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:06.524020910 CET	5651	49899	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:06.524084091 CET	49899	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:06.524152040 CET	49899	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:06.526266098 CET	80	49900	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:06.526362896 CET	49900	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:06.526453018 CET	49900	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:06.530297995 CET	5651	49899	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:06.532336950 CET	80	49900	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:06.561431885 CET	49907	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:06.567593098 CET	5651	49907	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:06.567679882 CET	49907	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:06.576539993 CET	49908	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:06.582905054 CET	80	49908	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:06.582973003 CET	49908	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:06.699114084 CET	49907	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:06.699618101 CET	49907	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:06.704994917 CET	5651	49907	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:06.705935955 CET	5651	49907	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:06.714745045 CET	49908	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:06.714783907 CET	49908	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:06.720782042 CET	80	49908	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:06.720798016 CET	80	49908	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:06.772284985 CET	80	49902	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:06.772456884 CET	49902	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:06.772456884 CET	49902	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:06.772510052 CET	49902	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:06.772566080 CET	49902	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:06.772566080 CET	49902	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:06.778358936 CET	80	49902	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:06.778383970 CET	80	49902	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:06.778395891 CET	80	49902	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:06.778409004 CET	80	49902	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:06.778836012 CET	80	49902	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:06.778976917 CET	49902	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:06.780658007 CET	49910	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:06.786875963 CET	80	49910	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:06.787237883 CET	49910	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:06.917656898 CET	49910	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:06.917777061 CET	49910	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:06.923621893 CET	80	49910	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:06.923759937 CET	80	49910	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:07.147872925 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:07.200592041 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:07.276963949 CET	5651	49907	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:07.277211905 CET	49907	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:07.277368069 CET	49907	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:07.283826113 CET	5651	49907	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:07.298917055 CET	80	49908	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:07.299129963 CET	49908	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:07.299336910 CET	49908	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:07.305135012 CET	80	49908	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:07.325973988 CET	49915	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:07.332235098 CET	5651	49915	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:07.332504034 CET	49915	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:07.340274096 CET	49916	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:07.346322060 CET	80	49916	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:07.346527100 CET	49916	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:07.464493036 CET	49915	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:07.464585066 CET	49915	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:07.470375061 CET	5651	49915	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:07.470504999 CET	5651	49915	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:07.480205059 CET	49916	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:07.480205059 CET	49916	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:07.486120939 CET	80	49916	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:07.486134052 CET	80	49916	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:07.636197090 CET	80	49910	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:07.636620998 CET	49910	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:07.636620998 CET	49910	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:07.636703014 CET	49910	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:07.636703014 CET	49910	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:07.636703014 CET	49910	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:07.643687010 CET	80	49910	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:07.643717051 CET	80	49910	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:07.643743992 CET	80	49910	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:07.643770933 CET	80	49910	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:07.644224882 CET	80	49910	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:07.644454956 CET	49910	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:07.653815031 CET	49918	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:07.662118912 CET	80	49918	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:07.662312031 CET	49918	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:07.792679071 CET	49918	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:07.792679071 CET	49918	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:07.798576117 CET	80	49918	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:07.798605919 CET	80	49918	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:08.058845997 CET	5651	49915	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:08.058917046 CET	49915	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.058984995 CET	49915	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.064198017 CET	80	49916	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:08.064265966 CET	49916	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.064322948 CET	49916	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.064819098 CET	5651	49915	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:08.070318937 CET	80	49916	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:08.091772079 CET	49923	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.097714901 CET	5651	49923	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:08.098961115 CET	49923	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.106193066 CET	49924	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.112097979 CET	80	49924	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:08.112216949 CET	49924	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.163465023 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:08.214416981 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.230201960 CET	49923	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.230201960 CET	49923	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.236493111 CET	5651	49923	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:08.236524105 CET	5651	49923	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:08.245877981 CET	49924	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.245907068 CET	49924	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.252140999 CET	80	49924	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:08.252155066 CET	80	49924	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:08.501873016 CET	80	49918	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:08.501998901 CET	49918	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:08.501998901 CET	49918	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:08.502074957 CET	49918	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:08.502074957 CET	49918	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:08.502116919 CET	49918	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:08.507975101 CET	80	49918	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:08.507992029 CET	80	49918	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:08.508008003 CET	80	49918	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:08.508019924 CET	80	49918	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:08.508202076 CET	80	49918	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:08.508255005 CET	49918	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:08.528821945 CET	49926	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:08.534677982 CET	80	49926	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:08.534742117 CET	49926	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:08.667717934 CET	49926	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:08.667717934 CET	49926	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:08.673710108 CET	80	49926	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:08.673728943 CET	80	49926	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:08.819422960 CET	5651	49923	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:08.819556952 CET	49923	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.819634914 CET	49923	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.825520039 CET	5651	49923	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:08.828486919 CET	80	49924	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:08.828623056 CET	49924	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.828788996 CET	49924	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.834568977 CET	80	49924	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:08.856802940 CET	49930	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.862785101 CET	5651	49930	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:08.862907887 CET	49930	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.876575947 CET	49931	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.882530928 CET	80	49931	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:08.882644892 CET	49931	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.995764971 CET	49930	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:08.995764971 CET	49930	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:09.002382040 CET	5651	49930	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:09.002424002 CET	5651	49930	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:09.011432886 CET	49931	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:09.011432886 CET	49931	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:09.017685890 CET	80	49931	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:09.017741919 CET	80	49931	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:09.179198027 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:09.230060101 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:09.391160011 CET	80	49926	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:09.391302109 CET	49926	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:09.391302109 CET	49926	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:09.391303062 CET	49926	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:09.391388893 CET	49926	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:09.391388893 CET	49926	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:09.398119926 CET	80	49926	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:09.398185968 CET	80	49926	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:09.398215055 CET	80	49926	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:09.398242950 CET	80	49926	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:09.398509026 CET	80	49926	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:09.398876905 CET	49926	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:09.403882027 CET	49934	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:09.410594940 CET	80	49934	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:09.410692930 CET	49934	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:09.542725086 CET	49934	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:09.542781115 CET	49934	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:09.548616886 CET	80	49934	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:09.548629045 CET	80	49934	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:09.590490103 CET	80	49931	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:09.590609074 CET	49931	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:09.590703011 CET	49931	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:09.596601009 CET	80	49931	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:09.599457979 CET	5651	49930	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:09.599565029 CET	49930	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:09.599822998 CET	49930	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:09.605551958 CET	5651	49930	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:09.622390032 CET	49938	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:09.628217936 CET	5651	49938	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:09.628343105 CET	49938	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:09.637334108 CET	49939	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:09.643170118 CET	80	49939	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:09.643235922 CET	49939	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:09.761416912 CET	49938	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:09.763931036 CET	49938	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:09.767281055 CET	5651	49938	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:09.769820929 CET	5651	49938	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:09.777019978 CET	49939	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:09.777040958 CET	49939	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:09.782857895 CET	80	49939	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:09.782867908 CET	80	49939	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:10.194813013 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:10.245639086 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:10.254131079 CET	80	49934	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:10.254236937 CET	49934	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:10.254252911 CET	49934	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:10.254261017 CET	49934	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:10.254267931 CET	49934	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:10.254297018 CET	49934	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:10.260318995 CET	80	49934	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:10.260329962 CET	80	49934	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:10.260339022 CET	80	49934	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:10.260348082 CET	80	49934	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:10.261053085 CET	80	49934	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:10.261101961 CET	49934	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:10.279786110 CET	49942	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:10.285959959 CET	80	49942	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:10.286032915 CET	49942	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:10.350459099 CET	5651	49938	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:10.350584030 CET	49938	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:10.350615978 CET	49938	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:10.356530905 CET	5651	49938	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:10.385029078 CET	80	49939	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:10.385094881 CET	49939	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:10.385174036 CET	49939	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:10.387995958 CET	49943	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:10.391011000 CET	80	49939	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:10.393838882 CET	5651	49943	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:10.393919945 CET	49943	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:10.403007030 CET	49944	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:10.408901930 CET	80	49944	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:10.408988953 CET	49944	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:10.417608976 CET	49942	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:10.417676926 CET	49942	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:10.423477888 CET	80	49942	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:10.423490047 CET	80	49942	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:10.527029037 CET	49943	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:10.527050018 CET	49943	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:10.532865047 CET	5651	49943	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:10.532880068 CET	5651	49943	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:10.542711020 CET	49944	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:10.542785883 CET	49944	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:10.548727989 CET	80	49944	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:10.548738956 CET	80	49944	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.113756895 CET	5651	49943	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.113815069 CET	49943	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.113912106 CET	49943	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.119693041 CET	5651	49943	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.134325027 CET	80	49944	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.134397030 CET	49944	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.134455919 CET	49944	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.140213966 CET	80	49944	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.144275904 CET	80	49942	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:11.144395113 CET	49942	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:11.144413948 CET	49942	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:11.144413948 CET	49942	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:11.144426107 CET	49942	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:11.144445896 CET	49942	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:11.150181055 CET	80	49942	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:11.150276899 CET	80	49942	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:11.150286913 CET	80	49942	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:11.150295973 CET	80	49942	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:11.151683092 CET	80	49942	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:11.151737928 CET	49942	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:11.154261112 CET	49948	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.160135984 CET	5651	49948	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.160223961 CET	49948	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.169979095 CET	49949	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.175745964 CET	80	49949	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.175848961 CET	49949	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.186450958 CET	49950	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:11.192198992 CET	80	49950	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:11.192673922 CET	49950	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:11.210242987 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.261275053 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.292733908 CET	49948	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.292735100 CET	49948	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.298914909 CET	5651	49948	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.299069881 CET	5651	49948	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.308842897 CET	49949	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.308842897 CET	49949	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.317145109 CET	80	49949	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.317293882 CET	80	49949	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.323893070 CET	49950	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:11.323893070 CET	49950	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:11.332176924 CET	80	49950	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:11.332340002 CET	80	49950	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:11.891143084 CET	5651	49948	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.891237974 CET	49948	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.891653061 CET	49948	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.897883892 CET	5651	49948	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.901316881 CET	80	49949	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.901422024 CET	49949	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.901422024 CET	49949	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.908081055 CET	80	49949	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.919224977 CET	49955	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.925014019 CET	5651	49955	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.925184011 CET	49955	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.934067011 CET	49956	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:11.941632032 CET	80	49956	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:11.941798925 CET	49956	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.058250904 CET	49955	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.058274031 CET	49955	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.064364910 CET	5651	49955	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:12.064378023 CET	5651	49955	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:12.064627886 CET	80	49950	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:12.064781904 CET	49950	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:12.064781904 CET	49950	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:12.064781904 CET	49950	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:12.064781904 CET	49950	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:12.064812899 CET	49950	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:12.071938992 CET	80	49950	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:12.071949005 CET	80	49950	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:12.072002888 CET	80	49950	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:12.072012901 CET	80	49950	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:12.072256088 CET	80	49950	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:12.072403908 CET	49950	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:12.073848009 CET	49956	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.073892117 CET	49956	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.080410004 CET	80	49956	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:12.080427885 CET	80	49956	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:12.138190985 CET	49958	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:12.144429922 CET	80	49958	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:12.144581079 CET	49958	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:12.226039886 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:12.272885084 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.276971102 CET	49958	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:12.276971102 CET	49958	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:12.283030987 CET	80	49958	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:12.283044100 CET	80	49958	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:12.651700020 CET	80	49956	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:12.651772022 CET	49956	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.652288914 CET	49956	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.652868986 CET	5651	49955	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:12.652965069 CET	49955	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.652965069 CET	49955	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.658078909 CET	80	49956	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:12.658809900 CET	5651	49955	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:12.684854031 CET	49963	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.690591097 CET	5651	49963	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:12.690865993 CET	49963	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.699634075 CET	49964	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.706803083 CET	80	49964	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:12.706937075 CET	49964	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.823848009 CET	49963	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.823848009 CET	49963	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.829787970 CET	5651	49963	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:12.829849005 CET	5651	49963	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:12.839659929 CET	49964	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.839706898 CET	49964	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:12.845585108 CET	80	49964	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:12.845602036 CET	80	49964	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:13.025109053 CET	80	49958	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.025276899 CET	49958	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.025307894 CET	49958	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.025307894 CET	49958	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.025307894 CET	49958	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.025340080 CET	49958	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.031230927 CET	80	49958	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.031259060 CET	80	49958	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.031269073 CET	80	49958	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.031280994 CET	80	49958	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.034775972 CET	80	49958	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.034840107 CET	49958	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.122586966 CET	49967	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.129031897 CET	80	49967	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.129117966 CET	49967	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.226814032 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:13.262042046 CET	49967	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.262226105 CET	49967	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.267838955 CET	80	49967	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.267962933 CET	80	49967	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.276896000 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.431103945 CET	80	49964	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:13.431186914 CET	49964	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.431284904 CET	49964	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.433732033 CET	5651	49963	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:13.434052944 CET	49963	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.434052944 CET	49963	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.437131882 CET	80	49964	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:13.439845085 CET	5651	49963	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:13.450793982 CET	49971	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.456676960 CET	5651	49971	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:13.456792116 CET	49971	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.465959072 CET	49972	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.471816063 CET	80	49972	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:13.471879959 CET	49972	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.521979094 CET	5555	49895	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.522083044 CET	49895	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.522088051 CET	465	49892	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:13.522151947 CET	49892	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.522200108 CET	49895	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.522209883 CET	49892	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.528029919 CET	5555	49895	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.528228998 CET	465	49892	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:13.560451984 CET	49973	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.566371918 CET	465	49973	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:13.566577911 CET	49973	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.600668907 CET	49974	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.600795031 CET	49971	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.601016045 CET	49971	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.605317116 CET	49972	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.605317116 CET	49972	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.606955051 CET	5555	49974	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.606985092 CET	5651	49971	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:13.607000113 CET	5651	49971	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:13.607079029 CET	49974	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.611213923 CET	80	49972	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:13.611227036 CET	80	49972	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:13.699109077 CET	49973	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.699201107 CET	49973	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:13.705197096 CET	465	49973	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:13.705215931 CET	465	49973	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:13.714935064 CET	49974	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.714935064 CET	49974	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.720846891 CET	5555	49974	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.720884085 CET	5555	49974	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.988059044 CET	80	49967	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.988210917 CET	49967	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.988210917 CET	49967	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.988210917 CET	49967	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.988291025 CET	49967	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.988291025 CET	49967	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.994824886 CET	80	49967	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.994842052 CET	80	49967	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.994856119 CET	80	49967	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.994868994 CET	80	49967	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.995563030 CET	80	49967	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:13.995655060 CET	49967	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:13.998116016 CET	49977	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:14.004467964 CET	80	49977	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:14.004540920 CET	49977	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:14.136888027 CET	49977	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:14.136915922 CET	49977	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:14.142828941 CET	80	49977	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:14.142847061 CET	80	49977	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:14.165050983 CET	5651	49971	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:14.165136099 CET	49971	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.165211916 CET	49971	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.171101093 CET	5651	49971	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:14.207653999 CET	80	49972	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:14.207765102 CET	49972	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.207765102 CET	49972	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.213649035 CET	80	49972	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:14.216514111 CET	49980	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.222605944 CET	5651	49980	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:14.222676039 CET	49980	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.227132082 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:14.231451988 CET	49981	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.237504959 CET	80	49981	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:14.237634897 CET	49981	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.276901960 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.355159998 CET	49980	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.355184078 CET	49980	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.361352921 CET	5651	49980	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:14.361373901 CET	5651	49980	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:14.370767117 CET	49981	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.370834112 CET	49981	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.376589060 CET	80	49981	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:14.376854897 CET	80	49981	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:14.863517046 CET	80	49977	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:14.863661051 CET	49977	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:14.863661051 CET	49977	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:14.863688946 CET	49977	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:14.863688946 CET	49977	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:14.863775015 CET	49977	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:14.869525909 CET	80	49977	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:14.869541883 CET	80	49977	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:14.869551897 CET	80	49977	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:14.869561911 CET	80	49977	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:14.870063066 CET	80	49977	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:14.870240927 CET	49977	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:14.872558117 CET	49985	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:14.878408909 CET	80	49985	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:14.880675077 CET	49985	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:14.948194027 CET	5651	49980	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:14.948287010 CET	49980	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.948375940 CET	49980	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.948957920 CET	80	49981	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:14.949414015 CET	49981	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.949490070 CET	49981	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.954292059 CET	5651	49980	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:14.955271959 CET	80	49981	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:14.981595039 CET	49987	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.987495899 CET	5651	49987	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:14.988687992 CET	49987	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:14.996721983 CET	49988	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.002554893 CET	80	49988	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:15.004821062 CET	49988	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.011395931 CET	49985	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:15.011466980 CET	49985	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:15.017533064 CET	80	49985	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:15.017569065 CET	80	49985	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:15.120770931 CET	49987	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.120857954 CET	49987	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.127298117 CET	5651	49987	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:15.127454996 CET	5651	49987	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:15.136573076 CET	49988	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.136573076 CET	49988	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.143207073 CET	80	49988	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:15.143217087 CET	80	49988	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:15.242620945 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:15.292602062 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.713023901 CET	5651	49987	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:15.713150024 CET	49987	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.713150024 CET	49987	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.719957113 CET	5651	49987	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:15.732486010 CET	80	49985	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:15.732598066 CET	49985	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:15.732646942 CET	49985	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:15.732646942 CET	49985	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:15.732671976 CET	49985	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:15.732703924 CET	49985	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:15.733256102 CET	80	49988	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:15.733316898 CET	49988	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.733351946 CET	49988	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.738625050 CET	80	49985	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:15.738646030 CET	80	49985	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:15.738658905 CET	80	49985	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:15.738672018 CET	80	49985	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:15.739165068 CET	80	49985	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:15.739212990 CET	49985	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:15.739330053 CET	80	49988	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:15.747359991 CET	49994	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.753247023 CET	5651	49994	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:15.753319025 CET	49994	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.762059927 CET	49995	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.768162012 CET	80	49995	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:15.768238068 CET	49995	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.777828932 CET	49996	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:15.783869028 CET	80	49996	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:15.783941984 CET	49996	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:15.886450052 CET	49994	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.886451006 CET	49994	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.893699884 CET	5651	49994	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:15.893735886 CET	5651	49994	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:15.902018070 CET	49995	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.902038097 CET	49995	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:15.908289909 CET	80	49995	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:15.908301115 CET	80	49995	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:15.917874098 CET	49996	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:15.917996883 CET	49996	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:15.923794985 CET	80	49996	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:15.923806906 CET	80	49996	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:16.258759975 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:16.308128119 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:16.459013939 CET	5651	49994	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:16.460648060 CET	49994	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:16.470688105 CET	49994	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:16.477248907 CET	5651	49994	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:16.481055975 CET	80	49995	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:16.481133938 CET	49995	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:16.481245041 CET	49995	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:16.487797022 CET	80	49995	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:16.582755089 CET	50001	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:16.589236021 CET	5651	50001	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:16.592637062 CET	50001	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:16.597484112 CET	50002	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:16.603991985 CET	80	50002	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:16.604059935 CET	50002	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:16.646450043 CET	80	49996	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:16.651235104 CET	49996	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:16.651271105 CET	49996	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:16.651271105 CET	49996	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:16.651288986 CET	49996	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:16.651288986 CET	49996	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:16.657133102 CET	80	49996	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:16.657145023 CET	80	49996	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:16.657152891 CET	80	49996	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:16.657180071 CET	80	49996	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:16.657824993 CET	80	49996	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:16.660619020 CET	49996	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:16.693212032 CET	50001	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:16.693233013 CET	50001	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:16.699043989 CET	5651	50001	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:16.699131012 CET	5651	50001	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:16.714694977 CET	50002	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:16.714694977 CET	50002	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:16.720545053 CET	80	50002	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:16.720567942 CET	80	50002	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:16.733666897 CET	50004	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:16.739639997 CET	80	50004	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:16.739698887 CET	50004	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:16.870743990 CET	50004	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:16.870771885 CET	50004	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:16.880016088 CET	80	50004	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:16.880033016 CET	80	50004	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:17.275321007 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:17.323765039 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:17.328047991 CET	80	50002	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:17.328178883 CET	50002	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:17.328178883 CET	50002	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:17.332636118 CET	5651	50001	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:17.332726002 CET	50001	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:17.332808018 CET	50001	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:17.334254026 CET	80	50002	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:17.338630915 CET	5651	50001	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:17.389352083 CET	50009	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:17.395459890 CET	5651	50009	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:17.395531893 CET	50009	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:17.405543089 CET	50010	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:17.411485910 CET	80	50010	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:17.411561966 CET	50010	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:17.527055979 CET	50009	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:17.527055979 CET	50009	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:17.532998085 CET	5651	50009	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:17.533015966 CET	5651	50009	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:17.542658091 CET	50010	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:17.542709112 CET	50010	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:17.548612118 CET	80	50010	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:17.548652887 CET	80	50010	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:17.596580982 CET	80	50004	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:17.596693993 CET	50004	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:17.596752882 CET	50004	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:17.596752882 CET	50004	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:17.596752882 CET	50004	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:17.596790075 CET	50004	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:17.602901936 CET	80	50004	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:17.602912903 CET	80	50004	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:17.602922916 CET	80	50004	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:17.602932930 CET	80	50004	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:17.603303909 CET	80	50004	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:17.603359938 CET	50004	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:17.607456923 CET	50012	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:17.613307953 CET	80	50012	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:17.613373995 CET	50012	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:17.745862007 CET	50012	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:17.745907068 CET	50012	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:17.751913071 CET	80	50012	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:17.752062082 CET	80	50012	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:18.105330944 CET	5651	50009	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:18.105664968 CET	50009	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.105771065 CET	50009	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.112709045 CET	5651	50009	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:18.135086060 CET	80	50010	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:18.135160923 CET	50010	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.135229111 CET	50010	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.141118050 CET	80	50010	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:18.156337976 CET	50016	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.162426949 CET	5651	50016	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:18.162518978 CET	50016	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.170937061 CET	50017	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.179028988 CET	80	50017	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:18.179150105 CET	50017	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.289439917 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:18.292678118 CET	50016	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.292716026 CET	50016	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.298708916 CET	5651	50016	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:18.298722029 CET	5651	50016	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:18.308221102 CET	50017	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.308336020 CET	50017	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.314095974 CET	80	50017	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:18.314379930 CET	80	50017	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:18.339401960 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.494033098 CET	80	50012	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:18.494235039 CET	50012	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:18.494319916 CET	50012	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:18.494343042 CET	50012	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:18.494363070 CET	50012	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:18.494399071 CET	50012	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:18.500587940 CET	80	50012	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:18.500825882 CET	80	50012	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:18.500925064 CET	80	50012	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:18.501046896 CET	80	50012	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:18.501629114 CET	80	50012	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:18.501684904 CET	50012	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:18.592406988 CET	50021	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:18.599204063 CET	80	50021	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:18.599275112 CET	50021	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:18.730217934 CET	50021	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:18.730484009 CET	50021	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:18.736330032 CET	80	50021	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:18.736385107 CET	80	50021	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:18.874187946 CET	5651	50016	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:18.874288082 CET	50016	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.874376059 CET	50016	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.880141020 CET	5651	50016	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:18.901344061 CET	80	50017	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:18.901420116 CET	50017	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.901529074 CET	50017	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.907433033 CET	80	50017	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:18.921092033 CET	50024	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.927186966 CET	5651	50024	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:18.927290916 CET	50024	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.935831070 CET	50025	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:18.942419052 CET	80	50025	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:18.942526102 CET	50025	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.058289051 CET	50024	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.058331966 CET	50024	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.064858913 CET	5651	50024	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:19.064877987 CET	5651	50024	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:19.073904037 CET	50025	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.073904037 CET	50025	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.080538988 CET	80	50025	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:19.080554008 CET	80	50025	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:19.304979086 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:19.355005980 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.499582052 CET	80	50021	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:19.499739885 CET	50021	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:19.499773979 CET	50021	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:19.499789000 CET	50021	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:19.499829054 CET	50021	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:19.499907017 CET	50021	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:19.505678892 CET	80	50021	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:19.505724907 CET	80	50021	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:19.505733013 CET	80	50021	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:19.505740881 CET	80	50021	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:19.506035089 CET	80	50021	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:19.506232977 CET	50021	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:19.576792955 CET	50029	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:19.582761049 CET	80	50029	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:19.582830906 CET	50029	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:19.641519070 CET	80	50025	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:19.641578913 CET	50025	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.641674042 CET	50025	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.645690918 CET	5651	50024	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:19.645854950 CET	50024	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.645899057 CET	50024	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.648231983 CET	80	50025	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:19.652688980 CET	5651	50024	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:19.685408115 CET	50032	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.691350937 CET	5651	50032	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:19.691416979 CET	50032	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.700963974 CET	50033	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.706882000 CET	80	50033	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:19.706959963 CET	50033	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.714534998 CET	50029	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:19.714571953 CET	50029	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:19.720505953 CET	80	50029	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:19.720516920 CET	80	50029	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:19.823945045 CET	50032	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.823995113 CET	50032	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.830971956 CET	5651	50032	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:19.830987930 CET	5651	50032	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:19.839535952 CET	50033	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.839936018 CET	50033	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:19.845423937 CET	80	50033	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:19.845705032 CET	80	50033	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:20.320413113 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:20.370635986 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:20.408859968 CET	5651	50032	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:20.408942938 CET	50032	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:20.408991098 CET	50032	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:20.414882898 CET	5651	50032	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:20.419985056 CET	80	50033	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:20.420453072 CET	50033	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:20.420453072 CET	50033	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:20.426270962 CET	80	50033	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:20.451709032 CET	50037	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:20.457639933 CET	5651	50037	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:20.460643053 CET	50037	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:20.464441061 CET	80	50029	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:20.464670897 CET	50029	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:20.464687109 CET	50029	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:20.464699984 CET	50029	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:20.464726925 CET	50029	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:20.464755058 CET	50029	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:20.467962980 CET	50038	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:20.470896006 CET	80	50029	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:20.470928907 CET	80	50029	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:20.470937967 CET	80	50029	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:20.470963955 CET	80	50029	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:20.471421003 CET	80	50029	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:20.472611904 CET	50029	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:20.473838091 CET	80	50038	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:20.474239111 CET	50038	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:20.589654922 CET	50037	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:20.589654922 CET	50037	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:20.595613956 CET	5651	50037	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:20.595629930 CET	5651	50037	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:20.605256081 CET	50038	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:20.605256081 CET	50038	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:20.611170053 CET	80	50038	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:20.611183882 CET	80	50038	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:21.157286882 CET	5651	50037	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:21.158989906 CET	50037	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:21.161761999 CET	50037	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:21.167543888 CET	5651	50037	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:21.212238073 CET	80	50038	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:21.214451075 CET	50038	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:21.245201111 CET	50038	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:21.251104116 CET	80	50038	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:21.336064100 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:21.386293888 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:22.064584970 CET	465	49973	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:22.064697027 CET	49973	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:22.064735889 CET	49973	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:22.070893049 CET	465	49973	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:22.093271017 CET	5555	49974	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:22.093364000 CET	49974	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:22.093400955 CET	49974	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:22.099373102 CET	5555	49974	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:22.351598024 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:22.401931047 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:23.367422104 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:23.417510033 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:24.369726896 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:24.417553902 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:24.547437906 CET	50062	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:24.553327084 CET	5651	50062	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:24.553436041 CET	50062	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:24.561189890 CET	50063	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:24.567111015 CET	80	50063	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:24.567209959 CET	50063	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:24.577721119 CET	50064	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:24.583574057 CET	465	50064	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:24.583652020 CET	50064	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:24.592027903 CET	50065	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:24.597871065 CET	80	50065	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:24.597976923 CET	50065	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:24.621649981 CET	50066	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:24.627698898 CET	5555	50066	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:24.627768993 CET	50066	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:24.683582067 CET	50062	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:24.683620930 CET	50062	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:24.690265894 CET	5651	50062	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:24.690359116 CET	5651	50062	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:24.698975086 CET	50063	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:24.699019909 CET	50063	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:24.704951048 CET	80	50063	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:24.704967022 CET	80	50063	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:24.715153933 CET	50064	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:24.715199947 CET	50064	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:24.721272945 CET	465	50064	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:24.721283913 CET	465	50064	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:24.730221987 CET	50065	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:24.730259895 CET	50065	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:24.736669064 CET	80	50065	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:24.736690998 CET	80	50065	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:24.746014118 CET	50066	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:24.746046066 CET	50066	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:24.751980066 CET	5555	50066	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:24.752006054 CET	5555	50066	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:25.273658991 CET	5651	50062	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:25.273742914 CET	50062	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:25.273814917 CET	50062	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:25.279618979 CET	5651	50062	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:25.288224936 CET	80	50063	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:25.288347006 CET	50063	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:25.288661003 CET	50063	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:25.294517994 CET	80	50063	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:25.370121956 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:25.374717951 CET	50072	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:25.380614042 CET	5651	50072	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:25.380678892 CET	50072	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:25.389214039 CET	50073	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:25.395126104 CET	80	50073	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:25.395246029 CET	50073	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:25.417511940 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:25.459703922 CET	80	50065	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:25.459853888 CET	50065	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:25.459897995 CET	50065	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:25.459897995 CET	50065	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:25.459980011 CET	50065	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:25.459980011 CET	50065	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:25.465827942 CET	80	50065	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:25.465841055 CET	80	50065	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:25.465851068 CET	80	50065	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:25.465859890 CET	80	50065	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:25.466165066 CET	80	50065	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:25.466528893 CET	50065	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:25.536478996 CET	50072	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:25.536505938 CET	50072	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:25.537065029 CET	50073	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:25.537065983 CET	50073	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:25.542382002 CET	5651	50072	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:25.542397022 CET	5651	50072	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:25.542920113 CET	80	50073	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:25.542937994 CET	80	50073	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:26.087521076 CET	5651	50072	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:26.087599039 CET	50072	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:26.087686062 CET	50072	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:26.093544006 CET	5651	50072	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:26.108881950 CET	80	50073	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:26.109038115 CET	50073	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:26.109038115 CET	50073	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:26.114912033 CET	80	50073	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:26.385114908 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:26.433160067 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:27.400593996 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:27.448791027 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:27.531034946 CET	50084	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:27.536855936 CET	5651	50084	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:27.540313005 CET	50084	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:27.545414925 CET	50085	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:27.551414967 CET	80	50085	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:27.551538944 CET	50085	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:27.560887098 CET	50086	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:27.567096949 CET	80	50086	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:27.567199945 CET	50086	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:27.668462038 CET	50084	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:27.668462038 CET	50084	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:27.674535036 CET	5651	50084	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:27.674570084 CET	5651	50084	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:27.683518887 CET	50085	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:27.683520079 CET	50085	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:27.689583063 CET	80	50085	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:27.689662933 CET	80	50085	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:27.699126959 CET	50086	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:27.699157953 CET	50086	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:27.704957962 CET	80	50086	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:27.704982996 CET	80	50086	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:28.271100998 CET	80	50085	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:28.271195889 CET	50085	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:28.271295071 CET	50085	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:28.277108908 CET	80	50085	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:28.283178091 CET	5651	50084	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:28.283307076 CET	50084	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:28.283418894 CET	50084	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:28.289910078 CET	5651	50084	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:28.327302933 CET	50091	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:28.333281040 CET	5651	50091	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:28.333350897 CET	50091	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:28.342140913 CET	50092	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:28.348171949 CET	80	50092	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:28.348232985 CET	50092	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:28.416039944 CET	80	50086	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:28.416205883 CET	50086	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:28.416258097 CET	50086	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:28.416258097 CET	50086	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:28.416258097 CET	50086	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:28.416275978 CET	50086	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:28.416872978 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:28.422075987 CET	80	50086	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:28.422086000 CET	80	50086	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:28.422095060 CET	80	50086	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:28.422151089 CET	80	50086	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:28.422605038 CET	80	50086	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:28.422763109 CET	50086	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:28.436305046 CET	50094	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:28.442390919 CET	80	50094	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:28.442533970 CET	50094	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:28.464437008 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:28.464785099 CET	50091	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:28.464785099 CET	50091	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:28.470727921 CET	5651	50091	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:28.470801115 CET	5651	50091	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:28.480129957 CET	50092	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:28.480164051 CET	50092	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:28.485944986 CET	80	50092	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:28.486124039 CET	80	50092	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:28.574306965 CET	50094	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:28.574306965 CET	50094	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:28.580246925 CET	80	50094	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:28.580302000 CET	80	50094	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:29.031631947 CET	5651	50091	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:29.031739950 CET	50091	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.031816959 CET	50091	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.037590027 CET	5651	50091	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:29.053544998 CET	80	50092	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:29.053659916 CET	50092	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.053724051 CET	50092	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.059549093 CET	80	50092	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:29.100651026 CET	50098	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.106801033 CET	50099	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.106832981 CET	5651	50098	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:29.106977940 CET	50098	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.112654924 CET	80	50099	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:29.114808083 CET	50099	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.230377913 CET	50098	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.230618954 CET	50098	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.236449003 CET	5651	50098	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:29.236465931 CET	5651	50098	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:29.245738983 CET	50099	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.245765924 CET	50099	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.251938105 CET	80	50099	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:29.251979113 CET	80	50099	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:29.299985886 CET	80	50094	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:29.300175905 CET	50094	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:29.300252914 CET	50094	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:29.300252914 CET	50094	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:29.300252914 CET	50094	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:29.300252914 CET	50094	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:29.306104898 CET	80	50094	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:29.306145906 CET	80	50094	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:29.306155920 CET	80	50094	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:29.306186914 CET	80	50094	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:29.306569099 CET	80	50094	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:29.306648016 CET	50094	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:29.309417963 CET	50101	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:29.315397024 CET	80	50101	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:29.315486908 CET	50101	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:29.431997061 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:29.448949099 CET	50101	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:29.449018002 CET	50101	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:29.455169916 CET	80	50101	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:29.455202103 CET	80	50101	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:29.480082035 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.818880081 CET	80	50099	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:29.819036007 CET	50099	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.819036007 CET	50099	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.819982052 CET	5651	50098	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:29.820060015 CET	50098	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.820116997 CET	50098	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.825134039 CET	80	50099	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:29.826081991 CET	5651	50098	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:29.856473923 CET	50102	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.862588882 CET	5651	50102	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:29.862649918 CET	50102	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.871738911 CET	50103	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.878036976 CET	80	50103	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:29.878108025 CET	50103	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.995914936 CET	50102	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:29.995999098 CET	50102	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:30.002024889 CET	5651	50102	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:30.002046108 CET	5651	50102	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:30.011423111 CET	50103	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:30.011462927 CET	50103	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:30.017460108 CET	80	50103	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:30.017518044 CET	80	50103	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:30.163588047 CET	80	50101	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:30.163789988 CET	50101	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:30.163888931 CET	50101	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:30.163888931 CET	50101	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:30.163889885 CET	50101	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:30.163889885 CET	50101	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:30.169833899 CET	80	50101	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:30.169867992 CET	80	50101	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:30.169923067 CET	80	50101	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:30.169950962 CET	80	50101	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:30.170470953 CET	80	50101	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:30.170530081 CET	50101	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:30.184308052 CET	50104	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:30.190193892 CET	80	50104	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:30.190295935 CET	50104	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:30.324245930 CET	50104	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:30.324320078 CET	50104	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:30.509088039 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:30.510092020 CET	80	50104	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:30.510128975 CET	80	50104	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:30.558166981 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:30.587557077 CET	5651	50102	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:30.587739944 CET	50102	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:30.587794065 CET	50102	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:30.589885950 CET	80	50103	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:30.589951038 CET	50103	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:30.589994907 CET	50103	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:30.593672037 CET	5651	50102	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:30.595841885 CET	80	50103	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:30.621973038 CET	50105	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:30.628551960 CET	5651	50105	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:30.628660917 CET	50105	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:30.637275934 CET	50106	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:30.643271923 CET	80	50106	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:30.643378019 CET	50106	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:30.761588097 CET	50105	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:30.761786938 CET	50105	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:30.767715931 CET	5651	50105	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:30.767740965 CET	5651	50105	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:30.777021885 CET	50106	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:30.780615091 CET	50106	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:30.783210993 CET	80	50106	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:30.786480904 CET	80	50106	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:31.080940008 CET	80	50104	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:31.081264019 CET	50104	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:31.081306934 CET	50104	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:31.081306934 CET	50104	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:31.081306934 CET	50104	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:31.081319094 CET	50104	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:31.087507010 CET	80	50104	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:31.087539911 CET	80	50104	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:31.087568045 CET	80	50104	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:31.087595940 CET	80	50104	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:31.088299990 CET	80	50104	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:31.088349104 CET	50104	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:31.168925047 CET	50107	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:31.174904108 CET	80	50107	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:31.175004005 CET	50107	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:31.308361053 CET	50107	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:31.308413982 CET	50107	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:31.314527988 CET	80	50107	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:31.314574003 CET	80	50107	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:31.346990108 CET	5651	50105	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:31.347071886 CET	50105	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:31.347121000 CET	50105	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:31.353267908 CET	5651	50105	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:31.370904922 CET	80	50106	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:31.371068954 CET	50106	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:31.371119976 CET	50106	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:31.377389908 CET	80	50106	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:31.387414932 CET	50108	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:31.393712044 CET	5651	50108	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:31.393804073 CET	50108	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:31.402879953 CET	50109	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:31.408782005 CET	80	50109	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:31.408862114 CET	50109	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:31.463160992 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:31.511362076 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:31.527110100 CET	50108	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:31.527110100 CET	50108	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:31.533171892 CET	5651	50108	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:31.533206940 CET	5651	50108	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:31.542606115 CET	50109	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:31.542728901 CET	50109	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:31.548583984 CET	80	50109	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:31.548630953 CET	80	50109	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.023204088 CET	80	50107	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:32.023441076 CET	50107	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:32.023442030 CET	50107	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:32.023490906 CET	50107	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:32.023490906 CET	50107	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:32.023490906 CET	50107	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:32.029570103 CET	80	50107	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:32.029632092 CET	80	50107	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:32.029659986 CET	80	50107	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:32.029686928 CET	80	50107	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:32.030163050 CET	80	50107	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:32.030237913 CET	50107	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:32.043706894 CET	50110	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:32.049832106 CET	80	50110	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:32.049952030 CET	50110	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:32.114351988 CET	80	50109	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.114587069 CET	50109	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.114623070 CET	50109	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.120748997 CET	80	50109	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.125520945 CET	5651	50108	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.125586987 CET	50108	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.125612974 CET	50108	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.131974936 CET	5651	50108	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.153402090 CET	50111	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.160166979 CET	5651	50111	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.160330057 CET	50111	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.168766975 CET	50112	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.175241947 CET	80	50112	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.175349951 CET	50112	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.183420897 CET	50110	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:32.183440924 CET	50110	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:32.189435005 CET	80	50110	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:32.189452887 CET	80	50110	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:32.292743921 CET	50111	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.292828083 CET	50111	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.299067020 CET	5651	50111	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.299310923 CET	5651	50111	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.308248997 CET	50112	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.308392048 CET	50112	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.314445972 CET	80	50112	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.314479113 CET	80	50112	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.479110003 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.526973963 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.875966072 CET	5651	50111	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.876735926 CET	50111	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.880505085 CET	50111	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.886435986 CET	5651	50111	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.897197962 CET	80	50112	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.900645018 CET	50112	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.900684118 CET	50112	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.906635046 CET	80	50110	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:32.906866074 CET	80	50112	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.906994104 CET	50110	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:32.907008886 CET	50110	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:32.907008886 CET	50110	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:32.907017946 CET	50110	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:32.907040119 CET	50110	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:32.912964106 CET	80	50110	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:32.912995100 CET	80	50110	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:32.913023949 CET	80	50110	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:32.913069010 CET	80	50110	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:32.913464069 CET	80	50110	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:32.916640043 CET	50110	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:32.918690920 CET	50113	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.924720049 CET	5651	50113	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.928663015 CET	50113	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.934228897 CET	50114	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.940231085 CET	80	50114	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:32.940648079 CET	50114	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:32.949949026 CET	50115	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:32.955864906 CET	80	50115	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:32.956634998 CET	50115	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:33.058343887 CET	50113	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.058377981 CET	50113	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.064208031 CET	465	50064	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.064292908 CET	50064	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.064347029 CET	50064	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.064522982 CET	5651	50113	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.064551115 CET	5651	50113	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.070523977 CET	465	50064	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.074013948 CET	50114	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.074013948 CET	50114	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.080079079 CET	80	50114	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.080097914 CET	80	50114	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.089468956 CET	50115	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:33.089490891 CET	50115	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:33.095472097 CET	80	50115	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:33.095566034 CET	80	50115	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:33.110093117 CET	5555	50066	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:33.110150099 CET	50066	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:33.110213041 CET	50066	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:33.116137981 CET	5555	50066	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:33.137789011 CET	50116	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.143773079 CET	465	50116	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.143867970 CET	50116	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.152982950 CET	50117	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:33.159090996 CET	5555	50117	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:33.159969091 CET	50117	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:33.277211905 CET	50116	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.277266026 CET	50116	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.283103943 CET	465	50116	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.283210039 CET	465	50116	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.292699099 CET	50117	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:33.292855024 CET	50117	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:33.298726082 CET	5555	50117	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:33.298764944 CET	5555	50117	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:33.495176077 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.542568922 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.642277956 CET	5651	50113	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.642493010 CET	50113	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.642541885 CET	50113	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.649667978 CET	5651	50113	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.661490917 CET	80	50114	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.661608934 CET	50114	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.661653996 CET	50114	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.667623043 CET	80	50114	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.684298038 CET	50118	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.690406084 CET	5651	50118	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.690489054 CET	50118	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.699709892 CET	50119	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.705770016 CET	80	50119	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.705871105 CET	50119	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.814249039 CET	80	50115	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:33.816699028 CET	50115	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:33.816726923 CET	50115	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:33.816726923 CET	50115	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:33.816745996 CET	50115	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:33.816745996 CET	50115	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:33.822783947 CET	80	50115	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:33.822801113 CET	80	50115	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:33.822815895 CET	80	50115	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:33.822828054 CET	80	50115	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:33.823191881 CET	80	50115	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:33.823359966 CET	50115	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:33.824342966 CET	50118	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.824415922 CET	50118	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.830296040 CET	5651	50118	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.830311060 CET	5651	50118	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.839643955 CET	50119	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.839675903 CET	50119	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:33.845663071 CET	80	50119	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.845681906 CET	80	50119	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:33.903301001 CET	50120	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:33.909584999 CET	80	50120	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:33.909653902 CET	50120	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:34.042850018 CET	50120	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:34.042937994 CET	50120	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:34.048866034 CET	80	50120	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:34.048882961 CET	80	50120	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:34.408561945 CET	5651	50118	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:34.408629894 CET	50118	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:34.408674955 CET	50118	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:34.414649010 CET	5651	50118	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:34.450009108 CET	80	50119	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:34.450069904 CET	50119	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:34.450114012 CET	50119	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:34.456057072 CET	80	50119	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:34.459137917 CET	50121	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:34.465105057 CET	5651	50121	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:34.465159893 CET	50121	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:34.510011911 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:34.558140039 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:34.592953920 CET	50121	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:34.592953920 CET	50121	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:34.598988056 CET	5651	50121	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:34.599006891 CET	5651	50121	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:34.790018082 CET	80	50120	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:34.792716980 CET	50120	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:34.792716980 CET	50120	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:34.792716980 CET	50120	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:34.792805910 CET	50120	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:34.792805910 CET	50120	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:34.798800945 CET	80	50120	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:34.798861027 CET	80	50120	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:34.798888922 CET	80	50120	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:34.798917055 CET	80	50120	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:34.799668074 CET	80	50120	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:34.799730062 CET	50120	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:35.188863993 CET	5651	50121	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:35.192653894 CET	50121	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:35.192759037 CET	50121	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:35.198678017 CET	5651	50121	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:35.525669098 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:35.573837996 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:36.526453972 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:36.573787928 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:37.541915894 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:37.589461088 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:38.529915094 CET	50122	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:38.535959959 CET	5651	50122	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:38.536030054 CET	50122	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:38.543391943 CET	50123	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:38.549725056 CET	80	50123	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:38.549784899 CET	50123	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:38.557267904 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:38.559459925 CET	50124	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:38.565336943 CET	80	50124	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:38.565401077 CET	50124	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:38.605037928 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:38.667893887 CET	50122	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:38.672620058 CET	50122	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:38.673739910 CET	5651	50122	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:38.678680897 CET	5651	50122	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:38.683670998 CET	50123	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:38.683670998 CET	50123	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:38.689639091 CET	80	50123	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:38.689652920 CET	80	50123	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:38.698965073 CET	50124	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:38.698996067 CET	50124	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:38.704879999 CET	80	50124	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:38.704962015 CET	80	50124	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:39.250766039 CET	5651	50122	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:39.250842094 CET	50122	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:39.250880003 CET	50122	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:39.256814003 CET	5651	50122	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:39.262538910 CET	50125	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:39.265734911 CET	80	50123	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:39.265790939 CET	50123	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:39.265832901 CET	50123	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:39.268819094 CET	5651	50125	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:39.268886089 CET	50125	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:39.271791935 CET	80	50123	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:39.402100086 CET	50125	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:39.402100086 CET	50125	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:39.408324957 CET	5651	50125	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:39.408371925 CET	5651	50125	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:39.419019938 CET	80	50124	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:39.419255972 CET	50124	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:39.419255972 CET	50124	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:39.419255972 CET	50124	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:39.419255972 CET	50124	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:39.419256926 CET	50124	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:39.425263882 CET	80	50124	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:39.425309896 CET	80	50124	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:39.425338030 CET	80	50124	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:39.425370932 CET	80	50124	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:39.425646067 CET	80	50124	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:39.425703049 CET	50124	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:39.573663950 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:39.620672941 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:40.749846935 CET	5651	50125	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:40.749975920 CET	50125	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:40.750128031 CET	50125	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:40.751106977 CET	5651	50125	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:40.751159906 CET	50125	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:40.751847029 CET	5651	50125	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:40.751892090 CET	50125	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:40.752710104 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:40.756866932 CET	5651	50125	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:40.792556047 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:41.604835033 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:41.631179094 CET	465	50116	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:41.631381035 CET	50116	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:41.631602049 CET	50116	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:41.637440920 CET	465	50116	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:41.648720980 CET	5555	50117	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:41.651660919 CET	50117	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:41.651719093 CET	50117	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:41.651905060 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:41.657696009 CET	5555	50117	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:42.605369091 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:42.651920080 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:43.620814085 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:43.667531967 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:44.636464119 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:44.683155060 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:45.372801065 CET	50127	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:45.379015923 CET	5651	50127	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:45.379112005 CET	50127	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:45.387113094 CET	50128	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:45.393146992 CET	80	50128	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:45.393306971 CET	50128	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:45.402592897 CET	50129	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:45.408472061 CET	465	50129	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:45.408571005 CET	50129	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:45.418545961 CET	50130	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:45.424408913 CET	80	50130	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:45.424484968 CET	50130	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:45.433980942 CET	50131	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:45.439924002 CET	5555	50131	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:45.440114975 CET	50131	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:45.511519909 CET	50127	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:45.511898041 CET	50127	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:45.517483950 CET	5651	50127	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:45.517752886 CET	5651	50127	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:45.526961088 CET	50128	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:45.526987076 CET	50128	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:45.532969952 CET	80	50128	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:45.533026934 CET	80	50128	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:45.542699099 CET	50129	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:45.542730093 CET	50129	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:45.548605919 CET	465	50129	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:45.548680067 CET	465	50129	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:45.558211088 CET	50130	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:45.558227062 CET	50130	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:45.564111948 CET	80	50130	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:45.564126015 CET	80	50130	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:45.574466944 CET	50131	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:45.574466944 CET	50131	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:45.580554962 CET	5555	50131	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:45.580580950 CET	5555	50131	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:45.636156082 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:45.683163881 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.104863882 CET	5651	50127	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:46.108676910 CET	50127	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.108757973 CET	50127	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.109759092 CET	80	50128	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:46.112379074 CET	50128	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.112471104 CET	50128	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.114701033 CET	5651	50127	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:46.118271112 CET	80	50128	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:46.158587933 CET	50132	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.164530039 CET	5651	50132	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:46.164686918 CET	50132	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.169634104 CET	50133	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.175560951 CET	80	50133	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:46.176647902 CET	50133	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.272918940 CET	80	50130	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:46.276722908 CET	50130	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:46.276724100 CET	50130	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:46.276724100 CET	50130	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:46.276809931 CET	50130	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:46.276809931 CET	50130	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:46.282756090 CET	80	50130	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:46.282814026 CET	80	50130	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:46.282843113 CET	80	50130	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:46.282893896 CET	80	50130	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:46.283185005 CET	80	50130	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:46.288635969 CET	50130	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:46.293350935 CET	50132	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.293351889 CET	50132	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.299336910 CET	5651	50132	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:46.299621105 CET	5651	50132	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:46.308206081 CET	50133	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.308234930 CET	50133	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.314202070 CET	80	50133	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:46.314230919 CET	80	50133	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:46.372090101 CET	50134	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:46.378017902 CET	80	50134	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:46.378087044 CET	50134	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:46.511682034 CET	50134	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:46.511682034 CET	50134	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:46.517713070 CET	80	50134	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:46.517748117 CET	80	50134	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:46.651863098 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:46.698795080 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.883867979 CET	80	50133	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:46.884028912 CET	50133	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.884093046 CET	50133	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.890003920 CET	80	50133	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:46.895524979 CET	5651	50132	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:46.895598888 CET	50132	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.895689964 CET	50132	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.901532888 CET	5651	50132	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:46.918664932 CET	50135	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.924685001 CET	5651	50135	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:46.924777985 CET	50135	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.934441090 CET	50136	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:46.940432072 CET	80	50136	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:46.940505981 CET	50136	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.060364962 CET	50135	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.060553074 CET	50135	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.066330910 CET	5651	50135	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:47.066446066 CET	5651	50135	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:47.074682951 CET	50136	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.074682951 CET	50136	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.082269907 CET	80	50136	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:47.082300901 CET	80	50136	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:47.243103027 CET	80	50134	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:47.243235111 CET	50134	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:47.243257999 CET	50134	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:47.243258953 CET	50134	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:47.243287086 CET	50134	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:47.243287086 CET	50134	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:47.246932030 CET	50137	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:47.249217987 CET	80	50134	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:47.249250889 CET	80	50134	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:47.249304056 CET	80	50134	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:47.249330997 CET	80	50134	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:47.249937057 CET	80	50134	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:47.249994040 CET	50134	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:47.252835989 CET	80	50137	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:47.252899885 CET	50137	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:47.386377096 CET	50137	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:47.386646032 CET	50137	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:47.392318964 CET	80	50137	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:47.392632961 CET	80	50137	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:47.637068987 CET	5651	50135	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:47.637136936 CET	50135	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.637171030 CET	50135	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.643173933 CET	5651	50135	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:47.651352882 CET	80	50136	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:47.651428938 CET	50136	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.651556969 CET	50136	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.657341003 CET	80	50136	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:47.667166948 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:47.684185028 CET	50138	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.690253973 CET	5651	50138	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:47.690315962 CET	50138	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.699517965 CET	50139	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.705753088 CET	80	50139	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:47.705828905 CET	50139	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.714399099 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.823914051 CET	50138	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.823966026 CET	50138	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.829947948 CET	5651	50138	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:47.829982042 CET	5651	50138	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:47.839448929 CET	50139	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.839551926 CET	50139	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:47.845279932 CET	80	50139	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:47.845379114 CET	80	50139	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:48.111412048 CET	80	50137	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:48.114708900 CET	50137	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:48.114742994 CET	50137	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:48.114799023 CET	50137	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:48.114806890 CET	50137	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:48.114840984 CET	50137	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:48.120842934 CET	80	50137	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:48.120872974 CET	80	50137	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:48.120898962 CET	80	50137	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:48.120925903 CET	80	50137	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:48.121151924 CET	80	50137	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:48.122685909 CET	50137	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:48.123653889 CET	50140	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:48.129734039 CET	80	50140	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:48.130740881 CET	50140	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:48.261454105 CET	50140	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:48.261455059 CET	50140	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:48.267750978 CET	80	50140	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:48.267784119 CET	80	50140	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:48.411084890 CET	80	50139	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:48.411159992 CET	50139	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:48.411202908 CET	50139	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:48.411807060 CET	5651	50138	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:48.411866903 CET	50138	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:48.411885023 CET	50138	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:48.417061090 CET	80	50139	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:48.417752981 CET	5651	50138	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:48.450558901 CET	50141	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:48.456731081 CET	5651	50141	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:48.458689928 CET	50141	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:48.466494083 CET	50142	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:48.472546101 CET	80	50142	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:48.472635031 CET	50142	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:48.589505911 CET	50141	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:48.590059996 CET	50141	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:48.595396042 CET	5651	50141	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:48.595942020 CET	5651	50141	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:48.605115891 CET	50142	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:48.606604099 CET	50142	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:48.610953093 CET	80	50142	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:48.612422943 CET	80	50142	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:48.683293104 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:48.730062962 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:48.984110117 CET	80	50140	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:48.984261036 CET	50140	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:48.984316111 CET	50140	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:48.984316111 CET	50140	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:48.984316111 CET	50140	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:48.984316111 CET	50140	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:48.990374088 CET	80	50140	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:48.990436077 CET	80	50140	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:48.990464926 CET	80	50140	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:48.990495920 CET	80	50140	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:48.990967035 CET	80	50140	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:48.991022110 CET	50140	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:48.998179913 CET	50143	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:49.004060030 CET	80	50143	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:49.004144907 CET	50143	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:49.136430979 CET	50143	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:49.138968945 CET	50143	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:49.142502069 CET	80	50143	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:49.145090103 CET	80	50143	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:49.163100958 CET	5651	50141	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:49.163186073 CET	50141	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.163250923 CET	50141	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.169224977 CET	5651	50141	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:49.181718111 CET	80	50142	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:49.181935072 CET	50142	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.181989908 CET	50142	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.187845945 CET	80	50142	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:49.215739012 CET	50144	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.221749067 CET	5651	50144	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:49.221873999 CET	50144	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.230873108 CET	50145	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.237025976 CET	80	50145	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:49.237112045 CET	50145	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.355170965 CET	50144	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.355263948 CET	50144	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.361213923 CET	5651	50144	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:49.361284018 CET	5651	50144	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:49.370738029 CET	50145	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.370764971 CET	50145	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.377818108 CET	80	50145	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:49.377857924 CET	80	50145	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:49.699002028 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:49.745670080 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.852947950 CET	80	50143	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:49.853101015 CET	50143	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:49.853135109 CET	50143	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:49.853135109 CET	50143	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:49.853158951 CET	50143	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:49.853158951 CET	50143	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:49.859235048 CET	80	50143	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:49.859277964 CET	80	50143	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:49.859291077 CET	80	50143	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:49.859302044 CET	80	50143	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:49.859810114 CET	80	50143	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:49.859878063 CET	50143	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:49.872170925 CET	50146	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:49.878263950 CET	80	50146	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:49.878727913 CET	50146	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:49.946938992 CET	5651	50144	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:49.947073936 CET	50144	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.947154045 CET	50144	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.953252077 CET	5651	50144	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:49.981262922 CET	50148	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.987171888 CET	5651	50148	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:49.987277985 CET	50148	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.989871025 CET	80	50145	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:49.989937067 CET	50145	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.989980936 CET	50145	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:49.995968103 CET	80	50145	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:50.011665106 CET	50146	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:50.011665106 CET	50146	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:50.017539024 CET	80	50146	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:50.017702103 CET	80	50146	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:50.120804071 CET	50148	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:50.120850086 CET	50148	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:50.127233028 CET	5651	50148	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:50.127304077 CET	5651	50148	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:50.697787046 CET	5651	50148	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:50.697983027 CET	50148	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:50.698080063 CET	50148	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:50.704374075 CET	5651	50148	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:50.714364052 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:50.761329889 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:50.761759043 CET	80	50146	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:50.761899948 CET	50146	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:50.761950016 CET	50146	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:50.761950016 CET	50146	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:50.761950016 CET	50146	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:50.761950016 CET	50146	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:50.767765045 CET	80	50146	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:50.767777920 CET	80	50146	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:50.767790079 CET	80	50146	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:50.767803907 CET	80	50146	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:50.768151045 CET	80	50146	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:50.768214941 CET	50146	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:51.738220930 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:51.792669058 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:52.745769024 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:52.792609930 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:53.761457920 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:53.808181047 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:53.895890951 CET	465	50129	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:53.896684885 CET	50129	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:53.896727085 CET	50129	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:53.902528048 CET	465	50129	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:53.952174902 CET	5555	50131	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:53.952267885 CET	50131	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:53.952315092 CET	50131	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:53.958247900 CET	5555	50131	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:54.761822939 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:54.808290958 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:55.777364016 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:55.823786020 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.091898918 CET	50149	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.097907066 CET	5651	50149	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:56.098041058 CET	50149	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.107884884 CET	50150	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.114090919 CET	80	50150	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:56.114177942 CET	50150	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.122642994 CET	50151	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.128503084 CET	465	50151	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:56.128582954 CET	50151	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.138308048 CET	50152	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:56.144262075 CET	80	50152	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:56.144330978 CET	50152	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:56.153661013 CET	50153	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:56.159487963 CET	5555	50153	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:56.159564018 CET	50153	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:56.230173111 CET	50149	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.230190992 CET	50149	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.236123085 CET	5651	50149	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:56.236138105 CET	5651	50149	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:56.245939016 CET	50150	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.246005058 CET	50150	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.252266884 CET	80	50150	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:56.252278090 CET	80	50150	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:56.263417006 CET	50151	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.263461113 CET	50151	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.269474983 CET	465	50151	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:56.269495964 CET	465	50151	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:56.278953075 CET	50152	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:56.278994083 CET	50152	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:56.284823895 CET	80	50152	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:56.284833908 CET	80	50152	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:56.293302059 CET	50153	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:56.293402910 CET	50153	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:56.299181938 CET	5555	50153	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:56.299211979 CET	5555	50153	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:56.793148041 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:56.809643030 CET	5651	50149	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:56.810694933 CET	50149	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.812623024 CET	50149	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.818922997 CET	5651	50149	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:56.828011990 CET	80	50150	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:56.830925941 CET	50150	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.833451986 CET	50150	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.839274883 CET	80	50150	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:56.839401960 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.874456882 CET	50154	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.880383968 CET	5651	50154	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:56.880686998 CET	50154	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.896456003 CET	50155	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:56.902471066 CET	80	50155	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:56.902946949 CET	50155	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.003952980 CET	80	50152	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:57.004076958 CET	50152	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:57.004122019 CET	50152	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:57.004122019 CET	50152	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:57.004122019 CET	50152	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:57.004122019 CET	50152	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:57.010262012 CET	80	50152	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:57.010272980 CET	80	50152	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:57.010282040 CET	80	50152	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:57.010289907 CET	80	50152	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:57.010963917 CET	80	50152	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:57.011025906 CET	50152	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:57.011797905 CET	50154	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.011797905 CET	50154	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.017743111 CET	5651	50154	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:57.017752886 CET	5651	50154	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:57.029849052 CET	50155	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.029906988 CET	50155	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.035654068 CET	80	50155	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:57.035662889 CET	80	50155	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:57.091175079 CET	50156	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:57.097028017 CET	80	50156	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:57.097141027 CET	50156	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:57.230123043 CET	50156	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:57.230123043 CET	50156	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:57.236084938 CET	80	50156	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:57.236148119 CET	80	50156	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:57.595134974 CET	5651	50154	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:57.595374107 CET	50154	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.595433950 CET	50154	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.601329088 CET	5651	50154	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:57.624593019 CET	80	50155	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:57.624699116 CET	50155	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.624738932 CET	50155	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.630544901 CET	80	50155	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:57.637654066 CET	50157	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.643564939 CET	5651	50157	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:57.643651962 CET	50157	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.653027058 CET	50158	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.658849955 CET	80	50158	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:57.658951998 CET	50158	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.777071953 CET	50157	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.777127028 CET	50157	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.783093929 CET	5651	50157	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:57.783109903 CET	5651	50157	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:57.792638063 CET	50158	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.792694092 CET	50158	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.798547029 CET	80	50158	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:57.798569918 CET	80	50158	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:57.808775902 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:57.855034113 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:57.957206964 CET	80	50156	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:57.957319975 CET	50156	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:57.957319975 CET	50156	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:57.957370996 CET	50156	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:57.957370996 CET	50156	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:57.957370996 CET	50156	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:57.963283062 CET	80	50156	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:57.963294029 CET	80	50156	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:57.963301897 CET	80	50156	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:57.963310957 CET	80	50156	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:57.963627100 CET	80	50156	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:57.963694096 CET	50156	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:57.966451883 CET	50159	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:57.972440958 CET	80	50159	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:57.972533941 CET	50159	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:58.105427027 CET	50159	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:58.105552912 CET	50159	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:58.111393929 CET	80	50159	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:58.111406088 CET	80	50159	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:58.355828047 CET	5651	50157	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:58.355899096 CET	50157	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:58.355953932 CET	50157	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:58.361809969 CET	5651	50157	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:58.380979061 CET	80	50158	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:58.381109953 CET	50158	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:58.381150961 CET	50158	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:58.387064934 CET	80	50158	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:58.404170990 CET	50160	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:58.410242081 CET	5651	50160	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:58.410366058 CET	50160	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:58.423525095 CET	50161	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:58.429369926 CET	80	50161	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:58.429435968 CET	50161	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:58.542581081 CET	50160	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:58.542581081 CET	50160	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:58.548557997 CET	5651	50160	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:58.548633099 CET	5651	50160	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:58.558252096 CET	50161	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:58.558274984 CET	50161	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:58.564125061 CET	80	50161	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:58.564145088 CET	80	50161	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:58.824242115 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:58.829576969 CET	80	50159	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:58.829791069 CET	50159	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:58.829833984 CET	50159	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:58.829833984 CET	50159	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:58.829833984 CET	50159	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:58.829833984 CET	50159	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:58.835740089 CET	80	50159	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:58.835752964 CET	80	50159	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:58.835761070 CET	80	50159	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:58.835769892 CET	80	50159	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:58.836153984 CET	80	50159	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:58.836194038 CET	50159	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:58.843156099 CET	50162	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:58.849010944 CET	80	50162	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:58.849070072 CET	50162	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:58.870672941 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:58.988459110 CET	50162	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:58.988497972 CET	50162	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:58.994601011 CET	80	50162	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:58.994627953 CET	80	50162	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:59.133749008 CET	5651	50160	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:59.136668921 CET	50160	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.146703959 CET	50160	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.152514935 CET	5651	50160	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:59.158997059 CET	80	50161	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:59.159070015 CET	50161	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.159224033 CET	50161	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.165026903 CET	80	50161	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:59.169322014 CET	50163	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.175251961 CET	5651	50163	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:59.175399065 CET	50163	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.244278908 CET	50164	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.250185966 CET	80	50164	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:59.250283003 CET	50164	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.321279049 CET	50163	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.321279049 CET	50163	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.327877045 CET	5651	50163	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:59.328386068 CET	5651	50163	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:59.376003027 CET	50164	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.376614094 CET	50164	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.381925106 CET	80	50164	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:59.382347107 CET	80	50164	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:59.698508978 CET	80	50162	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:59.698731899 CET	50162	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:59.698812008 CET	50162	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:59.698822975 CET	50162	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:59.699018002 CET	50162	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:59.699042082 CET	50162	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:59.704651117 CET	80	50162	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:59.704696894 CET	80	50162	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:59.704705954 CET	80	50162	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:59.704796076 CET	80	50162	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:59.705178976 CET	80	50162	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:59.705216885 CET	50162	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:59.716660023 CET	50165	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:59.722529888 CET	80	50165	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:59.722688913 CET	50165	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:59.840055943 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:59.856113911 CET	50165	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:59.856194973 CET	50165	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:38:59.861943007 CET	80	50165	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:59.861978054 CET	80	50165	65.21.245.7	192.168.2.6
Oct 30, 2024 22:38:59.886291981 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.912194967 CET	5651	50163	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:59.912281990 CET	50163	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.912450075 CET	50163	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.918181896 CET	5651	50163	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:59.935339928 CET	50166	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.941160917 CET	5651	50166	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:59.941217899 CET	50166	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.982785940 CET	80	50164	111.90.140.76	192.168.2.6
Oct 30, 2024 22:38:59.982844114 CET	50164	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.982887030 CET	50164	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:38:59.988756895 CET	80	50164	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:00.043795109 CET	50167	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.049622059 CET	80	50167	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:00.049679041 CET	50167	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.074064970 CET	50166	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.074064970 CET	50166	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.079987049 CET	5651	50166	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:00.079998016 CET	5651	50166	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:00.183336973 CET	50167	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.183336973 CET	50167	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.189135075 CET	80	50167	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:00.189296961 CET	80	50167	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:00.588133097 CET	80	50165	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:00.590127945 CET	50165	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:00.590178967 CET	50165	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:00.590178967 CET	50165	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:00.590178967 CET	50165	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:00.590178967 CET	50165	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:00.596256018 CET	80	50165	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:00.596266985 CET	80	50165	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:00.596276045 CET	80	50165	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:00.596286058 CET	80	50165	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:00.597043991 CET	80	50165	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:00.597312927 CET	50165	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:00.655733109 CET	5651	50166	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:00.655839920 CET	50166	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.655885935 CET	50166	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.661798000 CET	5651	50166	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:00.705463886 CET	50168	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.711540937 CET	5651	50168	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:00.715013027 CET	50168	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.715833902 CET	50169	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:00.721823931 CET	80	50169	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:00.722661972 CET	50169	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:00.750605106 CET	80	50167	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:00.750672102 CET	50167	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.750736952 CET	50167	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.756589890 CET	80	50167	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:00.810473919 CET	50170	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.816709995 CET	80	50170	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:00.816971064 CET	50170	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.839591980 CET	50168	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.839612961 CET	50168	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.845669031 CET	5651	50168	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:00.845690966 CET	5651	50168	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:00.855200052 CET	50169	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:00.855221033 CET	50169	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:00.855715990 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:00.861169100 CET	80	50169	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:00.861179113 CET	80	50169	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:00.901922941 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.949350119 CET	50170	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.949377060 CET	50170	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:00.955280066 CET	80	50170	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:00.955495119 CET	80	50170	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:01.459750891 CET	5651	50168	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:01.459813118 CET	50168	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:01.459892035 CET	50168	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:01.465675116 CET	5651	50168	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:01.466917038 CET	50171	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:01.472719908 CET	5651	50171	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:01.472796917 CET	50171	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:01.526050091 CET	80	50170	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:01.526330948 CET	50170	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:01.526571035 CET	50170	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:01.532421112 CET	80	50170	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:01.582290888 CET	50172	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:01.588285923 CET	80	50172	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:01.588368893 CET	50172	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:01.605308056 CET	50171	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:01.605309010 CET	50171	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:01.611320972 CET	5651	50171	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:01.611334085 CET	5651	50171	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:01.617650986 CET	80	50169	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:01.617765903 CET	50169	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:01.617765903 CET	50169	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:01.617821932 CET	50169	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:01.617856026 CET	50169	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:01.617872953 CET	50169	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:01.623714924 CET	80	50169	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:01.623724937 CET	80	50169	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:01.623734951 CET	80	50169	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:01.623771906 CET	80	50169	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:01.624430895 CET	80	50169	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:01.624516010 CET	50169	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:01.684462070 CET	50173	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:01.690470934 CET	80	50173	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:01.692692041 CET	50173	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:01.714648962 CET	50172	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:01.714648962 CET	50172	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:01.720815897 CET	80	50172	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:01.720829964 CET	80	50172	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:01.824827909 CET	50173	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:01.824827909 CET	50173	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:01.830786943 CET	80	50173	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:01.830801964 CET	80	50173	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:01.871211052 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:01.917553902 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:02.197390079 CET	5651	50171	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:02.200695992 CET	50171	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:02.200783014 CET	50171	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:02.206608057 CET	5651	50171	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:02.232429981 CET	50174	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:02.238351107 CET	5651	50174	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:02.240677118 CET	50174	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:02.312809944 CET	80	50172	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:02.316673994 CET	50172	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:02.317039967 CET	50172	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:02.322856903 CET	80	50172	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:02.340590954 CET	50175	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:02.346693993 CET	80	50175	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:02.350706100 CET	50175	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:02.370965004 CET	50174	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:02.370965004 CET	50174	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:02.376955032 CET	5651	50174	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:02.376970053 CET	5651	50174	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:02.480178118 CET	50175	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:02.480206966 CET	50175	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:02.486258030 CET	80	50175	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:02.486285925 CET	80	50175	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:02.548341990 CET	80	50173	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:02.549171925 CET	50173	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:02.549171925 CET	50173	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:02.549171925 CET	50173	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:02.549199104 CET	50173	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:02.549230099 CET	50173	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:02.555187941 CET	80	50173	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:02.555202961 CET	80	50173	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:02.555212021 CET	80	50173	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:02.555216074 CET	80	50173	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:02.555780888 CET	80	50173	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:02.555953979 CET	50173	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:02.572719097 CET	50176	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:02.578670979 CET	80	50176	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:02.578749895 CET	50176	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:02.698945045 CET	50176	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:02.702637911 CET	50176	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:02.704804897 CET	80	50176	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:02.708462000 CET	80	50176	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:02.871052980 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:02.917547941 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:02.975189924 CET	5651	50174	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:02.975241899 CET	50174	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:02.975334883 CET	50174	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:02.981091976 CET	5651	50174	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:02.997273922 CET	50177	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.003206015 CET	5651	50177	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:03.003304005 CET	50177	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.056740999 CET	80	50175	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:03.056803942 CET	50175	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.056866884 CET	50175	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.062720060 CET	80	50175	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:03.107091904 CET	50178	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.125603914 CET	80	50178	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:03.125678062 CET	50178	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.136493921 CET	50177	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.136570930 CET	50177	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.142401934 CET	5651	50177	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:03.142415047 CET	5651	50177	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:03.247092009 CET	50178	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.248620033 CET	50178	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.253009081 CET	80	50178	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:03.254554987 CET	80	50178	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:03.430547953 CET	80	50176	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:03.432723999 CET	50176	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:03.432768106 CET	50176	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:03.432768106 CET	50176	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:03.432769060 CET	50176	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:03.432769060 CET	50176	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:03.434710979 CET	50179	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:03.438709021 CET	80	50176	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:03.438720942 CET	80	50176	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:03.438729048 CET	80	50176	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:03.438738108 CET	80	50176	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:03.439026117 CET	80	50176	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:03.440499067 CET	80	50179	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:03.440565109 CET	50176	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:03.440599918 CET	50179	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:03.584186077 CET	50179	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:03.584186077 CET	50179	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:03.590153933 CET	80	50179	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:03.590167999 CET	80	50179	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:03.737601042 CET	5651	50177	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:03.737725973 CET	50177	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.737934113 CET	50177	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.743660927 CET	5651	50177	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:03.763891935 CET	50180	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.770167112 CET	5651	50180	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:03.770251036 CET	50180	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.849181890 CET	80	50178	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:03.852660894 CET	50178	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.852699995 CET	50178	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.858757973 CET	80	50178	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:03.871897936 CET	50181	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.877748966 CET	80	50181	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:03.880672932 CET	50181	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.887012005 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:03.902070999 CET	50180	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.904618025 CET	50180	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:03.907923937 CET	5651	50180	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:03.910463095 CET	5651	50180	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:03.933161020 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.014812946 CET	50181	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.014961958 CET	50181	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.020653009 CET	80	50181	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.020674944 CET	80	50181	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.289593935 CET	80	50179	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:04.289911985 CET	50179	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:04.289946079 CET	50179	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:04.289946079 CET	50179	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:04.289958000 CET	50179	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:04.289988995 CET	50179	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:04.295845985 CET	80	50179	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:04.295860052 CET	80	50179	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:04.295869112 CET	80	50179	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:04.295881033 CET	80	50179	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:04.296334028 CET	80	50179	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:04.296639919 CET	50179	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:04.310224056 CET	50182	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:04.316119909 CET	80	50182	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:04.316179991 CET	50182	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:04.448898077 CET	50182	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:04.448899031 CET	50182	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:04.454777002 CET	80	50182	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:04.454848051 CET	80	50182	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:04.489571095 CET	5651	50180	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.491657019 CET	50180	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.491703033 CET	50180	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.497549057 CET	5651	50180	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.528208017 CET	50183	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.534193039 CET	5651	50183	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.536667109 CET	50183	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.613778114 CET	80	50181	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.613827944 CET	50181	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.615171909 CET	50181	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.615655899 CET	465	50151	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.615751028 CET	50151	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.616566896 CET	50151	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.621401072 CET	80	50181	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.622486115 CET	465	50151	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.639153957 CET	50184	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.645143986 CET	80	50184	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.645246029 CET	50184	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.653320074 CET	50185	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.659221888 CET	465	50185	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.659332991 CET	50185	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.667871952 CET	50183	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.667884111 CET	50183	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.670888901 CET	5555	50153	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:04.670963049 CET	50153	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:04.671006918 CET	50153	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:04.673868895 CET	5651	50183	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.673878908 CET	5651	50183	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.676821947 CET	5555	50153	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:04.746707916 CET	50186	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:04.752573967 CET	5555	50186	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:04.752669096 CET	50186	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:04.777367115 CET	50184	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.777388096 CET	50184	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.783287048 CET	80	50184	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.783339977 CET	80	50184	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.792623043 CET	50185	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.792649984 CET	50185	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:04.798666954 CET	465	50185	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.798676968 CET	465	50185	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.886662960 CET	50186	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:04.886663914 CET	50186	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:04.892613888 CET	5555	50186	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:04.892692089 CET	5555	50186	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:04.902307987 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:04.949096918 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:05.165671110 CET	80	50182	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:05.167779922 CET	50182	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:05.167815924 CET	50182	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:05.167815924 CET	50182	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:05.167824984 CET	50182	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:05.167979002 CET	50182	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:05.173758984 CET	80	50182	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:05.173783064 CET	80	50182	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:05.173791885 CET	80	50182	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:05.173872948 CET	80	50182	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:05.174407005 CET	80	50182	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:05.174453974 CET	50182	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:05.186091900 CET	50187	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:05.191989899 CET	80	50187	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:05.192091942 CET	50187	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:05.247037888 CET	5651	50183	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:05.251343012 CET	50183	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:05.251343966 CET	50183	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:05.257227898 CET	5651	50183	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:05.321021080 CET	50188	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:05.324428082 CET	50187	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:05.324459076 CET	50187	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:05.327033043 CET	5651	50188	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:05.327145100 CET	50188	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:05.330730915 CET	80	50187	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:05.330748081 CET	80	50187	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:05.358393908 CET	80	50184	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:05.358875990 CET	50184	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:05.358875990 CET	50184	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:05.364800930 CET	80	50184	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:05.404426098 CET	50189	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:05.410337925 CET	80	50189	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:05.410413027 CET	50189	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:05.448940039 CET	50188	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:05.448940039 CET	50188	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:05.454875946 CET	5651	50188	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:05.454900980 CET	5651	50188	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:05.542633057 CET	50189	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:05.542633057 CET	50189	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:05.548685074 CET	80	50189	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:05.548710108 CET	80	50189	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:05.902847052 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:05.948848009 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:06.045960903 CET	5651	50188	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:06.048687935 CET	50188	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:06.048810005 CET	50188	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:06.054580927 CET	5651	50188	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:06.061755896 CET	50190	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:06.064588070 CET	80	50187	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:06.064857006 CET	50187	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:06.064883947 CET	50187	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:06.064883947 CET	50187	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:06.064893007 CET	50187	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:06.064920902 CET	50187	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:06.067631960 CET	5651	50190	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:06.067817926 CET	50190	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:06.070729017 CET	80	50187	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:06.070741892 CET	80	50187	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:06.070753098 CET	80	50187	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:06.070760965 CET	80	50187	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:06.071115017 CET	80	50187	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:06.071161032 CET	50187	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:06.128603935 CET	80	50189	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:06.128691912 CET	50189	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:06.128732920 CET	50189	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:06.134619951 CET	80	50189	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:06.199338913 CET	50190	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:06.200648069 CET	50190	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:06.205311060 CET	5651	50190	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:06.206618071 CET	5651	50190	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:06.797116995 CET	5651	50190	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:06.797476053 CET	50190	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:06.797610998 CET	50190	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:06.803401947 CET	5651	50190	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:06.918560982 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:06.964448929 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:07.936625957 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:07.980056047 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:08.107091904 CET	50191	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:08.113070965 CET	5651	50191	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:08.116673946 CET	50191	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:08.121774912 CET	50192	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:08.127739906 CET	80	50192	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:08.128667116 CET	50192	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:08.138245106 CET	50193	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:08.144097090 CET	80	50193	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:08.144676924 CET	50193	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:08.246377945 CET	50191	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:08.246378899 CET	50191	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:08.252294064 CET	5651	50191	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:08.252309084 CET	5651	50191	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:08.261533976 CET	50192	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:08.261604071 CET	50192	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:08.267561913 CET	80	50192	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:08.267582893 CET	80	50192	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:08.277565002 CET	50193	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:08.277832031 CET	50193	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:08.283901930 CET	80	50193	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:08.283962011 CET	80	50193	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:08.842071056 CET	5651	50191	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:08.844724894 CET	50191	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:08.844782114 CET	50191	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:08.850713968 CET	5651	50191	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:08.856004953 CET	80	50192	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:08.856683969 CET	50192	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:08.856766939 CET	50192	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:08.862762928 CET	80	50192	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:08.904205084 CET	50194	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:08.910279989 CET	5651	50194	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:08.910355091 CET	50194	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:08.919504881 CET	50195	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:08.925405025 CET	80	50195	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:08.925474882 CET	50195	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:08.933944941 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:08.980061054 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.032418013 CET	80	50193	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:09.032572985 CET	50193	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:09.032573938 CET	50193	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:09.032573938 CET	50193	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:09.032697916 CET	50193	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:09.032697916 CET	50193	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:09.038681984 CET	80	50193	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:09.038696051 CET	80	50193	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:09.038705111 CET	80	50193	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:09.038713932 CET	80	50193	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:09.039114952 CET	80	50193	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:09.039166927 CET	50193	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:09.044658899 CET	50194	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.044743061 CET	50194	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.050679922 CET	5651	50194	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:09.050707102 CET	5651	50194	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:09.058352947 CET	50195	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.058439970 CET	50195	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.066180944 CET	80	50195	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:09.066195011 CET	80	50195	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:09.123481035 CET	50196	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:09.129497051 CET	80	50196	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:09.129591942 CET	50196	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:09.261615038 CET	50196	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:09.261656046 CET	50196	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:09.267664909 CET	80	50196	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:09.267690897 CET	80	50196	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:09.627419949 CET	5651	50194	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:09.627837896 CET	50194	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.627943993 CET	50194	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.633845091 CET	5651	50194	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:09.665870905 CET	80	50195	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:09.666081905 CET	50195	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.666187048 CET	50195	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.671147108 CET	50197	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.672095060 CET	80	50195	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:09.677309036 CET	5651	50197	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:09.677427053 CET	50197	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.684670925 CET	50198	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.690836906 CET	80	50198	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:09.690929890 CET	50198	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.809104919 CET	50197	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.809235096 CET	50197	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.815176964 CET	5651	50197	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:09.815202951 CET	5651	50197	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:09.829631090 CET	50198	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.830235004 CET	50198	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.835805893 CET	80	50198	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:09.836205959 CET	80	50198	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:09.949826956 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:09.989753962 CET	80	50196	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:09.992357016 CET	50196	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:09.992357016 CET	50196	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:09.992851019 CET	50196	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:09.992907047 CET	50196	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:09.992961884 CET	50196	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:09.995695114 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:09.998229980 CET	80	50196	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:09.998373985 CET	80	50196	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:09.998770952 CET	80	50196	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:09.998816967 CET	80	50196	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:10.000137091 CET	80	50196	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:10.000298023 CET	50196	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:10.332552910 CET	50199	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:10.338532925 CET	80	50199	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:10.338603973 CET	50199	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:10.373281002 CET	5651	50197	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:10.373613119 CET	50197	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:10.373613119 CET	50197	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:10.379931927 CET	5651	50197	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:10.431170940 CET	80	50198	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:10.431680918 CET	50198	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:10.431720972 CET	50198	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:10.437623024 CET	80	50198	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:10.465773106 CET	50199	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:10.465801001 CET	50199	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:10.471740961 CET	80	50199	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:10.472063065 CET	80	50199	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:10.965322971 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:11.105083942 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:11.186810970 CET	80	50199	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:11.186932087 CET	50199	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:11.186966896 CET	50199	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:11.186966896 CET	50199	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:11.186986923 CET	50199	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:11.186986923 CET	50199	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:11.192926884 CET	80	50199	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:11.192936897 CET	80	50199	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:11.192945004 CET	80	50199	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:11.192955971 CET	80	50199	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:11.193644047 CET	80	50199	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:11.193697929 CET	50199	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:11.231332064 CET	50200	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:11.238260031 CET	5651	50200	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:11.239063025 CET	50200	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:11.246566057 CET	50201	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:11.252582073 CET	80	50201	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:11.255456924 CET	50201	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:11.262665987 CET	50202	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:11.268980026 CET	80	50202	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:11.269046068 CET	50202	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:11.370750904 CET	50200	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:11.370855093 CET	50200	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:11.376646996 CET	5651	50200	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:11.376660109 CET	5651	50200	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:11.386702061 CET	50201	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:11.386703014 CET	50201	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:11.392679930 CET	80	50201	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:11.392703056 CET	80	50201	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:11.402867079 CET	50202	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:11.402894020 CET	50202	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:11.408823967 CET	80	50202	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:11.408849001 CET	80	50202	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:11.955600977 CET	5651	50200	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:11.955924988 CET	50200	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:11.956054926 CET	50200	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:11.961911917 CET	5651	50200	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:11.965549946 CET	50203	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:11.971467972 CET	5651	50203	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:11.971543074 CET	50203	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:11.981370926 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:11.989418983 CET	80	50201	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:11.992651939 CET	50201	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:11.992683887 CET	50201	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:11.998437881 CET	80	50201	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:12.080399036 CET	50204	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:12.086357117 CET	80	50204	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:12.086422920 CET	50204	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:12.105047941 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:12.105535030 CET	50203	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:12.105804920 CET	50203	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:12.111579895 CET	5651	50203	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:12.111944914 CET	5651	50203	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:12.123459101 CET	80	50202	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:12.123558998 CET	50202	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:12.123574972 CET	50202	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:12.123574972 CET	50202	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:12.123600960 CET	50202	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:12.123600960 CET	50202	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:12.129410028 CET	80	50202	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:12.129420996 CET	80	50202	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:12.129429102 CET	80	50202	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:12.129437923 CET	80	50202	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:12.130006075 CET	80	50202	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:12.130055904 CET	50202	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:12.184781075 CET	50205	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:12.190778017 CET	80	50205	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:12.192698956 CET	50205	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:12.214548111 CET	50204	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:12.216638088 CET	50204	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:12.220465899 CET	80	50204	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:12.222637892 CET	80	50204	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:12.324100971 CET	50205	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:12.324100971 CET	50205	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:12.330008984 CET	80	50205	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:12.330029964 CET	80	50205	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:12.697513103 CET	5651	50203	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:12.697866917 CET	50203	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:12.749135971 CET	50203	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:12.755003929 CET	5651	50203	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:12.808303118 CET	80	50204	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:12.811114073 CET	50204	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:12.914136887 CET	50204	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:12.920591116 CET	80	50204	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:12.996912003 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.002490044 CET	50206	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.003153086 CET	50207	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.008586884 CET	5651	50206	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.008655071 CET	50206	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.009135962 CET	80	50207	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.009217978 CET	50207	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.039354086 CET	80	50205	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.039474964 CET	50205	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.039474964 CET	50205	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.039474964 CET	50205	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.039474964 CET	50205	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.039544106 CET	50205	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.046155930 CET	80	50205	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.046195030 CET	80	50205	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.046236038 CET	80	50205	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.046246052 CET	80	50205	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.046551943 CET	80	50205	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.046606064 CET	50205	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.059462070 CET	50208	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.065601110 CET	80	50208	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.065689087 CET	50208	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.136512041 CET	50206	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.136512041 CET	50206	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.136626959 CET	50207	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.136626959 CET	50207	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.142656088 CET	5651	50206	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.142671108 CET	5651	50206	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.142683983 CET	80	50207	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.142693043 CET	80	50207	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.162516117 CET	465	50185	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.162576914 CET	50185	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.162616014 CET	50185	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.167766094 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.168445110 CET	465	50185	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.169230938 CET	50209	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.175189018 CET	465	50209	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.175282955 CET	50209	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.198899031 CET	50208	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.198991060 CET	50208	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.205014944 CET	80	50208	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.205037117 CET	80	50208	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.235498905 CET	5555	50186	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.238368988 CET	50186	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.238539934 CET	50186	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.244467020 CET	5555	50186	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.278439999 CET	50210	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.284461021 CET	5555	50210	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.284554005 CET	50210	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.308501005 CET	50209	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.308501005 CET	50209	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.314445019 CET	465	50209	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.315272093 CET	465	50209	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.417947054 CET	50210	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.417982101 CET	50210	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.424210072 CET	5555	50210	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.424231052 CET	5555	50210	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.743592024 CET	80	50207	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.743669987 CET	50207	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.743683100 CET	5651	50206	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.743762016 CET	50207	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.743789911 CET	50206	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.744003057 CET	50206	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.749728918 CET	80	50207	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.749795914 CET	5651	50206	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.825086117 CET	50211	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.830938101 CET	5651	50211	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.830992937 CET	50211	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.840467930 CET	50212	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.846307993 CET	80	50212	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.846368074 CET	50212	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.947248936 CET	80	50208	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.947349072 CET	50208	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.947349072 CET	50208	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.947386026 CET	50208	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.947452068 CET	50208	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.947474957 CET	50208	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.953327894 CET	80	50208	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.953350067 CET	80	50208	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.953358889 CET	80	50208	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.953367949 CET	80	50208	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.954240084 CET	80	50208	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:13.954464912 CET	50208	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:13.964524031 CET	50211	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.964535952 CET	50211	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.970511913 CET	5651	50211	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.970531940 CET	5651	50211	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.980313063 CET	50212	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.980411053 CET	50212	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:13.986107111 CET	80	50212	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:13.986160040 CET	80	50212	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:14.012660980 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:14.043956041 CET	50213	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:14.049882889 CET	80	50213	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:14.050695896 CET	50213	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:14.183496952 CET	50213	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:14.183532953 CET	50213	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:14.189477921 CET	80	50213	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:14.189491987 CET	80	50213	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:14.198844910 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:14.552041054 CET	5651	50211	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:14.552159071 CET	50211	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:14.552325010 CET	50211	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:14.558103085 CET	5651	50211	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:14.570538044 CET	80	50212	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:14.570754051 CET	50212	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:14.570801020 CET	50212	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:14.576585054 CET	80	50212	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:14.590574026 CET	50214	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:14.596596956 CET	5651	50214	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:14.600672007 CET	50214	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:14.606529951 CET	50215	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:14.612349987 CET	80	50215	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:14.616693974 CET	50215	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:14.730218887 CET	50214	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:14.730678082 CET	50214	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:14.736254930 CET	5651	50214	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:14.736610889 CET	5651	50214	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:14.745897055 CET	50215	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:14.746781111 CET	50215	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:14.751755953 CET	80	50215	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:14.752644062 CET	80	50215	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:14.964818001 CET	80	50213	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:14.965001106 CET	50213	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:14.965039968 CET	50213	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:14.965039968 CET	50213	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:14.965039968 CET	50213	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:14.965039968 CET	50213	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:14.970897913 CET	80	50213	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:14.970907927 CET	80	50213	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:14.970916033 CET	80	50213	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:14.970925093 CET	80	50213	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:14.971402884 CET	80	50213	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:14.971463919 CET	50213	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:15.027805090 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:15.036813974 CET	50216	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:15.043951035 CET	80	50216	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:15.044030905 CET	50216	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:15.167710066 CET	50216	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:15.171474934 CET	50216	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:15.174058914 CET	80	50216	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:15.177510023 CET	80	50216	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:15.199045897 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:15.329387903 CET	5651	50214	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:15.329653025 CET	50214	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:15.329689980 CET	50214	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:15.335511923 CET	5651	50214	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:15.337492943 CET	80	50215	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:15.337564945 CET	50215	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:15.337786913 CET	50215	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:15.343568087 CET	80	50215	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:15.359630108 CET	50217	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:15.365494967 CET	5651	50217	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:15.368674994 CET	50217	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:15.372951031 CET	50218	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:15.378772020 CET	80	50218	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:15.382680893 CET	50218	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:15.499089003 CET	50217	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:15.503001928 CET	50217	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:15.505059958 CET	5651	50217	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:15.509057045 CET	5651	50217	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:15.511832952 CET	50218	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:15.515466928 CET	50218	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:15.517774105 CET	80	50218	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:15.521538019 CET	80	50218	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:15.899362087 CET	80	50216	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:15.899588108 CET	50216	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:15.899630070 CET	50216	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:15.899630070 CET	50216	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:15.899630070 CET	50216	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:15.899844885 CET	50216	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:15.903536081 CET	50219	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:15.905517101 CET	80	50216	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:15.905528069 CET	80	50216	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:15.905535936 CET	80	50216	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:15.905596972 CET	80	50216	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:15.906157017 CET	80	50216	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:15.906209946 CET	50216	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:15.909559965 CET	80	50219	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:15.909697056 CET	50219	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:16.029273987 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:16.042648077 CET	50219	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:16.042678118 CET	50219	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:16.048634052 CET	80	50219	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:16.048645973 CET	80	50219	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:16.086724997 CET	80	50218	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:16.086806059 CET	50218	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.086850882 CET	50218	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.087173939 CET	5651	50217	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:16.087232113 CET	50217	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.087264061 CET	50217	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.092725039 CET	80	50218	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:16.093082905 CET	5651	50217	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:16.121934891 CET	50221	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.128035069 CET	5651	50221	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:16.128122091 CET	50221	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.137336016 CET	50222	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.143416882 CET	80	50222	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:16.143507957 CET	50222	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.198838949 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.261421919 CET	50221	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.261423111 CET	50221	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.267375946 CET	5651	50221	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:16.267400980 CET	5651	50221	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:16.277693987 CET	50222	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.278718948 CET	50222	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.283622980 CET	80	50222	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:16.284538031 CET	80	50222	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:16.790891886 CET	80	50219	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:16.794720888 CET	50219	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:16.794763088 CET	50219	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:16.794763088 CET	50219	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:16.794763088 CET	50219	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:16.794763088 CET	50219	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:16.800801992 CET	80	50219	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:16.800815105 CET	80	50219	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:16.800823927 CET	80	50219	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:16.800832033 CET	80	50219	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:16.801183939 CET	80	50219	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:16.802725077 CET	50219	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:16.851819992 CET	80	50222	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:16.853663921 CET	5651	50221	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:16.854928017 CET	50222	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.854968071 CET	50221	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.854980946 CET	50222	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.855103016 CET	50221	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.860899925 CET	80	50222	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:16.860979080 CET	5651	50221	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:16.889589071 CET	50223	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.895546913 CET	5651	50223	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:16.895615101 CET	50223	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.904247999 CET	50224	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.910135031 CET	80	50224	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:16.910202980 CET	50224	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:16.920171022 CET	50225	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:16.927685976 CET	80	50225	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:16.927789927 CET	50225	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:17.034841061 CET	50223	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:17.034923077 CET	50223	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:17.040916920 CET	5651	50223	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:17.040932894 CET	5651	50223	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:17.044110060 CET	50224	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:17.044110060 CET	50224	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:17.044918060 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:17.050173998 CET	80	50224	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:17.050187111 CET	80	50224	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:17.060884953 CET	50225	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:17.061305046 CET	50225	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:17.066827059 CET	80	50225	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:17.067121029 CET	80	50225	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:17.092425108 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:17.623055935 CET	5651	50223	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:17.623121023 CET	50223	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:17.623270035 CET	50223	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:17.628993034 CET	5651	50223	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:17.631184101 CET	80	50224	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:17.631248951 CET	50224	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:17.631333113 CET	50224	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:17.637244940 CET	80	50224	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:17.658051014 CET	50226	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:17.664149046 CET	5651	50226	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:17.664225101 CET	50226	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:17.669435978 CET	50227	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:17.675333977 CET	80	50227	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:17.675400972 CET	50227	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:17.776361942 CET	80	50225	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:17.776525974 CET	50225	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:17.776571035 CET	50225	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:17.776571035 CET	50225	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:17.776571989 CET	50225	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:17.776592970 CET	50225	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:17.783132076 CET	80	50225	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:17.783147097 CET	80	50225	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:17.783158064 CET	80	50225	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:17.783215046 CET	80	50225	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:17.783533096 CET	80	50225	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:17.783572912 CET	50225	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:17.793504953 CET	50226	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:17.794070005 CET	50226	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:17.799453974 CET	5651	50226	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:17.800087929 CET	5651	50226	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:17.808394909 CET	50227	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:17.808440924 CET	50227	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:17.814409971 CET	80	50227	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:17.814498901 CET	80	50227	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:17.871865988 CET	50228	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:17.877840996 CET	80	50228	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:17.878808022 CET	50228	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:18.011733055 CET	50228	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:18.011734009 CET	50228	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:18.018088102 CET	80	50228	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:18.018102884 CET	80	50228	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:18.060487986 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:18.198829889 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:18.380440950 CET	5651	50226	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:18.384728909 CET	50226	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:18.384776115 CET	50226	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:18.392398119 CET	5651	50226	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:18.397732973 CET	80	50227	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:18.400676966 CET	50227	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:18.400729895 CET	50227	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:18.407149076 CET	80	50227	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:18.419469118 CET	50229	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:18.425447941 CET	5651	50229	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:18.425676107 CET	50229	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:18.434849024 CET	50230	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:18.441144943 CET	80	50230	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:18.444734097 CET	50230	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:18.558361053 CET	50229	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:18.558643103 CET	50229	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:18.564265966 CET	5651	50229	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:18.564430952 CET	5651	50229	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:18.575011969 CET	50230	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:18.575011969 CET	50230	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:18.580945015 CET	80	50230	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:18.580959082 CET	80	50230	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:18.740174055 CET	80	50228	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:18.740910053 CET	50228	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:18.740910053 CET	50228	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:18.740910053 CET	50228	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:18.740978003 CET	50228	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:18.740978003 CET	50228	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:18.746958017 CET	80	50228	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:18.746973038 CET	80	50228	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:18.746989965 CET	80	50228	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:18.746999025 CET	80	50228	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:18.747610092 CET	80	50228	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:18.748686075 CET	50228	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:18.753057003 CET	50231	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:18.758935928 CET	80	50231	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:18.759031057 CET	50231	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:18.886461020 CET	50231	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:18.887584925 CET	50231	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:18.892399073 CET	80	50231	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:18.893384933 CET	80	50231	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:19.076076984 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:19.156116962 CET	5651	50229	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:19.156692982 CET	50229	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.156747103 CET	50229	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.162579060 CET	5651	50229	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:19.167829037 CET	80	50230	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:19.167876005 CET	50230	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.167932987 CET	50230	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.173742056 CET	80	50230	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:19.184509039 CET	50232	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.190562010 CET	5651	50232	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:19.192676067 CET	50232	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.198817968 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.199712992 CET	50233	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.205763102 CET	80	50233	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:19.207581043 CET	50233	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.323981047 CET	50232	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.324640036 CET	50232	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.330399036 CET	5651	50232	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:19.330507040 CET	5651	50232	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:19.339550018 CET	50233	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.340636969 CET	50233	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.345479012 CET	80	50233	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:19.346822977 CET	80	50233	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:19.632157087 CET	80	50231	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:19.632308006 CET	50231	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:19.632397890 CET	50231	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:19.632397890 CET	50231	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:19.632397890 CET	50231	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:19.632399082 CET	50231	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:19.638631105 CET	80	50231	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:19.638679981 CET	80	50231	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:19.638689041 CET	80	50231	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:19.638710022 CET	80	50231	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:19.640053034 CET	80	50231	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:19.640126944 CET	50231	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:19.754714966 CET	50234	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:19.761864901 CET	80	50234	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:19.761941910 CET	50234	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:19.886423111 CET	50234	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:19.886424065 CET	50234	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:19.892514944 CET	80	50234	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:19.892780066 CET	80	50234	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:19.919064999 CET	5651	50232	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:19.920734882 CET	50232	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.920734882 CET	50232	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.925834894 CET	80	50233	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:19.927932978 CET	5651	50232	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:19.928025961 CET	50233	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.928107977 CET	50233	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.935375929 CET	80	50233	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:19.950700998 CET	50235	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.956607103 CET	5651	50235	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:19.956684113 CET	50235	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.967139959 CET	50236	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:19.973234892 CET	80	50236	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:19.973293066 CET	50236	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.089874983 CET	50235	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.089874983 CET	50235	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.091500044 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:20.096991062 CET	5651	50235	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:20.097002029 CET	5651	50235	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:20.114216089 CET	50236	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.114216089 CET	50236	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.120125055 CET	80	50236	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:20.120137930 CET	80	50236	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:20.198847055 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.651424885 CET	80	50234	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:20.652779102 CET	50234	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:20.652780056 CET	50234	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:20.652780056 CET	50234	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:20.652780056 CET	50234	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:20.652883053 CET	50234	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:20.656490088 CET	5651	50235	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:20.656570911 CET	50235	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.656606913 CET	50235	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.658778906 CET	80	50234	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:20.658788919 CET	80	50234	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:20.658797979 CET	80	50234	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:20.658806086 CET	80	50234	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:20.659646988 CET	80	50234	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:20.660680056 CET	50234	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:20.662401915 CET	5651	50235	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:20.695661068 CET	80	50236	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:20.696711063 CET	50236	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.696785927 CET	50236	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.702662945 CET	80	50236	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:20.715822935 CET	50237	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.721836090 CET	5651	50237	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:20.724689960 CET	50237	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.731148958 CET	50238	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.737158060 CET	80	50238	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:20.740808010 CET	50238	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.748087883 CET	50239	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:20.754345894 CET	80	50239	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:20.756791115 CET	50239	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:20.855442047 CET	50237	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.856637001 CET	50237	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.861588955 CET	5651	50237	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:20.862791061 CET	5651	50237	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:20.871407986 CET	50238	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.871408939 CET	50238	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:20.877460957 CET	80	50238	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:20.877491951 CET	80	50238	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:20.886395931 CET	50239	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:20.888637066 CET	50239	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:20.892328978 CET	80	50239	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:20.894570112 CET	80	50239	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:21.107455969 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:21.198843956 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.463047981 CET	80	50238	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:21.463140965 CET	50238	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.463226080 CET	50238	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.470721006 CET	80	50238	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:21.470956087 CET	5651	50237	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:21.471016884 CET	50237	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.471071005 CET	50237	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.476846933 CET	5651	50237	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:21.506441116 CET	50240	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.506613016 CET	50241	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.514504910 CET	5651	50240	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:21.514556885 CET	80	50241	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:21.514622927 CET	50240	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.514693975 CET	50241	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.613769054 CET	80	50239	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:21.613917112 CET	50239	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:21.613917112 CET	50239	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:21.613954067 CET	50239	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:21.613979101 CET	50239	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:21.614077091 CET	50239	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:21.622996092 CET	80	50239	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:21.623030901 CET	80	50239	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:21.623040915 CET	80	50239	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:21.623049021 CET	80	50239	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:21.623466015 CET	80	50239	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:21.623549938 CET	50239	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:21.636637926 CET	50241	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.636637926 CET	50241	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.636683941 CET	50240	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.636683941 CET	50240	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.645817041 CET	80	50241	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:21.645828009 CET	80	50241	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:21.645837069 CET	5651	50240	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:21.645914078 CET	5651	50240	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:21.661912918 CET	465	50209	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:21.662875891 CET	50209	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.662956953 CET	50209	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.669827938 CET	465	50209	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:21.700192928 CET	50242	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.706335068 CET	465	50242	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:21.707176924 CET	50242	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.715456963 CET	50243	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:21.722981930 CET	80	50243	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:21.726906061 CET	50243	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:21.771768093 CET	5555	50210	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:21.771820068 CET	50210	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:21.771898031 CET	50210	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:21.777719021 CET	5555	50210	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:21.813349962 CET	50244	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:21.819221020 CET	5555	50244	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:21.819294930 CET	50244	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:21.839579105 CET	50242	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.839623928 CET	50242	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:21.845632076 CET	465	50242	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:21.845643044 CET	465	50242	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:21.856471062 CET	50243	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:21.856549978 CET	50243	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:21.862323046 CET	80	50243	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:21.862334013 CET	80	50243	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:21.948945045 CET	50244	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:21.948976994 CET	50244	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:21.955125093 CET	5555	50244	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:21.955142975 CET	5555	50244	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:22.122648001 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:22.198862076 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:22.233522892 CET	80	50241	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:22.234800100 CET	50241	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:22.238843918 CET	5651	50240	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:22.238892078 CET	50241	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:22.238939047 CET	50240	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:22.238997936 CET	50240	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:22.244793892 CET	80	50241	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:22.244815111 CET	5651	50240	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:22.246936083 CET	50245	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:22.252877951 CET	5651	50245	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:22.255140066 CET	50245	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:22.262509108 CET	50246	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:22.268441916 CET	80	50246	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:22.268521070 CET	50246	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:22.386441946 CET	50245	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:22.386512041 CET	50245	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:22.392987967 CET	5651	50245	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:22.393007040 CET	5651	50245	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:22.402113914 CET	50246	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:22.402113914 CET	50246	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:22.408134937 CET	80	50246	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:22.408145905 CET	80	50246	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:22.603615999 CET	80	50243	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:22.603842020 CET	50243	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:22.603842020 CET	50243	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:22.603879929 CET	50243	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:22.603879929 CET	50243	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:22.603899002 CET	50243	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:22.610208988 CET	80	50243	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:22.610219002 CET	80	50243	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:22.610228062 CET	80	50243	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:22.610235929 CET	80	50243	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:22.610851049 CET	80	50243	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:22.610938072 CET	50243	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:22.686764002 CET	50247	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:22.692724943 CET	80	50247	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:22.693123102 CET	50247	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:22.824379921 CET	50247	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:22.824381113 CET	50247	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:22.830332041 CET	80	50247	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:22.830343962 CET	80	50247	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:22.985430002 CET	80	50246	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:22.985565901 CET	50246	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:22.985652924 CET	50246	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:22.991547108 CET	80	50246	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:23.012583017 CET	50248	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:23.019047976 CET	80	50248	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:23.019169092 CET	50248	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:23.138272047 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:23.152467966 CET	50248	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:23.152749062 CET	50248	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:23.158417940 CET	80	50248	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:23.158529997 CET	80	50248	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:23.198841095 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:23.555001020 CET	80	50247	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:23.555258989 CET	50247	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:23.555258989 CET	50247	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:23.555299044 CET	50247	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:23.555299044 CET	50247	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:23.555619955 CET	50247	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:23.561142921 CET	80	50247	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:23.561165094 CET	80	50247	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:23.561176062 CET	80	50247	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:23.561183929 CET	80	50247	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:23.562149048 CET	80	50247	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:23.562191963 CET	50247	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:23.563568115 CET	50249	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:23.569741011 CET	80	50249	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:23.569814920 CET	50249	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:23.698996067 CET	50249	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:23.698996067 CET	50249	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:23.705141068 CET	80	50249	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:23.705156088 CET	80	50249	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:23.748258114 CET	80	50248	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:23.748356104 CET	50248	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:23.748395920 CET	50248	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:23.754745007 CET	80	50248	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:23.780011892 CET	50250	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:23.786256075 CET	80	50250	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:23.786331892 CET	50250	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:23.917805910 CET	50250	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:23.920638084 CET	50250	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:23.923741102 CET	80	50250	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:23.926522970 CET	80	50250	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:24.292264938 CET	5651	50245	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:24.292351007 CET	50245	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:24.292455912 CET	50245	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:24.292583942 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:24.292911053 CET	5651	50245	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:24.292960882 CET	50245	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:24.298564911 CET	5651	50245	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:24.325278997 CET	50251	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:24.331356049 CET	5651	50251	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:24.332689047 CET	50251	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:24.339446068 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:24.429249048 CET	80	50249	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:24.429528952 CET	50249	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:24.429552078 CET	50249	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:24.429558992 CET	50249	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:24.429569960 CET	50249	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:24.429661989 CET	50249	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:24.435507059 CET	80	50249	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:24.435517073 CET	80	50249	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:24.435524940 CET	80	50249	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:24.435534000 CET	80	50249	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:24.436170101 CET	80	50249	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:24.436412096 CET	50249	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:24.437958956 CET	50252	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:24.443821907 CET	80	50252	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:24.443873882 CET	50252	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:24.464772940 CET	50251	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:24.464772940 CET	50251	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:24.470743895 CET	5651	50251	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:24.470765114 CET	5651	50251	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:24.518244982 CET	80	50250	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:24.518831015 CET	50250	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:24.518933058 CET	50250	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:24.524801970 CET	80	50250	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:24.544302940 CET	50253	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:24.550160885 CET	80	50253	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:24.550265074 CET	50253	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:24.575259924 CET	50252	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:24.576630116 CET	50252	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:24.581190109 CET	80	50252	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:24.582504988 CET	80	50252	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:24.683284998 CET	50253	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:24.683398962 CET	50253	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:24.689398050 CET	80	50253	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:24.689412117 CET	80	50253	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:25.050867081 CET	5651	50251	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:25.052706957 CET	50251	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.052798033 CET	50251	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.058689117 CET	5651	50251	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:25.090517998 CET	50254	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.096560001 CET	5651	50254	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:25.099049091 CET	50254	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.154567003 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:25.198822021 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.230164051 CET	50254	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.230190039 CET	50254	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.236557007 CET	5651	50254	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:25.236591101 CET	5651	50254	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:25.258816004 CET	80	50253	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:25.259190083 CET	50253	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.259294033 CET	50253	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.265125036 CET	80	50253	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:25.299940109 CET	80	50252	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:25.300755024 CET	50252	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:25.300755024 CET	50252	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:25.300755024 CET	50252	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:25.300755978 CET	50252	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:25.300822020 CET	50252	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:25.306768894 CET	80	50252	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:25.306802034 CET	80	50252	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:25.306829929 CET	80	50252	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:25.306869030 CET	80	50252	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:25.307080030 CET	80	50252	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:25.307137012 CET	50252	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:25.309468985 CET	50255	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.315330029 CET	80	50255	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:25.316695929 CET	50255	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.324680090 CET	50256	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:25.330796957 CET	80	50256	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:25.332690954 CET	50256	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:25.449668884 CET	50255	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.449670076 CET	50255	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.455749035 CET	80	50255	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:25.455780983 CET	80	50255	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:25.464632034 CET	50256	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:25.464632034 CET	50256	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:25.471179962 CET	80	50256	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:25.471307993 CET	80	50256	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:25.827040911 CET	5651	50254	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:25.827130079 CET	50254	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.827163935 CET	50254	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.833060980 CET	5651	50254	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:25.856439114 CET	50257	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.862531900 CET	5651	50257	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:25.862637997 CET	50257	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.995897055 CET	50257	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:25.996646881 CET	50257	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.001760960 CET	5651	50257	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:26.002454042 CET	5651	50257	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:26.051739931 CET	80	50255	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:26.052726030 CET	50255	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.052838087 CET	50255	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.058808088 CET	80	50255	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:26.075922966 CET	50258	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.081955910 CET	80	50258	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:26.082039118 CET	50258	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.169997931 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:26.214469910 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.214541912 CET	80	50256	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:26.214554071 CET	50258	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.214624882 CET	50256	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:26.214629889 CET	50258	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.214658022 CET	50256	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:26.214658022 CET	50256	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:26.214658022 CET	50256	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:26.214685917 CET	50256	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:26.220535994 CET	80	50258	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:26.220546961 CET	80	50258	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:26.220566988 CET	80	50256	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:26.220581055 CET	80	50256	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:26.220587015 CET	80	50256	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:26.220592022 CET	80	50256	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:26.220863104 CET	80	50256	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:26.224674940 CET	50256	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:26.296036959 CET	50259	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:26.302148104 CET	80	50259	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:26.302258968 CET	50259	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:26.433455944 CET	50259	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:26.436651945 CET	50259	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:26.440800905 CET	80	50259	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:26.443470001 CET	80	50259	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:26.750499964 CET	5651	50257	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:26.752742052 CET	50257	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.752823114 CET	50257	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.758793116 CET	5651	50257	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:26.813524961 CET	80	50258	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:26.813795090 CET	50258	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.813854933 CET	50258	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.819787025 CET	80	50258	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:26.841021061 CET	50260	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.847012043 CET	5651	50260	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:26.847290039 CET	50260	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.856868982 CET	50261	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.862823009 CET	80	50261	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:26.862900019 CET	50261	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.980351925 CET	50260	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.980351925 CET	50260	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.986320019 CET	5651	50260	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:26.986334085 CET	5651	50260	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:26.995925903 CET	50261	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:26.995925903 CET	50261	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:27.001915932 CET	80	50261	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:27.001981974 CET	80	50261	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:27.162036896 CET	80	50259	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:27.162375927 CET	50259	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:27.162377119 CET	50259	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:27.162475109 CET	50259	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:27.162475109 CET	50259	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:27.162475109 CET	50259	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:27.168426991 CET	80	50259	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:27.168437004 CET	80	50259	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:27.168543100 CET	80	50259	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:27.168551922 CET	80	50259	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:27.168957949 CET	80	50259	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:27.169028044 CET	50259	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:27.174823046 CET	50262	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:27.180874109 CET	80	50262	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:27.181001902 CET	50262	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:27.186904907 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:27.230073929 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:27.310061932 CET	50262	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:27.310103893 CET	50262	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:27.316143036 CET	80	50262	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:27.316176891 CET	80	50262	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:27.578063011 CET	5651	50260	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:27.580635071 CET	50260	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:27.588675976 CET	80	50261	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:27.592681885 CET	50261	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:27.642083883 CET	50260	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:27.642543077 CET	50261	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:27.647407055 CET	50263	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:27.647996902 CET	5651	50260	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:27.648447990 CET	80	50261	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:27.653302908 CET	5651	50263	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:27.656685114 CET	50263	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:27.798281908 CET	50263	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:27.798367977 CET	50263	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:27.798958063 CET	50264	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:27.804171085 CET	5651	50263	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:27.804182053 CET	5651	50263	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:27.804740906 CET	80	50264	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:27.804944992 CET	50264	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:27.933732033 CET	50264	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:27.933732033 CET	50264	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:27.939846039 CET	80	50264	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:27.940063000 CET	80	50264	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:28.023994923 CET	80	50262	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:28.024574995 CET	50262	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:28.024605036 CET	50262	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:28.024605036 CET	50262	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:28.024637938 CET	50262	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:28.024637938 CET	50262	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:28.031207085 CET	80	50262	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:28.031219006 CET	80	50262	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:28.031227112 CET	80	50262	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:28.031235933 CET	80	50262	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:28.031933069 CET	80	50262	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:28.032001019 CET	50262	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:28.045057058 CET	50265	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:28.051690102 CET	80	50265	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:28.051826000 CET	50265	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:28.184468985 CET	50265	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:28.184468985 CET	50265	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:28.190562963 CET	80	50265	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:28.190594912 CET	80	50265	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:28.201370955 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:28.339468002 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:28.363526106 CET	5651	50263	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:28.363585949 CET	50263	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:28.363718987 CET	50263	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:28.369596004 CET	5651	50263	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:28.371964931 CET	50266	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:28.377888918 CET	5651	50266	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:28.378050089 CET	50266	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:28.511416912 CET	50266	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:28.511418104 CET	50266	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:28.517484903 CET	5651	50266	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:28.517510891 CET	5651	50266	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:28.518153906 CET	80	50264	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:28.520909071 CET	50264	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:28.520909071 CET	50264	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:28.526907921 CET	80	50264	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:28.590783119 CET	50267	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:28.596729040 CET	80	50267	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:28.600711107 CET	50267	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:28.731024981 CET	50267	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:28.731025934 CET	50267	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:28.737133980 CET	80	50267	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:28.738326073 CET	80	50267	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:28.893948078 CET	80	50265	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:28.894083023 CET	50265	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:28.894114017 CET	50265	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:28.894114017 CET	50265	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:28.894222975 CET	50265	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:28.894222975 CET	50265	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:28.900755882 CET	80	50265	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:28.900768995 CET	80	50265	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:28.900938988 CET	80	50265	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:28.901189089 CET	80	50265	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:28.901638985 CET	80	50265	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:28.901933908 CET	50265	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:28.919756889 CET	50268	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:28.925728083 CET	80	50268	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:28.925796986 CET	50268	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:29.058695078 CET	50268	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:29.058779955 CET	50268	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:29.448901892 CET	50268	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:29.534989119 CET	5651	50266	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:29.535280943 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:29.535774946 CET	80	50268	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:29.535784960 CET	80	50268	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:29.535881996 CET	50266	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:29.536007881 CET	80	50267	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:29.536065102 CET	5651	50266	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:29.536628008 CET	50266	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:29.536684036 CET	50267	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:29.536739111 CET	50267	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:29.536823034 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:29.536976099 CET	50266	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:29.537075996 CET	80	50268	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:29.540683031 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:29.542690039 CET	5651	50266	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:29.542748928 CET	80	50267	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:29.577518940 CET	50269	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:29.583641052 CET	5651	50269	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:29.583692074 CET	50269	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:29.590724945 CET	50270	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:29.596666098 CET	80	50270	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:29.597093105 CET	50270	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:29.714952946 CET	50269	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:29.715454102 CET	50269	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:29.720747948 CET	5651	50269	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:29.721575975 CET	5651	50269	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:29.731087923 CET	50270	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:29.731108904 CET	50270	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:29.736862898 CET	80	50270	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:29.737238884 CET	80	50270	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:29.775715113 CET	80	50268	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:29.775835991 CET	50268	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:29.775856018 CET	50268	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:29.775856018 CET	50268	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:29.775871038 CET	50268	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:29.775895119 CET	50268	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:29.781718016 CET	80	50268	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:29.781727076 CET	80	50268	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:29.781735897 CET	80	50268	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:29.781744957 CET	80	50268	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:29.782248974 CET	80	50268	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:29.782285929 CET	50268	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:29.794306040 CET	50271	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:29.800182104 CET	80	50271	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:29.800395966 CET	50271	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:29.937632084 CET	50271	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:29.937665939 CET	50271	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:29.943624020 CET	80	50271	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:29.943893909 CET	80	50271	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:30.197149992 CET	465	50242	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:30.197211027 CET	50242	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.197273970 CET	50242	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.203741074 CET	465	50242	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:30.219053984 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:30.298341990 CET	5651	50269	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:30.300719023 CET	50269	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.301625013 CET	50269	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.307117939 CET	5555	50244	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:30.307692051 CET	5651	50269	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:30.307794094 CET	50244	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:30.309870958 CET	50244	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:30.315727949 CET	5555	50244	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:30.336468935 CET	80	50270	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:30.336694956 CET	50270	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.337255001 CET	50270	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.339462042 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.343070030 CET	80	50270	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:30.493449926 CET	50272	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.493956089 CET	50273	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.494065046 CET	50274	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.494142056 CET	50275	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:30.499458075 CET	465	50272	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:30.499558926 CET	50272	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.499733925 CET	5651	50273	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:30.499774933 CET	50273	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.499838114 CET	80	50274	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:30.499882936 CET	50274	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.499947071 CET	5555	50275	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:30.499998093 CET	50275	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:30.613178968 CET	50275	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:30.613179922 CET	50275	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:30.613944054 CET	50274	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.613950968 CET	50273	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.613951921 CET	50273	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.613987923 CET	50274	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.613987923 CET	50272	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.614140987 CET	50272	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:30.619352102 CET	5555	50275	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:30.619498968 CET	5555	50275	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:30.619949102 CET	80	50274	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:30.620019913 CET	5651	50273	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:30.620048046 CET	80	50274	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:30.620078087 CET	465	50272	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:30.620105028 CET	5651	50273	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:30.620136976 CET	465	50272	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:30.643224001 CET	80	50271	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:30.644821882 CET	50271	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:30.644821882 CET	50271	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:30.644942045 CET	50271	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:30.644942045 CET	50271	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:30.644942045 CET	50271	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:30.651009083 CET	80	50271	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:30.651036024 CET	80	50271	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:30.651046038 CET	80	50271	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:30.651056051 CET	80	50271	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:30.651551008 CET	80	50271	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:30.652141094 CET	50271	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:31.198554039 CET	5651	50273	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:31.198651075 CET	50273	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:31.198739052 CET	50273	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:31.204900026 CET	5651	50273	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:31.218941927 CET	80	50274	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:31.219007969 CET	50274	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:31.219095945 CET	50274	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:31.225056887 CET	80	50274	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:31.234482050 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:31.433197975 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:31.467681885 CET	50276	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:31.473726034 CET	5651	50276	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:31.473804951 CET	50276	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:31.500113010 CET	50277	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:31.501039028 CET	50278	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:31.506151915 CET	80	50277	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:31.506968021 CET	80	50278	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:31.507052898 CET	50277	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:31.507639885 CET	50278	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:31.605220079 CET	50276	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:31.607676029 CET	50276	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:31.613344908 CET	5651	50276	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:31.613770008 CET	5651	50276	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:31.636842012 CET	50278	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:31.636890888 CET	50278	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:31.637219906 CET	50277	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:31.637229919 CET	50277	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:31.642918110 CET	80	50278	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:31.643032074 CET	80	50278	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:31.643136978 CET	80	50277	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:31.643146038 CET	80	50277	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:32.203269005 CET	5651	50276	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:32.203397989 CET	50276	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:32.203633070 CET	50276	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:32.209490061 CET	5651	50276	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:32.229203939 CET	80	50277	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:32.229336023 CET	50277	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:32.229398012 CET	50277	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:32.235217094 CET	80	50277	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:32.249838114 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:32.311513901 CET	50279	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:32.317698002 CET	5651	50279	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:32.320693016 CET	50279	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:32.325016975 CET	50280	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:32.331043959 CET	80	50280	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:32.336626053 CET	50280	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:32.339462996 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:32.366045952 CET	80	50278	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:32.368771076 CET	50278	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:32.368814945 CET	50278	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:32.368815899 CET	50278	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:32.368815899 CET	50278	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:32.368815899 CET	50278	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:32.374650002 CET	80	50278	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:32.374661922 CET	80	50278	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:32.374670982 CET	80	50278	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:32.374758959 CET	80	50278	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:32.375336885 CET	80	50278	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:32.375392914 CET	50278	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:32.418864965 CET	50281	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:32.424865961 CET	80	50281	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:32.428740025 CET	50281	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:32.449090958 CET	50279	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:32.449090958 CET	50279	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:32.455163002 CET	5651	50279	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:32.455179930 CET	5651	50279	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:32.466418982 CET	50280	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:32.466418982 CET	50280	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:32.472510099 CET	80	50280	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:32.472687006 CET	80	50280	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:32.559323072 CET	50281	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:32.559359074 CET	50281	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:32.566390991 CET	80	50281	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:32.566420078 CET	80	50281	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:33.027812004 CET	5651	50279	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:33.028692007 CET	50279	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.037182093 CET	80	50280	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:33.037770987 CET	50279	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.037828922 CET	50280	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.041510105 CET	50280	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.043677092 CET	5651	50279	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:33.047545910 CET	80	50280	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:33.093374014 CET	50282	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.093674898 CET	50283	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.099639893 CET	5651	50282	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:33.099694014 CET	80	50283	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:33.099735022 CET	50282	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.099739075 CET	50283	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.243230104 CET	50283	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.243263960 CET	50283	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.243305922 CET	50282	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.243305922 CET	50282	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.249386072 CET	80	50283	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:33.249424934 CET	80	50283	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:33.249454021 CET	5651	50282	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:33.249481916 CET	5651	50282	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:33.265862942 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:33.283760071 CET	80	50281	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:33.283904076 CET	50281	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:33.283930063 CET	50281	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:33.283956051 CET	50281	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:33.283956051 CET	50281	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:33.283991098 CET	50281	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:33.289769888 CET	80	50281	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:33.289838076 CET	80	50281	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:33.289868116 CET	80	50281	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:33.289917946 CET	80	50281	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:33.290532112 CET	80	50281	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:33.290594101 CET	50281	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:33.294209957 CET	50284	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:33.300570965 CET	80	50284	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:33.300637007 CET	50284	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:33.339467049 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.433420897 CET	50284	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:33.433422089 CET	50284	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:33.439562082 CET	80	50284	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:33.439614058 CET	80	50284	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:33.815794945 CET	5651	50282	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:33.815948963 CET	50282	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.816011906 CET	50282	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.817359924 CET	80	50283	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:33.817452908 CET	50283	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.817545891 CET	50283	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.821801901 CET	5651	50282	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:33.823327065 CET	80	50283	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:33.915473938 CET	50285	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.915549040 CET	50286	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.921416044 CET	5651	50285	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:33.921439886 CET	80	50286	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:33.921493053 CET	50285	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:33.921516895 CET	50286	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.044528008 CET	50286	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.044569016 CET	50286	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.044579983 CET	50285	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.044605017 CET	50285	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.050745010 CET	80	50286	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:34.050770998 CET	80	50286	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:34.050781012 CET	5651	50285	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:34.050789118 CET	5651	50285	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:34.185904026 CET	80	50284	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:34.187050104 CET	50284	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:34.187088966 CET	50284	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:34.187088966 CET	50284	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:34.187100887 CET	50284	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:34.187366962 CET	50284	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:34.192946911 CET	80	50284	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:34.192955971 CET	80	50284	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:34.192964077 CET	80	50284	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:34.193075895 CET	80	50284	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:34.193530083 CET	80	50284	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:34.193623066 CET	50284	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:34.265950918 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:34.279349089 CET	50287	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:34.285267115 CET	80	50287	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:34.285340071 CET	50287	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:34.324417114 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.418431044 CET	50287	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:34.418670893 CET	50287	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:34.424518108 CET	80	50287	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:34.425098896 CET	80	50287	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:34.643429995 CET	80	50286	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:34.643516064 CET	50286	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.643652916 CET	50286	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.644939899 CET	5651	50285	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:34.645010948 CET	50285	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.645222902 CET	50285	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.649389029 CET	80	50286	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:34.650955915 CET	5651	50285	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:34.716567039 CET	50288	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.722424984 CET	5651	50288	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:34.722807884 CET	50288	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.743938923 CET	50289	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.750303984 CET	80	50289	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:34.750366926 CET	50289	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.857839108 CET	50288	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.857876062 CET	50288	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.863923073 CET	5651	50288	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:34.864077091 CET	5651	50288	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:34.877379894 CET	50289	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.877379894 CET	50289	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:34.883445978 CET	80	50289	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:34.883485079 CET	80	50289	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:35.143415928 CET	80	50287	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:35.143685102 CET	50287	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:35.143732071 CET	50287	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:35.143732071 CET	50287	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:35.143732071 CET	50287	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:35.143759966 CET	50287	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:35.150152922 CET	80	50287	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:35.150188923 CET	80	50287	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:35.150350094 CET	80	50287	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:35.150379896 CET	80	50287	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:35.150495052 CET	80	50287	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:35.150882959 CET	50287	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:35.153263092 CET	50290	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:35.159276009 CET	80	50290	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:35.160001993 CET	50290	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:35.281632900 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:35.292953014 CET	50290	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:35.292953014 CET	50290	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:35.298974991 CET	80	50290	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:35.299057961 CET	80	50290	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:35.339442015 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:35.466751099 CET	5651	50288	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:35.466826916 CET	50288	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:35.466855049 CET	50288	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:35.472841978 CET	5651	50288	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:35.481369019 CET	50291	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:35.487319946 CET	5651	50291	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:35.487436056 CET	50291	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:35.489087105 CET	80	50289	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:35.489223003 CET	50289	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:35.489320993 CET	50289	80	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:35.495232105 CET	80	50289	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:35.620940924 CET	50291	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:35.623760939 CET	50291	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:35.626844883 CET	5651	50291	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:35.629550934 CET	5651	50291	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:36.020236969 CET	80	50290	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:36.145333052 CET	80	50290	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:36.146790981 CET	50290	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:36.215590954 CET	5651	50291	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:36.215781927 CET	50291	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:36.281836987 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:36.339443922 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:37.283890009 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:37.339445114 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:38.130501986 CET	50290	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:38.130501986 CET	50291	5651	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:38.130501986 CET	50290	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:38.130678892 CET	50290	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:38.130726099 CET	50290	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:38.130726099 CET	50290	80	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:38.136910915 CET	80	50290	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:38.136971951 CET	5651	50291	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:38.137006998 CET	80	50290	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:38.137034893 CET	80	50290	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:38.137062073 CET	80	50290	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:38.137089014 CET	80	50290	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:38.298676968 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:38.339441061 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:38.979034901 CET	465	50272	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:38.979197025 CET	50272	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:38.979197025 CET	50272	465	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:38.985285997 CET	465	50272	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:38.986260891 CET	5555	50275	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:38.986377954 CET	50275	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:38.986377954 CET	50275	5555	192.168.2.6	65.21.245.7
Oct 30, 2024 22:39:38.992557049 CET	5555	50275	65.21.245.7	192.168.2.6
Oct 30, 2024 22:39:39.313852072 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:39.356648922 CET	49786	8080	192.168.2.6	111.90.140.76
Oct 30, 2024 22:39:40.329565048 CET	8080	49786	111.90.140.76	192.168.2.6
Oct 30, 2024 22:39:40.386327028 CET	49786	8080	192.168.2.6	111.90.140.76

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 22:37:40.764496088 CET	55096	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 22:37:40.764496088 CET	192.168.2.6	1.1.1.1	0x7b6d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 22:37:40.773577929 CET	1.1.1.1	192.168.2.6	0x7b6d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 22:37:48.632395983 CET	1.1.1.1	192.168.2.6	0x519	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:37:48.632395983 CET	1.1.1.1	192.168.2.6	0x519	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:38:34.052417994 CET	1.1.1.1	192.168.2.6	0x649f	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 22:38:34.052417994 CET	1.1.1.1	192.168.2.6	0x649f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.37	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:38:34.052417994 CET	1.1.1.1	192.168.2.6	0x649f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.22	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:38:34.052417994 CET	1.1.1.1	192.168.2.6	0x649f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.42	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:38:34.052417994 CET	1.1.1.1	192.168.2.6	0x649f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:38:34.052417994 CET	1.1.1.1	192.168.2.6	0x649f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.38	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:38:34.052417994 CET	1.1.1.1	192.168.2.6	0x649f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:38:34.052417994 CET	1.1.1.1	192.168.2.6	0x649f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:38:49.892594099 CET	1.1.1.1	192.168.2.6	0x2202	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 22:38:49.892594099 CET	1.1.1.1	192.168.2.6	0x2202	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:38:49.892594099 CET	1.1.1.1	192.168.2.6	0x2202	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.19	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:38:49.892594099 CET	1.1.1.1	192.168.2.6	0x2202	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:38:49.892594099 CET	1.1.1.1	192.168.2.6	0x2202	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.22	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:38:49.892594099 CET	1.1.1.1	192.168.2.6	0x2202	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.37	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:38:49.892594099 CET	1.1.1.1	192.168.2.6	0x2202	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.35	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:38:49.892594099 CET	1.1.1.1	192.168.2.6	0x2202	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:39:10.339526892 CET	1.1.1.1	192.168.2.6	0x9c24	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:39:10.339526892 CET	1.1.1.1	192.168.2.6	0x9c24	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:39:34.492718935 CET	1.1.1.1	192.168.2.6	0xb54f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:39:34.492718935 CET	1.1.1.1	192.168.2.6	0xb54f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

armmf.adobe.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49787	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:37:49.661247969 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:49.661269903 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49789	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:37:49.768898964 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:49.771640062 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:37:50.395867109 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:37:49 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:37:50.396013975 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:37:50.396044970 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:50.396044970 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:37:50.396059036 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49797	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:37:50.795167923 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:50.795454025 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49798	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:37:50.798233986 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:50.798249960 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:37:51.547911882 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:37:50 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:37:51.548060894 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:37:51.548060894 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:51.548062086 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:37:51.548140049 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49805	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:37:51.839538097 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:51.839561939 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49806	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:37:51.855794907 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:51.855808020 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:37:52.607168913 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:37:51 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:37:52.607296944 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:37:52.607325077 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:52.607331991 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:37:52.607348919 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49816	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:37:52.911115885 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:52.911149025 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49817	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:37:52.922277927 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:52.922297001 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:37:53.671948910 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:37:52 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:37:53.672089100 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:37:53.672112942 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:53.672128916 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:37:53.672142982 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49824	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:37:53.965255976 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:53.965312004 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49825	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:37:53.981199980 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:53.981199980 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:37:54.699486971 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:37:53 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:37:54.699615002 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:37:54.699640989 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:54.700037956 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:37:54.700097084 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49829	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:37:54.782145977 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:54.782231092 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49833	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:37:55.083396912 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:55.083478928 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:37:55.965658903 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:37:54 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:37:55.965800047 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:37:55.965830088 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:55.965862989 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:37:55.965862989 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49841	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:37:56.245887041 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:56.246076107 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49842	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:37:56.261514902 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:56.261600018 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:37:56.978071928 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:37:56 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:37:56.978203058 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:37:56.978231907 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:37:56.978301048 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:37:56.978324890 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49891	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:05.120965958 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:05.121052980 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49894	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:05.152194023 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:05.152211905 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:05.869683981 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:04 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:05.869805098 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:05.869823933 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:05.869831085 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:05.869848967 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49900	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:05.949028015 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:05.949054956 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49902	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:06.042792082 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:06.042813063 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:06.772284985 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:04 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:06.772456884 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:06.772456884 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:06.772510052 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:06.772566080 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49908	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:06.714745045 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:06.714783907 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49910	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:06.917656898 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:06.917777061 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:07.636197090 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:06 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:07.636620998 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:07.636620998 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:07.636703014 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:07.636703014 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49916	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:07.480205059 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:07.480205059 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49918	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:07.792679071 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:07.792679071 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:08.501873016 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:06 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:08.501998901 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:08.501998901 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:08.502074957 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:08.502074957 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49924	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:08.245877981 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:08.245907068 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49926	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:08.667717934 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:08.667717934 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:09.391160011 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:08 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:09.391302109 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:09.391302109 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:09.391303062 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:09.391388893 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49931	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:09.011432886 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:09.011432886 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49934	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:09.542725086 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:09.542781115 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:10.254131079 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:09 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:10.254236937 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:10.254252911 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:10.254261017 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:10.254267931 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49939	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:09.777019978 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:09.777040958 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49942	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:10.417608976 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:10.417676926 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:11.144275904 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:09 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:11.144395113 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:11.144413948 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:11.144413948 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:11.144426107 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49944	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:10.542711020 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:10.542785883 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49949	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:11.308842897 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:11.308842897 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49950	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:11.323893070 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:11.323893070 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:12.064627886 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:10 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:12.064781904 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:12.064781904 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:12.064781904 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:12.064781904 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49956	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:12.073848009 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:12.073892117 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49958	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:12.276971102 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:12.276971102 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:13.025109053 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:11 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:13.025276899 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:13.025307894 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:13.025307894 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:13.025307894 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49964	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:12.839659929 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:12.839706898 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49967	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:13.262042046 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:13.262226105 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:13.988059044 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:12 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:13.988210917 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:13.988210917 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:13.988210917 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:13.988291025 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49972	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:13.605317116 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:13.605317116 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49977	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:14.136888027 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:14.136915922 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:14.863517046 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:13 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:14.863661051 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:14.863661051 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:14.863688946 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:14.863688946 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49981	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:14.370767117 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:14.370834112 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49985	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:15.011395931 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:15.011466980 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:15.732486010 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:14 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:15.732598066 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:15.732646942 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:15.732646942 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:15.732671976 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49988	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:15.136573076 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:15.136573076 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49995	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:15.902018070 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:15.902038097 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	49996	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:15.917874098 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:15.917996883 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:16.646450043 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:14 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:16.651235104 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:16.651271105 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:16.651271105 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:16.651288986 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	50002	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:16.714694977 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:16.714694977 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	50004	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:16.870743990 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:16.870771885 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:17.596580982 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:16 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:17.596693993 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:17.596752882 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:17.596752882 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:17.596752882 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	50010	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:17.542658091 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:17.542709112 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	50012	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:17.745862007 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:17.745907068 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:18.494033098 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:16 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:18.494235039 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:18.494319916 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:18.494343042 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:18.494363070 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	50017	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:18.308221102 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:18.308336020 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	50021	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:18.730217934 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:18.730484009 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:19.499582052 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:17 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:19.499739885 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:19.499773979 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:19.499789000 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:19.499829054 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	50025	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:19.073904037 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:19.073904037 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	50029	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:19.714534998 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:19.714571953 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:20.464441061 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:19 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:20.464670897 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:20.464687109 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:20.464699984 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:20.464726925 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	50033	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:19.839535952 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:19.839936018 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	50038	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:20.605256081 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:20.605256081 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	50063	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:24.698975086 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:24.699019909 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	50065	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:24.730221987 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:24.730259895 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:25.459703922 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:23 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:25.459853888 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:25.459897995 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:25.459897995 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:25.459980011 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	50073	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:25.537065029 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:25.537065983 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	50085	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:27.683518887 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:27.683520079 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	50086	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:27.699126959 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:27.699157953 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:28.416039944 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:27 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:28.416205883 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:28.416258097 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:28.416258097 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:28.416258097 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	50092	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:28.480129957 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:28.480164051 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	50094	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:28.574306965 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:28.574306965 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:29.299985886 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:27 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:29.300175905 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:29.300252914 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:29.300252914 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:29.300252914 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	50099	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:29.245738983 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:29.245765924 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	50101	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:29.448949099 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:29.449018002 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:30.163588047 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:28 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:30.163789988 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:30.163888931 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:30.163888931 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:30.163889885 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	50103	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:30.011423111 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:30.011462927 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	50104	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:30.324245930 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:30.324320078 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:31.080940008 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:30 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:31.081264019 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:31.081306934 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:31.081306934 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:31.081306934 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	50106	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:30.777021885 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:30.780615091 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	50107	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:31.308361053 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:31.308413982 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:32.023204088 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:31 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:32.023441076 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:32.023442030 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:32.023490906 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:32.023490906 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	50109	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:31.542606115 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:31.542728901 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	50110	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:32.183420897 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:32.183440924 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:32.906635046 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:31 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:32.906994104 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:32.907008886 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:32.907008886 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:32.907017946 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	50112	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:32.308248997 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:32.308392048 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	50114	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:33.074013948 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:33.074013948 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	50115	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:33.089468956 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:33.089490891 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:33.814249039 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:32 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:33.816699028 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:33.816726923 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:33.816726923 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:33.816745996 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	50119	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:33.839643955 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:33.839675903 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	50120	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:34.042850018 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:34.042937994 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:34.790018082 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:33 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:34.792716980 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:34.792716980 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:34.792716980 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:34.792805910 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	50123	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:38.683670998 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:38.683670998 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	50124	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:38.698965073 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:38.698996067 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:39.419019938 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:37 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:39.419255972 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:39.419255972 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:39.419255972 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:39.419255972 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	50128	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:45.526961088 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:45.526987076 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	50130	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:45.558211088 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:45.558227062 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:46.272918940 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:44 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:46.276722908 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:46.276724100 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:46.276724100 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:46.276809931 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	50133	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:46.308206081 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:46.308234930 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	50134	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:46.511682034 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:46.511682034 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:47.243103027 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:46 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:47.243235111 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:47.243257999 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:47.243258953 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:47.243287086 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	50136	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:47.074682951 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:47.074682951 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	50137	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:47.386377096 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:47.386646032 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:48.111412048 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:47 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:48.114708900 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:48.114742994 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:48.114799023 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:48.114806890 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	50139	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:47.839448929 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:47.839551926 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	50140	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:48.261454105 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:48.261455059 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:48.984110117 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:47 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:48.984261036 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:48.984316111 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:48.984316111 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:48.984316111 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	50142	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:48.605115891 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:48.606604099 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	50143	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:49.136430979 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:49.138968945 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:49.852947950 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:48 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:49.853101015 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:49.853135109 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:49.853135109 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:49.853158951 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	50145	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:49.370738029 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:49.370764971 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	50146	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:50.011665106 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:50.011665106 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:50.761759043 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:48 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:50.761899948 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:50.761950016 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:50.761950016 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:50.761950016 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	50150	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:56.245939016 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:56.246005058 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	50152	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:56.278953075 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:56.278994083 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:57.003952980 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:55 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:57.004076958 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:57.004122019 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:57.004122019 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:57.004122019 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	50155	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:57.029849052 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:57.029906988 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	50156	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:57.230123043 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:57.230123043 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:57.957206964 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:56 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:57.957319975 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:57.957319975 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:57.957370996 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:57.957370996 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	50158	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:57.792638063 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:57.792694092 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	50159	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:58.105427027 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:58.105552912 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:58.829576969 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:57 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:58.829791069 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:58.829833984 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:58.829833984 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:58.829833984 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	50161	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:58.558252096 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:58.558274984 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	50162	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:58.988459110 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:58.988497972 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:38:59.698508978 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:57 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:38:59.698731899 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:38:59.698812008 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:59.698822975 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:38:59.699018002 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	50164	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:59.376003027 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:59.376614094 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	50165	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:38:59.856113911 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:38:59.856194973 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:00.588133097 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:38:59 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:00.590127945 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:00.590178967 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:00.590178967 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:00.590178967 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	50167	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:00.183336973 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:00.183336973 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	50169	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:00.855200052 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:00.855221033 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:01.617650986 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:00 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:01.617765903 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:01.617765903 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:01.617821932 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:01.617856026 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	50170	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:00.949350119 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:00.949377060 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	50172	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:01.714648962 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:01.714648962 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	50173	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:01.824827909 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:01.824827909 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:02.548341990 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:00 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:02.549171925 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:02.549171925 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:02.549171925 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:02.549199104 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	50175	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:02.480178118 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:02.480206966 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	50176	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:02.698945045 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:02.702637911 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:03.430547953 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:02 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:03.432723999 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:03.432768106 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:03.432768106 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:03.432769060 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	50178	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:03.247092009 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:03.248620033 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	50179	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:03.584186077 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:03.584186077 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:04.289593935 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:03 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:04.289911985 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:04.289946079 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:04.289946079 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:04.289958000 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	50181	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:04.014812946 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:04.014961958 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	50182	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:04.448898077 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:04.448899031 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:05.165671110 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:03 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:05.167779922 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:05.167815924 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:05.167815924 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:05.167824984 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	50184	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:04.777367115 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:04.777388096 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	50187	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:05.324428082 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:05.324459076 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:06.064588070 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:04 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:06.064857006 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:06.064883947 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:06.064883947 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:06.064893007 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	50189	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:05.542633057 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:05.542633057 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	50192	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:08.261533976 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:08.261604071 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	50193	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:08.277565002 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:08.277832031 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:09.032418013 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:08 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:09.032572985 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:09.032573938 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:09.032573938 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:09.032697916 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	50195	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:09.058352947 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:09.058439970 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	50196	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:09.261615038 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:09.261656046 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:09.989753962 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:08 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:09.992357016 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:09.992357016 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:09.992851019 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:09.992907047 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	50198	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:09.829631090 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:09.830235004 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	50199	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:10.465773106 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:10.465801001 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:11.186810970 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:10 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:11.186932087 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:11.186966896 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:11.186966896 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:11.186986923 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	50201	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:11.386702061 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:11.386703014 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	50202	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:11.402867079 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:11.402894020 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:12.123459101 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:11 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:12.123558998 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:12.123574972 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:12.123574972 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:12.123600960 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	50204	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:12.214548111 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:12.216638088 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	50205	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:12.324100971 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:12.324100971 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:13.039354086 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:11 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:13.039474964 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:13.039474964 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:13.039474964 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:13.039474964 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	50207	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:13.136626959 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:13.136626959 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	50208	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:13.198899031 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:13.198991060 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:13.947248936 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:12 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:13.947349072 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:13.947349072 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:13.947386026 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:13.947452068 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	50212	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:13.980313063 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:13.980411053 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	50213	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:14.183496952 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:14.183532953 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:14.964818001 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:13 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:14.965001106 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:14.965039968 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:14.965039968 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:14.965039968 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	50215	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:14.745897055 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:14.746781111 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	50216	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:15.167710066 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:15.171474934 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:15.899362087 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:14 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:15.899588108 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:15.899630070 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:15.899630070 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:15.899630070 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	50218	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:15.511832952 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:15.515466928 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	50219	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:16.042648077 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:16.042678118 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:16.790891886 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:14 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:16.794720888 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:16.794763088 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:16.794763088 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:16.794763088 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	50222	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:16.277693987 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:16.278718948 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	50224	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:17.044110060 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:17.044110060 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	50225	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:17.060884953 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:17.061305046 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:17.776361942 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:16 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:17.776525974 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:17.776571035 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:17.776571035 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:17.776571989 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	50227	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:17.808394909 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:17.808440924 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	50228	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:18.011733055 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:18.011734009 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:18.740174055 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:17 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:18.740910053 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:18.740910053 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:18.740910053 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:18.740978003 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	50230	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:18.575011969 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:18.575011969 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	50231	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:18.886461020 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:18.887584925 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:19.632157087 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:18 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:19.632308006 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:19.632397890 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:19.632397890 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:19.632397890 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	50233	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:19.339550018 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:19.340636969 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	50234	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:19.886423111 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:19.886424065 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:20.651424885 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:19 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:20.652779102 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:20.652780056 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:20.652780056 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:20.652780056 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	50236	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:20.114216089 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:20.114216089 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	50238	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:20.871407986 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:20.871408939 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	50239	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:20.886395931 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:20.888637066 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:21.613769054 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:19 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:21.613917112 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:21.613917112 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:21.613954067 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:21.613979101 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	50241	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:21.636637926 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:21.636637926 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	50243	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:21.856471062 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:21.856549978 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:22.603615999 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:20 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:22.603842020 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:22.603842020 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:22.603879929 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:22.603879929 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	50246	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:22.402113914 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:22.402113914 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	50247	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:22.824379921 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:22.824381113 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:23.555001020 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:22 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:23.555258989 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:23.555258989 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:23.555299044 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:23.555299044 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	50248	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:23.152467966 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:23.152749062 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	50249	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:23.698996067 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:23.698996067 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:24.429249048 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:23 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:24.429528952 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:24.429552078 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:24.429558992 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:24.429569960 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	50250	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:23.917805910 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:23.920638084 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	50252	65.21.245.7	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:24.575259924 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:24.576630116 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:
Oct 30, 2024 22:39:25.299940109 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 30 Oct 2024 21:39:23 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>
Oct 30, 2024 22:39:25.300755024 CET	6	OUT	Data Raw: 00 00 10 18 Data Ascii:
Oct 30, 2024 22:39:25.300755024 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:25.300755024 CET	6	OUT	Data Raw: 2d 2d 0d 0a Data Ascii: --
Oct 30, 2024 22:39:25.300755978 CET	6	OUT	Data Raw: 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	50253	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:24.683284998 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:24.683398962 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	50255	111.90.140.76	80	8036	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 22:39:25.449668884 CET	6	OUT	Data Raw: 00 00 00 01 Data Ascii:
Oct 30, 2024 22:39:25.449670076 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49760	96.7.168.138	443	7180	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:37:46 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-10-30 21:37:46 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Wed, 30 Oct 2024 21:37:46 GMT Connection: close

Target ID:	0
Start time:	17:37:29
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\0438.pdf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\0438.pdf.exe"
Imagebase:	0x7ff655d80000
File size:	11'654'747 bytes
MD5 hash:	2D11DBA46735AF1CB1C0A42E9564E20D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:37:30
Start date:	30/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\pdf.msi" /qn
Imagebase:	0x7ff75fcd0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:37:31
Start date:	30/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\Doc.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	17:37:31
Start date:	30/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff75fcd0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	17:37:32
Start date:	30/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:37:32
Start date:	30/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	17:37:32
Start date:	30/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1736,i,7783600837662025009,4322504478347230784,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	17:37:39
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /siex /silentinstall
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000B.00000000.2234439109.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:37:41
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /siex /silentinstall
Imagebase:	0x400000
File size:	7'753'808 bytes
MD5 hash:	F3D74B072B9697CF64B0B8445FDC8128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000C.00000000.2252577316.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:37:42
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /firewall
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:37:42
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /firewall
Imagebase:	0x400000
File size:	7'753'808 bytes
MD5 hash:	F3D74B072B9697CF64B0B8445FDC8128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:37:43
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /server /start
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:37:44
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe" /start
Imagebase:	0x400000
File size:	7'753'808 bytes
MD5 hash:	F3D74B072B9697CF64B0B8445FDC8128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:37:44
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe"
Imagebase:	0x400000
File size:	7'753'808 bytes
MD5 hash:	F3D74B072B9697CF64B0B8445FDC8128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	17:37:47
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe"
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	17:37:47
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	17:37:47
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	17:37:48
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	17:37:49
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	17:37:50
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	17:37:51
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	17:37:53
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	17:39:09
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	17:39:29
Start date:	30/10/2024
Path:	C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe" /tray
Imagebase:	0x400000
File size:	6'307'408 bytes
MD5 hash:	63D0964168B927D00064AA684E79A300
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	27

Executed Functions

Function 00007FF655DAB190 Relevance: 123.9, APIs: 60, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655D8255C: GetDlgItem.USER32 ref: 00007FF655D825AC
Part of subcall function 00007FF655D8255C: SetWindowTextW.USER32 ref: 00007FF655D825C8

EndDialog.USER32 ref: 00007FF655DAB2D0
SetDlgItemTextW.USER32 ref: 00007FF655DAB320
GetMessageW.USER32 ref: 00007FF655DAB350
IsDialogMessageW.USER32 ref: 00007FF655DAB369
TranslateMessage.USER32 ref: 00007FF655DAB37B
DispatchMessageW.USER32 ref: 00007FF655DAB389
EndDialog.USER32 ref: 00007FF655DAB3D3
GetDlgItem.USER32 ref: 00007FF655DAB410
SendMessageW.USER32 ref: 00007FF655DAB431
SendMessageW.USER32 ref: 00007FF655DAB449
SetFocus.USER32 ref: 00007FF655DAB452
GetLastError.KERNEL32 ref: 00007FF655DAB634
GetLastError.KERNEL32 ref: 00007FF655DAB665
GetTickCount.KERNEL32 ref: 00007FF655DAB68B
GetLastError.KERNEL32 ref: 00007FF655DAB6F5
GetCommandLineW.KERNEL32 ref: 00007FF655DAB841
CreateFileMappingW.KERNEL32 ref: 00007FF655DAB900
MapViewOfFile.KERNEL32 ref: 00007FF655DAB923
Sleep.KERNEL32 ref: 00007FF655DAB9B6
UnmapViewOfFile.KERNEL32 ref: 00007FF655DAB9DF
CloseHandle.KERNEL32 ref: 00007FF655DAB9E8
SetDlgItemTextW.USER32 ref: 00007FF655DABCDE
DialogBoxParamW.USER32 ref: 00007FF655DAC0D7
EndDialog.USER32 ref: 00007FF655DAC0EF
EnableWindow.USER32 ref: 00007FF655DAC2A6
SendMessageW.USER32 ref: 00007FF655DAC2F8
ShellExecuteExW.SHELL32 ref: 00007FF655DAB95B

Part of subcall function 00007FF655D9AAE0: LoadStringW.USER32 ref: 00007FF655D9AB67
Part of subcall function 00007FF655D9AAE0: LoadStringW.USER32 ref: 00007FF655D9AB80

SendMessageW.USER32 ref: 00007FF655DABEC3
SendDlgItemMessageW.USER32 ref: 00007FF655DABEEA
GetDlgItem.USER32 ref: 00007FF655DABEF8
SendMessageW.USER32 ref: 00007FF655DABF12
GetDlgItem.USER32 ref: 00007FF655DABF4F
SetDlgItemTextW.USER32 ref: 00007FF655DABFEC
SetDlgItemTextW.USER32 ref: 00007FF655DAC004
SetDlgItemTextW.USER32 ref: 00007FF655DAC321
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAC363
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAC369
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAC36F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAC375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAC37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAC381
SendDlgItemMessageW.USER32 ref: 00007FF655DAC449
EndDialog.USER32 ref: 00007FF655DAC463
GetDlgItem.USER32 ref: 00007FF655DAC491
SetFocus.USER32 ref: 00007FF655DAC49A
SendDlgItemMessageW.USER32 ref: 00007FF655DAC53E
FindFirstFileW.KERNEL32 ref: 00007FF655DAC562
FindClose.KERNEL32 ref: 00007FF655DAC68A
SendDlgItemMessageW.USER32 ref: 00007FF655DAC7AF

Part of subcall function 00007FF655D8129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655D81396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DACAA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DACAAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DACAB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DACABB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DACAC1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DACAC7

Strings

REPLACEFILEDLG, xrefs: 00007FF655DAC3D3
STARTDLG, xrefs: 00007FF655DAB1CA
@, xrefs: 00007FF655DAB7B6
winrarsfxmappingfile.tmp, xrefs: 00007FF655DAB8E0
p, xrefs: 00007FF655DAB7AB
LICENSEDLG, xrefs: 00007FF655DAC0C9
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF655DAB799
__tmp_rar_sfx_access_check_, xrefs: 00007FF655DAB6A9
%s %s, xrefs: 00007FF655DAC6D9, 00007FF655DAC946
runas, xrefs: 00007FF655DAB7C9

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Item$Message$_invalid_parameter_noinfo_noreturn$Send$DialogText$File$ErrorLast$CloseFindFocusLoadStringViewWindow$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleLineMappingParamShellSleepTickTranslateUnmap
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 255727823-2702805183
Opcode ID: 25d7627cdadfb7a0975e693defbf18a1c09942109cbeb33185e2f9b754ac09a6
Instruction ID: 8368aaa82076f52a6d6cbb38a4f63f396720894b57c300f33fd0d236997f996d
Opcode Fuzzy Hash: 25d7627cdadfb7a0975e693defbf18a1c09942109cbeb33185e2f9b754ac09a6
Instruction Fuzzy Hash: 72D2C53BA0868381FA60DB64E8582FA6351EF85F98F484335D94DA66A5DF3CED44C708

Function 00007FF655DACE88 Relevance: 65.0, APIs: 26, Strings: 10, Instructions: 1963windowfileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF655DAD5F3
SendMessageW.USER32 ref: 00007FF655DAD626
SendMessageW.USER32 ref: 00007FF655DAD655
MoveFileW.KERNEL32 ref: 00007FF655DADB4B
MoveFileExW.KERNEL32 ref: 00007FF655DADB69
GetTempPathW.KERNEL32 ref: 00007FF655DADC49

Part of subcall function 00007FF655D81FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D81FFB

EndDialog.USER32 ref: 00007FF655DADFCA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655DAEEE3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAEEEF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAEF07
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAEF0D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAEF13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAEF19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAEF1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAEF25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAEF2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAEF31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAEF37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAEF3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAEF43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAEF49
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAEF4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAEF55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAEF5B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655DAEF67
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655DAEF73

Strings

<br>, xrefs: 00007FF655DAD6DA, 00007FF655DAD6E9
.lnk, xrefs: 00007FF655DAE406, 00007FF655DAE415
ProgramFilesDir, xrefs: 00007FF655DAD4F0
lnk, xrefs: 00007FF655DAE3CA, 00007FF655DAE3D9
HIDE, xrefs: 00007FF655DAE9E5, 00007FF655DAE9F4
MAX, xrefs: 00007FF655DAEA82, 00007FF655DAEA91
MIN, xrefs: 00007FF655DAEAE5, 00007FF655DAEAF4
.tmp, xrefs: 00007FF655DADA85
@set:user, xrefs: 00007FF655DADD96, 00007FF655DADDA5
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF655DAD501

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$FileMessageMoveSend$DialogItemPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 3007431893-3916287355
Opcode ID: e8e04c62f54770bedbb7c0e18cc69a2eaec3cac7609a0d283ef696123d8756e1
Instruction ID: 59c59340c3d6326d2539683ffd005b09447dbb99c7b89be0ae52fdea56e10ed6
Opcode Fuzzy Hash: e8e04c62f54770bedbb7c0e18cc69a2eaec3cac7609a0d283ef696123d8756e1
Instruction Fuzzy Hash: 38139F77A04B8285EB10DF64D8482ED27B1EB40B9CF581735DA1DA7AD9DF38E984C348

Function 00007FF655DB0754 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 380
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF655D9DFD0: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF655D9E018
Part of subcall function 00007FF655D9DFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF655D9E030
Part of subcall function 00007FF655D9DFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF655D9E05D

Part of subcall function 00007FF655D962DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF655D962F2
Part of subcall function 00007FF655D962DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF655D9632C

Part of subcall function 00007FF655DA946C: OleInitialize.OLE32 ref: 00007FF655DA9486
Part of subcall function 00007FF655DA946C: SHGetMalloc.SHELL32 ref: 00007FF655DA94D4

GetCommandLineW.KERNEL32 ref: 00007FF655DB096E
OpenFileMappingW.KERNEL32 ref: 00007FF655DB0A07
MapViewOfFile.KERNEL32 ref: 00007FF655DB0A30
UnmapViewOfFile.KERNEL32 ref: 00007FF655DB0A46
MapViewOfFile.KERNEL32 ref: 00007FF655DB0A63
UnmapViewOfFile.KERNEL32 ref: 00007FF655DB0ACA
CloseHandle.KERNEL32 ref: 00007FF655DB0AD3
SetEnvironmentVariableW.KERNEL32 ref: 00007FF655DB0BAD
GetLocalTime.KERNEL32 ref: 00007FF655DB0BB8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF655DB0C13
SetEnvironmentVariableW.KERNEL32 ref: 00007FF655DB0C26
GetModuleHandleW.KERNEL32 ref: 00007FF655DB0C2E
LoadIconW.USER32 ref: 00007FF655DB0C4D
DialogBoxParamW.USER32 ref: 00007FF655DB0CB6
Sleep.KERNEL32 ref: 00007FF655DB0CE6
DeleteObject.GDI32 ref: 00007FF655DB0D0D
DeleteObject.GDI32 ref: 00007FF655DB0D1F
CloseHandle.KERNEL32 ref: 00007FF655DB0D67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DB0DD7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DB0DDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DB0DE3

Part of subcall function 00007FF655DAFD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF655DAFD43
Part of subcall function 00007FF655DAFD0C: SetEnvironmentVariableW.KERNELBASE ref: 00007FF655DAFDBC

Strings

STARTDLG, xrefs: 00007FF655DB0CA5
sfxname, xrefs: 00007FF655DB0B9B
winrarsfxmappingfile.tmp, xrefs: 00007FF655DB09F9
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF655DB0C02
sfxstime, xrefs: 00007FF655DB0C1F

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 1048086575-3710569615
Opcode ID: a2d1f56a0ea0f115fb5c545e7d969dd7b349b6d85002bdedd461fc6b968f04a4
Instruction ID: ccc8897fad7932b612c54cd4c0eb9dc14444d1b8603384ddbefb8c902e584097
Opcode Fuzzy Hash: a2d1f56a0ea0f115fb5c545e7d969dd7b349b6d85002bdedd461fc6b968f04a4
Instruction Fuzzy Hash: 6D12776BA1878381FB109B24E8492B97361FF84F98F484335DA5DA6B95DF3CE944C708

Function 00007FF655D9A4AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF655D9A504

Part of subcall function 00007FF655DA0F68: WideCharToMultiByte.KERNEL32 ref: 00007FF655DA0F99

SetDlgItemTextW.USER32 ref: 00007FF655D9A573
GetWindowRect.USER32 ref: 00007FF655D9A5AD
GetClientRect.USER32 ref: 00007FF655D9A5BB
GetWindowLongPtrW.USER32 ref: 00007FF655D9A66C
GetWindowRect.USER32 ref: 00007FF655D9A6B2
SetWindowTextW.USER32 ref: 00007FF655D9A6EC
GetSystemMetrics.USER32 ref: 00007FF655D9A6F7
GetWindow.USER32 ref: 00007FF655D9A708
GetWindowRect.USER32 ref: 00007FF655D9A746
GetWindow.USER32 ref: 00007FF655D9A808

Strings

$%s:, xrefs: 00007FF655D9A4EF
CAPTION, xrefs: 00007FF655D9A6CF

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 2100155373-404845831
Opcode ID: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction ID: 280dd9c071037b666bbb3e07523e5ab38c9ccc5a4f0ae1aeacea78ab8c61462c
Opcode Fuzzy Hash: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction Fuzzy Hash: 2A91D737B1864286E7149F29E414669B7A1FB84B88F485735EE4DA7B58CF3CEC05CB04

Function 00007FF655DA8624 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32 ref: 00007FF655DA863D
SizeofResource.KERNEL32 ref: 00007FF655DA8659
LoadResource.KERNEL32 ref: 00007FF655DA8673
LockResource.KERNEL32 ref: 00007FF655DA8685
GlobalAlloc.KERNELBASE ref: 00007FF655DA86A6
GlobalLock.KERNEL32 ref: 00007FF655DA86BB
CreateStreamOnHGlobal.COMBASE ref: 00007FF655DA86E8
GdipAlloc.GDIPLUS ref: 00007FF655DA86FE
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF655DA8769
GlobalUnlock.KERNEL32 ref: 00007FF655DA878C
GlobalFree.KERNEL32 ref: 00007FF655DA8795

Strings

PNG, xrefs: 00007FF655DA862F

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction ID: c6783c27b8c44e366506887b4cbaf044d75de1cd5a8f415893e32b06dce826d7
Opcode Fuzzy Hash: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction Fuzzy Hash: E5411F2BA19A0281EA159B56D85C779A3A0AF88F98F0C4735CD0DA7764EF7CEC45C704

Function 00007FF655D8F930 Relevance: 17.2, APIs: 8, Strings: 1, Instructions: 1417COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D91239
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D9123F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D91245
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D9124B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D91251
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D91257
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D9125D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D91263

Strings

__tmp_reference_source_, xrefs: 00007FF655D8FCCF, 00007FF655D8FCDE

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: d5a8365e8948251528286b161cddaa5feaa6a84134b6101f2d82ca0e8e1ec618
Instruction ID: 61852f81b0adf2ebbd18dce301023682a71d75c2049d62ac3d12a68dad43f5b1
Opcode Fuzzy Hash: d5a8365e8948251528286b161cddaa5feaa6a84134b6101f2d82ca0e8e1ec618
Instruction Fuzzy Hash: 06E2EB67A086C292EA64CB65E0583FEA761FB41F48F484331DB9DA36A5CF3CE854C704

Function 00007FF655D84840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8511E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D85124
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8512A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D85E16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D85E1C

Strings

CMT, xrefs: 00007FF655D859B2

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: CMT
API String ID: 3668304517-2756464174
Opcode ID: c11a863c1fc623ed6efd17e9f8372475e5dca71780db97a9728ff10bb20c177f
Instruction ID: b749a970ea6f92e4cfd37aa76330b6df0466f5b11a60f0bfb9a2fced5b74e131
Opcode Fuzzy Hash: c11a863c1fc623ed6efd17e9f8372475e5dca71780db97a9728ff10bb20c177f
Instruction Fuzzy Hash: 2BE2F32BB0868296EB14DB64D4682FD67A1FB40B8CF481335DA5EA7792DF3CE854C305

Function 00007FF655D940BC Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF655D9410B
FindFirstFileW.KERNELBASE ref: 00007FF655D9415E
GetLastError.KERNEL32 ref: 00007FF655D941AF
FindNextFileW.KERNEL32 ref: 00007FF655D941D7
GetLastError.KERNEL32 ref: 00007FF655D941E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D9430F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D94315

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: e946e08dc8eba9ecab1b1533132c2bb6995f9a4699fd30eb303f74d9a567b386
Instruction ID: 786091e9229bef8d4fc3b00354e84f700c0ce6361dbcb2bbd74cd9f6079bbfe4
Opcode Fuzzy Hash: e946e08dc8eba9ecab1b1533132c2bb6995f9a4699fd30eb303f74d9a567b386
Instruction Fuzzy Hash: 4D61A367A09A4281EA109B24E85827D6371FB85FB8F145331EAADA37D9DF3CD984C704

Function 00007FF655D85E24 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMT, xrefs: 00007FF655D859B2, 00007FF655D8675B

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: 589854a86694341a55c69b07c8121abed16d2d53b78a965ac968b8bdafdd2d04
Instruction ID: f8c6b4d5674047165075c6ab48ccf84e599b082bcf6504635f3499edfc0c653c
Opcode Fuzzy Hash: 589854a86694341a55c69b07c8121abed16d2d53b78a965ac968b8bdafdd2d04
Instruction Fuzzy Hash: 7742F12BB0868196EB18DB74C1592FD67A1EB10B5CF081336DB1EA76D6DF38E918C305

Function 00007FF655DA1F20 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7c7bc2dc56eba4a822e06febf8edf8ef325e601d03988013764f0f8a043b181
Instruction ID: 732c6d73f0101983775e7d5b2dc80972704cb4b4f6580570e2ef764bc3429c16
Opcode Fuzzy Hash: a7c7bc2dc56eba4a822e06febf8edf8ef325e601d03988013764f0f8a043b181
Instruction Fuzzy Hash: 45E1A67BA0928287EB64CF29E44827E7791FB45B4CF094339DB4DA7645DE3CE9418708

Function 00007FF655DA3484 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca6f1c51f28919b1ed0d44622ea5b19d03515415c361c6bf899ecd233d7ad4e
Instruction ID: caa39f7699abf9b48e79669e1c400154e5c2ca982bc9ef1c2d4448fb55db1357
Opcode Fuzzy Hash: bca6f1c51f28919b1ed0d44622ea5b19d03515415c361c6bf899ecd233d7ad4e
Instruction Fuzzy Hash: 43B1C0A7B04AC992DE59CA65D50C7EAA392B745FC8F488232DE0D67B40DF3CE955C304

Function 00007FF655D94928 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID:
API String ID: 3340455307-0
Opcode ID: 70d0a199513ddd0303306b6c1f9c9cd84068436a56a79b22c40158a956f58a9a
Instruction ID: e82177f9f79fdbf901884e010c2f005d434ac11d1f38a8606ad139e1ba6eee71
Opcode Fuzzy Hash: 70d0a199513ddd0303306b6c1f9c9cd84068436a56a79b22c40158a956f58a9a
Instruction Fuzzy Hash: 03410827B1565686FB64DF11E92877A2262FBC4B8CF084334DE4DA7795DE3CE8428708

Function 00007FF655D9DFD0 Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF655D9E018
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF655D9E030
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF655D9E05D
CreateFileW.KERNEL32 ref: 00007FF655D9E3F0
SetFilePointer.KERNEL32 ref: 00007FF655D9E40E
ReadFile.KERNEL32 ref: 00007FF655D9E436

Part of subcall function 00007FF655D9DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF655D9DDDF

CompareStringW.KERNELBASE ref: 00007FF655D9E559
CloseHandle.KERNEL32 ref: 00007FF655D9E4F3

Part of subcall function 00007FF655D81FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D81FFB

Part of subcall function 00007FF655D951A4: GetVersionExW.KERNEL32 ref: 00007FF655D951D5

Part of subcall function 00007FF655D9DFD0: LoadLibraryExW.KERNELBASE ref: 00007FF655D9DEFF
Part of subcall function 00007FF655D9DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D9DFB5
Part of subcall function 00007FF655D9DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D9DFBB
Part of subcall function 00007FF655D9DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D9DFC1
Part of subcall function 00007FF655D9DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D9DFC7

AllocConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF655D9E74B
GetCurrentProcessId.KERNEL32(?,?,?,00000000,?), ref: 00007FF655D9E755
AttachConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF655D9E75D
GetStdHandle.KERNEL32(?,?,?,00000000,?), ref: 00007FF655D9E780
WriteConsoleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF655D9E799
Sleep.KERNEL32(?,?,?,00000000,?), ref: 00007FF655D9E7A4
FreeConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF655D9E7AA
ExitProcess.KERNEL32 ref: 00007FF655D9E7BB

Strings

dfscli.dll, xrefs: 00007FF655D9E2F3
psapi.dll, xrefs: 00007FF655D9E115
ws2_32.dll, xrefs: 00007FF655D9E0FF
cabinet.dll, xrefs: 00007FF655D9E1DB
slc.dll, xrefs: 00007FF655D9E23D
crypt32.dll, xrefs: 00007FF655D9E187
sfc_os.dll, xrefs: 00007FF655D9E091
comres.dll, xrefs: 00007FF655D9E0F4
version.dll, xrefs: 00007FF655D9E07B
dnsapi.DLL, xrefs: 00007FF655D9E259
clbcatq.dll, xrefs: 00007FF655D9E0E9
SetDllDirectoryW, xrefs: 00007FF655D9E026
shdocvw.dll, xrefs: 00007FF655D9E179
mpr.dll, xrefs: 00007FF655D9E291
dhcpcsvc6.dll, xrefs: 00007FF655D9E31D
shell32.dll, xrefs: 00007FF655D9E1BF
secur32.dll, xrefs: 00007FF655D9E1CD
aclui.dll, xrefs: 00007FF655D9E371
iphlpapi.DLL, xrefs: 00007FF655D9E267
wkscli.dll, xrefs: 00007FF655D9E2E5
cryptbase.dll, xrefs: 00007FF655D9E0C8
mlang.dll, xrefs: 00007FF655D9E2BB
linkinfo.dll, xrefs: 00007FF655D9E347
cryptui.dll, xrefs: 00007FF655D9E1A3
peerdist.dll, xrefs: 00007FF655D9E38D
RpcRtRemote.dll, xrefs: 00007FF655D9E363
apphelp.dll, xrefs: 00007FF655D9E14F
samcli.dll, xrefs: 00007FF655D9E2C9
usp10.dll, xrefs: 00007FF655D9E0DE
atl.dll, xrefs: 00007FF655D9E136
cryptsp.dll, xrefs: 00007FF655D9E355
uxtheme.dll, xrefs: 00007FF655D9E66D
browcli.dll, xrefs: 00007FF655D9E301
profapi.dll, xrefs: 00007FF655D9E205
dhcpcsvc.dll, xrefs: 00007FF655D9E32B
ieframe.dll, xrefs: 00007FF655D9E120
XmlLite.dll, xrefs: 00007FF655D9E339
cscapi.dll, xrefs: 00007FF655D9E22F
wintrust.dll, xrefs: 00007FF655D9E1B1
samlib.dll, xrefs: 00007FF655D9E2D7
dwmapi.dll, xrefs: 00007FF655D9E0BD, 00007FF655D9E661
netutils.dll, xrefs: 00007FF655D9E283
SetDefaultDllDirectories, xrefs: 00007FF655D9E053
ntshrui.dll, xrefs: 00007FF655D9E12B
rasadhlp.dll, xrefs: 00007FF655D9E30F
oleaccrc.dll, xrefs: 00007FF655D9E1E9
SSPICLI.DLL, xrefs: 00007FF655D9E09C
imageres.dll, xrefs: 00007FF655D9E24B
UXTheme.dll, xrefs: 00007FF655D9E0B2
lpk.dll, xrefs: 00007FF655D9E0D3
setupapi.dll, xrefs: 00007FF655D9E141
netapi32.dll, xrefs: 00007FF655D9E16B
ws2help.dll, xrefs: 00007FF655D9E10A
devrtl.dll, xrefs: 00007FF655D9E29F
msasn1.dll, xrefs: 00007FF655D9E195
DXGIDebug.dll, xrefs: 00007FF655D9E086, 00007FF655D9E5B6
WindowsCodecs.dll, xrefs: 00007FF655D9E213
rsaenh.dll, xrefs: 00007FF655D9E0A7
WINNSI.DLL, xrefs: 00007FF655D9E275
dsrole.dll, xrefs: 00007FF655D9E37F
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF655D9E73B
userenv.dll, xrefs: 00007FF655D9E15D
propsys.dll, xrefs: 00007FF655D9E2AD
srvcli.dll, xrefs: 00007FF655D9E221
ntmarta.dll, xrefs: 00007FF655D9E1F7
kernel32, xrefs: 00007FF655D9E011

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 1496594111-2013832382
Opcode ID: 468c4a7f069b7598ff125167d5f4f846522f64d48354b40e84144950afa66450
Instruction ID: c94b8f6b36b775558e71432e4c1910b5fe182495f47e1db7b1c117e3cef0ea24
Opcode Fuzzy Hash: 468c4a7f069b7598ff125167d5f4f846522f64d48354b40e84144950afa66450
Instruction Fuzzy Hash: 9E324E3AA09B8295E7119F60E8481E933B4FF44B58F580336DA4DA77A5EF3CEA45C344

Function 00007FF655D998DC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655D98E58: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655D98F8D

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF655D99F75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D9A42F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D9A435

Part of subcall function 00007FF655DA0BBC: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF655DA0B44), ref: 00007FF655DA0BE9

Strings

*messages***, xrefs: 00007FF655D99C04
*messages***, xrefs: 00007FF655D99BC6
,, xrefs: 00007FF655D99FAA
, xrefs: 00007FF655D99DF9
@%s:, xrefs: 00007FF655D99F57
MENU, xrefs: 00007FF655D99DD9
STRINGS, xrefs: 00007FF655D99DC1
DIALOG, xrefs: 00007FF655D99DCD
DIRECTION, xrefs: 00007FF655D99DE5
RTL, xrefs: 00007FF655D99F2E
$%s:, xrefs: 00007FF655D99F50

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: d5e184d1739c57cd0f07290b4b435b9f8b6515e69c147f3d5d8e6c96380bb7e8
Instruction ID: 7c4447c46ed3332b66cc8809d42c5e1ba03a8cea03962ca0c6eee880fcbeadf2
Opcode Fuzzy Hash: d5e184d1739c57cd0f07290b4b435b9f8b6515e69c147f3d5d8e6c96380bb7e8
Instruction Fuzzy Hash: 0D62B12BA1964295EB10DB64C46C2BD6371FB40B8CF885335DA4DA7A95EF3CED84C348

Function 00007FF655DB1900 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF655DB1558: DloadProtectSection.DELAYIMP ref: 00007FF655DB15C9

RaiseException.KERNEL32 ref: 00007FF655DB19A7
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF655DB1993

Part of subcall function 00007FF655DB1868: DloadProtectSection.DELAYIMP ref: 00007FF655DB18C7

LoadLibraryExA.KERNELBASE ref: 00007FF655DB1A46
GetLastError.KERNEL32 ref: 00007FF655DB1A54
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF655DB1A86
RaiseException.KERNEL32 ref: 00007FF655DB1A9A

Strings

H, xrefs: 00007FF655DB1974

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction ID: c1931a897578eaafa980068d8ab35028f3294e97e582b11e15ddbc20ebe78aea
Opcode Fuzzy Hash: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction Fuzzy Hash: 3A914C3BA15B518AEB00DFA5D8486A823B5FB09F98F484735DE0DA7754EF38E845C708

Function 00007FF655DAF4E0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF655DAF747
ShowWindow.USER32 ref: 00007FF655DAF786
GetExitCodeProcess.KERNEL32 ref: 00007FF655DAF7BD
CloseHandle.KERNEL32 ref: 00007FF655DAF7E7
ShowWindow.USER32 ref: 00007FF655DAF83F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAF8FB

Strings

.exe, xrefs: 00007FF655DAF7F2
Install, xrefs: 00007FF655DAF684
p, xrefs: 00007FF655DAF529
.inf, xrefs: 00007FF655DAF675

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 1054546013-3607691742
Opcode ID: c93eaa18019216a85c3e78fe71fcdc46f058aac99f8069240fe2a65e9d023974
Instruction ID: acac43fae8aa256415769c0d6de9b76f4250acc8b8ace5b7b15846b869ee4880
Opcode Fuzzy Hash: c93eaa18019216a85c3e78fe71fcdc46f058aac99f8069240fe2a65e9d023974
Instruction Fuzzy Hash: BFC1807BF0864395FA50CB65D94827AA361AF85F88F084371CA4DA77A4DF3CEC958308

Function 00007FF655DAF0A4 Relevance: 16.6, APIs: 11, Instructions: 102
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF655DAAE1C: PeekMessageW.USER32 ref: 00007FF655DAAE32
Part of subcall function 00007FF655DAAE1C: GetMessageW.USER32 ref: 00007FF655DAAE49
Part of subcall function 00007FF655DAAE1C: IsDialogMessageW.USER32 ref: 00007FF655DAAE60
Part of subcall function 00007FF655DAAE1C: TranslateMessage.USER32 ref: 00007FF655DAAE6F
Part of subcall function 00007FF655DAAE1C: DispatchMessageW.USER32 ref: 00007FF655DAAE7A

GetDlgItem.USER32 ref: 00007FF655DAF0E3
ShowWindow.USER32 ref: 00007FF655DAF109
SendMessageW.USER32 ref: 00007FF655DAF11E
SendMessageW.USER32 ref: 00007FF655DAF136
SendMessageW.USER32 ref: 00007FF655DAF157
SendMessageW.USER32 ref: 00007FF655DAF173
SendMessageW.USER32 ref: 00007FF655DAF1B6
SendMessageW.USER32 ref: 00007FF655DAF1D4
SendMessageW.USER32 ref: 00007FF655DAF1E8
SendMessageW.USER32 ref: 00007FF655DAF212
SendMessageW.USER32 ref: 00007FF655DAF22A

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 3569833718-0
Opcode ID: c58ef51af4c11ae469b78d40ba7290d4e9656f32b0895ce54e4debee0d1a06d9
Instruction ID: e88a9ff34786c688eec05201e835f84d1fa035cbc1b6a169740da59cce211f82
Opcode Fuzzy Hash: c58ef51af4c11ae469b78d40ba7290d4e9656f32b0895ce54e4debee0d1a06d9
Instruction Fuzzy Hash: 7C41903AB1464386F7108F61E818BAA7360EB85F9DF481335DD0AA7B95CE3DDC458748

Function 00007FF655D8EF10 Relevance: 11.0, APIs: 7, Instructions: 453COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8F542
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8F548
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8F554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8F55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8F560
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8F56C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8F572

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 39ec4a74e49df8f56e32db411fcadac0f579ee807ced4d6d4e98762d9bdd5929
Instruction ID: e63d2437b2c591f9fe56f9765f950edbe73dfde764f7fc28fa3cf0f2f3811f69
Opcode Fuzzy Hash: 39ec4a74e49df8f56e32db411fcadac0f579ee807ced4d6d4e98762d9bdd5929
Instruction Fuzzy Hash: C812D367F0874285EB10DB64D4482AD6372EB45BACF441336DA5CA7ADADF3CE889C305

Function 00007FF655D924C0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF655D9259B
GetLastError.KERNEL32 ref: 00007FF655D925AE
CreateFileW.KERNEL32 ref: 00007FF655D9260E
GetLastError.KERNEL32 ref: 00007FF655D92617
SetFileTime.KERNEL32 ref: 00007FF655D926C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D92736

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 3a28dd0dcfd7b89b689d9fe25ecc7464786bdc3a32dccfb94d5fbab1a7314792
Instruction ID: 47fb9b789c14fd55767fe776a960cae222456aac7ff7d45dfcaffc723076f4c5
Opcode Fuzzy Hash: 3a28dd0dcfd7b89b689d9fe25ecc7464786bdc3a32dccfb94d5fbab1a7314792
Instruction Fuzzy Hash: B961E76BA1868185E7208B69E41836E67B1F784BACF141334DFAD63AD4CF3DD894C748

Function 00007FF655DAFD0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF655DAFD43
SetEnvironmentVariableW.KERNELBASE ref: 00007FF655DAFDBC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAFE1B

Strings

sfxpar, xrefs: 00007FF655DAFDB5
sfxcmd, xrefs: 00007FF655DAFD3C

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: f7f09a535254ba7702706040489ea7439e58d63b661cc729fc85acc9afefde13
Instruction ID: bfc0cc9d61e85e6a438265975d36134f2fd8b1a9b95b76bbb19a4e1ed0f0bbd1
Opcode Fuzzy Hash: f7f09a535254ba7702706040489ea7439e58d63b661cc729fc85acc9afefde13
Instruction Fuzzy Hash: 9C318F3BA14A4684EF009B65E4881AD6371FB48F9CF180735DE5DA77A9DF38D841C348

Function 00007FF655DAB014 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF655DAB02A
GetObjectW.GDI32 ref: 00007FF655DAB05B
DeleteObject.GDI32 ref: 00007FF655DAB095
DeleteObject.GDI32 ref: 00007FF655DAB0C5

Part of subcall function 00007FF655DA8624: FindResourceW.KERNEL32 ref: 00007FF655DA863D
Part of subcall function 00007FF655DA8624: SizeofResource.KERNEL32 ref: 00007FF655DA8659
Part of subcall function 00007FF655DA8624: LoadResource.KERNEL32 ref: 00007FF655DA8673
Part of subcall function 00007FF655DA8624: LockResource.KERNEL32 ref: 00007FF655DA8685
Part of subcall function 00007FF655DA8624: GlobalAlloc.KERNELBASE ref: 00007FF655DA86A6
Part of subcall function 00007FF655DA8624: GlobalLock.KERNEL32 ref: 00007FF655DA86BB
Part of subcall function 00007FF655DA8624: CreateStreamOnHGlobal.COMBASE ref: 00007FF655DA86E8
Part of subcall function 00007FF655DA8624: GdipAlloc.GDIPLUS ref: 00007FF655DA86FE
Part of subcall function 00007FF655DA8624: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF655DA8769
Part of subcall function 00007FF655DA8624: GlobalUnlock.KERNEL32 ref: 00007FF655DA878C
Part of subcall function 00007FF655DA8624: GlobalFree.KERNEL32 ref: 00007FF655DA8795

Strings

], xrefs: 00007FF655DAB063

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Global$Resource$Object$AllocBitmapCreateDeleteGdipLoadLock$FindFreeFromSizeofStreamUnlock
String ID: ]
API String ID: 3561356813-3352871620
Opcode ID: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction ID: 4a900662afd2fd41e01aadeeba0b4d2bdd362051ad7edba05ad188e32c040567
Opcode Fuzzy Hash: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction Fuzzy Hash: 1311963BB0D64346FA249B21D65C27AA291AF89FC8F0C0334DD1D97B99DE2CEC45C608

Function 00007FF655DAAE1C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF655DAAE32
GetMessageW.USER32 ref: 00007FF655DAAE49
IsDialogMessageW.USER32 ref: 00007FF655DAAE60
TranslateMessage.USER32 ref: 00007FF655DAAE6F
DispatchMessageW.USER32 ref: 00007FF655DAAE7A

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction ID: 5316a2961dd079a0a0a1a219dfb9efbda25908c00754ff51166b828b5aa96703
Opcode Fuzzy Hash: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction Fuzzy Hash: CEF0C93AB2954282EB909B20E899A367361FF94B09F885735E64E95854DE2CD948CB08

Function 00007FF655DA91E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF655DA9211
SHAutoComplete.SHLWAPI ref: 00007FF655DA9255

Part of subcall function 00007FF655DA13C4: CompareStringW.KERNEL32 ref: 00007FF655DA13E3

FindWindowExW.USER32 ref: 00007FF655DA923F

Strings

EDIT, xrefs: 00007FF655DA921B, 00007FF655DA9233

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction ID: e21af97401140219ec11aad05b4b1999f4ab6743d03a01d36be64cb2e6382ed7
Opcode Fuzzy Hash: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction Fuzzy Hash: BC011767B1564381FA209B11E8187F66350BF99F48F8C1331C94D9A655EE2CD949C644

Function 00007FF655D92CE0 Relevance: 6.1, APIs: 4, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(00007FF655D98C9A), ref: 00007FF655D92D22
WriteFile.KERNEL32 ref: 00007FF655D92D6C
WriteFile.KERNELBASE ref: 00007FF655D92D9A

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 36bd0183a846d9ba9312903715bf2ef21d1db3e0abb52a3d50b28083c89a0b57
Instruction ID: 39a0f72e385216577e90e393c3a5ed5ea25d4830b39ca6ce81649e2975c54134
Opcode Fuzzy Hash: 36bd0183a846d9ba9312903715bf2ef21d1db3e0abb52a3d50b28083c89a0b57
Instruction Fuzzy Hash: D551046BA1864282FA50CB65D85877A2360FF84F98F081335EA0D97A94DF3CEC85C744

Function 00007FF655DB03E0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32 ref: 00007FF655DB0556
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DB05C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DB05C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DB05CD

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$TextWindow
String ID:
API String ID: 2912839123-0
Opcode ID: fc1dbc180cc96f95be2c8896ee01285d2f87486fd65e1fc7a35e6e120e6522b5
Instruction ID: 3f3bed421abbefb40f3ea49855a7c7ec938261087804b5ce321fb446edf3e7a5
Opcode Fuzzy Hash: fc1dbc180cc96f95be2c8896ee01285d2f87486fd65e1fc7a35e6e120e6522b5
Instruction Fuzzy Hash: BD51C467F1465284FF00ABA4D8483AD2362AF44FA8F484735DA1CA6BD9DF6CE940C708

Function 00007FF655D93684 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,00000000,?,00007FF655D9309D), ref: 00007FF655D936CE
CreateDirectoryW.KERNEL32 ref: 00007FF655D93733
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF655D9309D), ref: 00007FF655D93791
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D937CE

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: 4afa93bd4a700d257cdc7d509a41c9c5d78617ffec5cec458594de29b09af307
Instruction ID: b1188f9d6c125c2f4edf35067259acda709401eecf0637d75e594431ae816ab3
Opcode Fuzzy Hash: 4afa93bd4a700d257cdc7d509a41c9c5d78617ffec5cec458594de29b09af307
Instruction Fuzzy Hash: 6E31956FA0C68241EA609B25A46C2796371FF89FA8F580331EE9DD3795DF3CDC458608

Function 00007FF655DB2D6C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF655DB2D7B

Part of subcall function 00007FF655DB27FC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF655DB281E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF655DB2D90
__scrt_release_startup_lock.LIBCMT ref: 00007FF655DB2DFE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF655DB2E51

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction ID: c3b2e7ffc6f87bb46028ad32f7259b893a309dae3a20d2f615bb06568446e39c
Opcode Fuzzy Hash: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction Fuzzy Hash: 84314E1BE0810341FA14BBA5D45D3B92292AF41FACF4C0734D90DEB2E3DE2DAC448A4D

Function 00007FF655D92320 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF655D92927,?,00100000,?,00000001,00000000,00000000,?,00007FF655D914C1), ref: 00007FF655D92348
ReadFile.KERNELBASE ref: 00007FF655D92367
GetLastError.KERNEL32 ref: 00007FF655D9239B
GetLastError.KERNEL32 ref: 00007FF655D923BA

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction ID: cb390697892f5790ce9393c21a0f08a7af4a628af83ace34333cb37d47e27145
Opcode Fuzzy Hash: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction Fuzzy Hash: 0D21922BA0C54281EA609B91A41823963B0FB45F9CF1C4738DA5DE6A84CF7DEC858758

Function 00007FF655D9E948 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655D9ECD8: ResetEvent.KERNEL32 ref: 00007FF655D9ECF1
Part of subcall function 00007FF655D9ECD8: ReleaseSemaphore.KERNEL32 ref: 00007FF655D9ED07

ReleaseSemaphore.KERNEL32 ref: 00007FF655D9E974
CloseHandle.KERNELBASE ref: 00007FF655D9E993
DeleteCriticalSection.KERNEL32 ref: 00007FF655D9E9AA
CloseHandle.KERNEL32 ref: 00007FF655D9E9B7

Part of subcall function 00007FF655D9EA5C: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF655D9E95F,?,?,?,00007FF655D9463A,?,?,?), ref: 00007FF655D9EA63
Part of subcall function 00007FF655D9EA5C: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF655D9E95F,?,?,?,00007FF655D9463A,?,?,?), ref: 00007FF655D9EA6E

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction ID: b4cbfe8e7a9196ea4c5560834b7400f69e36bf47b0a6b3746324462f69415bcd
Opcode Fuzzy Hash: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction Fuzzy Hash: 63016D3BA14A91E2E658DB21E55866DA330FB84B84F040331DB5DA3221CF39E8B48744

Function 00007FF655D9EAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF655D9EAE0
SetThreadPriority.KERNEL32 ref: 00007FF655D9EB36

Strings

CreateThread failed, xrefs: 00007FF655D9EAEE

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction ID: 1b8574a07746401310cc98f3628f0140a1f84bc78f8b4e070db104be7ce65fef
Opcode Fuzzy Hash: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction Fuzzy Hash: 5011513BA09A4281E700DF10E849169B370FB84F8CF5C4331D64D92665DF3CE946C748

Function 00007FF655DA946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655D9DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF655D9DDDF

OleInitialize.OLE32 ref: 00007FF655DA9486
SHGetMalloc.SHELL32 ref: 00007FF655DA94D4

Strings

riched20.dll, xrefs: 00007FF655DA9475

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: b1936b3f38021c99ecd6522b050f6163774a90ef7a51b133bb98bdb322c125e4
Instruction ID: 08c95621986989f588e542da2bba16067ce8e31aafbc7fccf3cb94d7f1c8b535
Opcode Fuzzy Hash: b1936b3f38021c99ecd6522b050f6163774a90ef7a51b133bb98bdb322c125e4
Instruction Fuzzy Hash: 00F04476518A4282E7419F60F41816EB3A0FB88B58F480335E58D96B54DF7CD989CB04

Function 00007FF655DA095C Relevance: 4.7, APIs: 3, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655DA853C: GlobalMemoryStatusEx.KERNEL32 ref: 00007FF655DA856C

Part of subcall function 00007FF655D9AAE0: LoadStringW.USER32 ref: 00007FF655D9AB67
Part of subcall function 00007FF655D9AAE0: LoadStringW.USER32 ref: 00007FF655D9AB80

Part of subcall function 00007FF655D81FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D81FFB

Part of subcall function 00007FF655D8129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655D81396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DB01BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DB01C1
SendDlgItemMessageW.USER32 ref: 00007FF655DB01F2

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LoadString$Concurrency::cancel_current_taskGlobalItemMemoryMessageSendStatus
String ID:
API String ID: 3106221260-0
Opcode ID: bd759a4fa0bd9309ccea4b20fd132112b516600e79edc36bc9085e82c2e5f9f2
Instruction ID: 12c0c4aa1bb86508e12312e2ddbbe5106b84df711fe842b6d05c75c99016c8eb
Opcode Fuzzy Hash: bd759a4fa0bd9309ccea4b20fd132112b516600e79edc36bc9085e82c2e5f9f2
Instruction Fuzzy Hash: 8D519F6BF0564286EB10ABA5D4592FD2322AB85FDCF480335DE0DA77D6DE2CE944C348

Function 00007FF655D92134 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF655D921CF
CreateFileW.KERNEL32 ref: 00007FF655D9223C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D922D8

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: 0c3154c3ea30730f01a4f8c09a6becc7efe45a6579d5a839052cc1f3b70dbf60
Instruction ID: f423466009993f462cf9f9dd7ab6d365f9d1d78ee875bcb15206897b764b1462
Opcode Fuzzy Hash: 0c3154c3ea30730f01a4f8c09a6becc7efe45a6579d5a839052cc1f3b70dbf60
Instruction Fuzzy Hash: 7F41B477A0878182EB108B55E45826D63A1FB84BB8F145334DFAD67AD5CF3CE8948708

Function 00007FF655D823F8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF655D8243E
GetWindowTextW.USER32 ref: 00007FF655D82476
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D82505

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 7a493db6b2aa3cd2f88e086a9d80210bd8f4b3ce53d8088c5f8b34bcaf14f9b4
Instruction ID: a5b8d4938e1f290dd80b830f03896b5abb336358302c1293cc25460f43f9c2a7
Opcode Fuzzy Hash: 7a493db6b2aa3cd2f88e086a9d80210bd8f4b3ce53d8088c5f8b34bcaf14f9b4
Instruction Fuzzy Hash: 7A21C277A18B8181EA109B65E44417AB361FB89FE4F185335EB9C53B95CF3CD480CB04

Function 00007FF655DA1F94 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF655DA205B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF655DA2077
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF655DA2093

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 21b91969b9d64179b995d4837780b836304a3883ec3903795673f1ee3d55d581
Instruction ID: 7e2ffbe2914e7b7d3bed76469004e9fd7d2e7a81e8ded1d8b987706123a7546a
Opcode Fuzzy Hash: 21b91969b9d64179b995d4837780b836304a3883ec3903795673f1ee3d55d581
Instruction Fuzzy Hash: B031BE27A0868651EB259755E4483BA63A0FB40F88F4C4331D28DA29A9DF6CEDC6C309

Function 00007FF655D93D34 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,00000000,00000001,?,00007FF655DA07E1), ref: 00007FF655D93D5E
SetFileAttributesW.KERNEL32 ref: 00007FF655D93DB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D93E1A

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: f54af9b99a092d8e3351366c83bb5c41e52826feeb3933286249cd948367a950
Instruction ID: 64c7b04d21344095a2250b40f18de4369342ec62e36ebb349fc3f172603507d9
Opcode Fuzzy Hash: f54af9b99a092d8e3351366c83bb5c41e52826feeb3933286249cd948367a950
Instruction Fuzzy Hash: D021B827B1868181EE209B25E4692696371FFC4F98F185334EE9D96795EF2CD940CA08

Function 00007FF655D931BC Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00007FF655DA0822), ref: 00007FF655D931E7
DeleteFileW.KERNEL32 ref: 00007FF655D93237
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D932A1

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 932ad18ef346e480087a3096a192501f062bfc4628e0a3d12bdedb18b4200694
Instruction ID: d675754e618148c15a3958bfc66814b0a25c31d00a0955a48303a44b491f772d
Opcode Fuzzy Hash: 932ad18ef346e480087a3096a192501f062bfc4628e0a3d12bdedb18b4200694
Instruction Fuzzy Hash: 8221C837A1878182EE109B25F45822E6371FB85F98F541334EE9E97A95DF3CD940CB08

Function 00007FF655D932BC Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00007FF655D9E5B1,?,?,?,00000000,?), ref: 00007FF655D932E7
GetFileAttributesW.KERNELBASE ref: 00007FF655D93334
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D93399

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 85da30fe1743cc553a0db4a1375168b1f74b8b313009b96f55f923233ac5e066
Instruction ID: 0bd32340413574b8b0be98a049ab199e65bd6c4caa4acf3977ef2c6e2b9298b9
Opcode Fuzzy Hash: 85da30fe1743cc553a0db4a1375168b1f74b8b313009b96f55f923233ac5e066
Instruction Fuzzy Hash: A8217437A1868181EE109B29E4581296371FB89FA8F580331EA9D97BE5DF3CD940CB08

Function 00007FF655DBBF64 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF655DBBF48), ref: 00007FF655DBBF8C
TerminateProcess.KERNEL32(?,?,?,00007FF655DBBF48), ref: 00007FF655DBBF97
ExitProcess.KERNEL32 ref: 00007FF655DBBFA6

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction ID: 684f08cd7167887c4586b505dc8c8f64f109c71b3b64747b409eaeafe72a60f0
Opcode Fuzzy Hash: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction Fuzzy Hash: CAE0122EA0430546FA546B21989977913535F88F59F185738C84A93396CE3DEC494B04

Function 00007FF655D8F578 Relevance: 3.2, APIs: 2, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8F895
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8F89B

Part of subcall function 00007FF655D93EC8: FindClose.KERNELBASE(?,?,00000000,00007FF655DA0811), ref: 00007FF655D93EFD

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: aa1ea596e9d1cadc8f56f1dbcb820402499d9af580a35bcbf67a9d3a71afab75
Instruction ID: daa53024c433d937d7f5fbaf8177819dda47ed3d9fe75772a2e0bda3e2e478b1
Opcode Fuzzy Hash: aa1ea596e9d1cadc8f56f1dbcb820402499d9af580a35bcbf67a9d3a71afab75
Instruction Fuzzy Hash: 3391E477A18B8290FB10DF64D4482AD6361FB44B9CF481335EA4CA7ADADF78D985C305

Function 00007FF655D83904 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D83AB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D83AB9

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 059fe93b6b6045c61731c70e0e29f52abe1320b84121e6dc329f1e36eead177c
Instruction ID: de9253e4b6f646a6905feb402855caa0479386d5fae5355d75b9af8086f175ca
Opcode Fuzzy Hash: 059fe93b6b6045c61731c70e0e29f52abe1320b84121e6dc329f1e36eead177c
Instruction Fuzzy Hash: D341A267F1465185FB00EBB1D8482BD2361AF44F9CF186335DE1DB7A99DE38D8828305

Function 00007FF655D92778 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,00000F99,?,00007FF655D9274D), ref: 00007FF655D928A9
GetLastError.KERNEL32(?,00007FF655D9274D), ref: 00007FF655D928B8

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction ID: 099afe1ecf1fe050085ca1ed855527b0ad2fa749f690bd6385f0c2bfcfc3af64
Opcode Fuzzy Hash: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction Fuzzy Hash: 4231C52BB19A5282EA604B6AD9586F92364AF04FDCF1C0331DE1DA7790DF3CDC818645

Function 00007FF655D822BC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF655D822F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D823F0

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: 3846a219fa003ef6eba4311ff2349970a98922bd5935619b32e66c41ec2b6e9c
Instruction ID: fbd332fd7091a23d65c5d4215f7b13ab565be90d534c14af3e01d5ad2be1aa43
Opcode Fuzzy Hash: 3846a219fa003ef6eba4311ff2349970a98922bd5935619b32e66c41ec2b6e9c
Instruction Fuzzy Hash: 9C31F027A1874282EA109B55F45836EB361EB84F98F485335EB9C57B95DF3CE8408708

Function 00007FF655D92AD0 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF655D92AFE
SetFileTime.KERNELBASE ref: 00007FF655D92B9B

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction ID: 6e62ad240d2f00749348afe899d3d936aaf39420e817b94a7299600e08141720
Opcode Fuzzy Hash: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction Fuzzy Hash: 1021B227E09B4291EA628E91D4297BA57F0AF01F9EF194331DE4C56299EE3CDD86C304

Function 00007FF655D9AAE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF655D9AB67
LoadStringW.USER32 ref: 00007FF655D9AB80

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction ID: c443855d0e4e6e1e63ea1f571726795a14b84dd9de5aa62c75f3b0dbe4c8af5b
Opcode Fuzzy Hash: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction Fuzzy Hash: 7511517AB0964286E600CF16A848169B7A1BB88FD8F5C4735CA0DE3B20DE7CE9418348

Function 00007FF655D92BB0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF655D92C11
GetLastError.KERNEL32 ref: 00007FF655D92C1E

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction ID: 303b28b7835ad3f706b78b48f87cf8371469b7457c5c34d994d7ad33531da644
Opcode Fuzzy Hash: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction Fuzzy Hash: A0116027A0864281EB608B65E8586796260FB45FBCF5C4331DA7DE62D4CF3CED82C344

Function 00007FF655D8255C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655D9A4AC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF655D9A504
Part of subcall function 00007FF655D9A4AC: SetDlgItemTextW.USER32 ref: 00007FF655D9A573
Part of subcall function 00007FF655D9A4AC: GetWindowRect.USER32 ref: 00007FF655D9A5AD
Part of subcall function 00007FF655D9A4AC: GetClientRect.USER32 ref: 00007FF655D9A5BB

GetDlgItem.USER32 ref: 00007FF655D825AC
SetWindowTextW.USER32 ref: 00007FF655D825C8

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ItemRectTextWindow$Clientswprintf
String ID:
API String ID: 3322643685-0
Opcode ID: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction ID: ed7f6e68143d99139e92b37f7b11bbb0d644296b84e54067a0d554beca808a98
Opcode Fuzzy Hash: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction Fuzzy Hash: 6E01751AA4D28B81FF555B91A46C27963929F45F4CF0C1375C84DA6AD9DE2CEC88C309

Function 00007FF655D9EB58 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF655D9EBAD,?,?,?,?,00007FF655D95752,?,?,?,00007FF655D956DE), ref: 00007FF655D9EB5C
GetProcessAffinityMask.KERNEL32 ref: 00007FF655D9EB6F

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction ID: 42c0b9f043829ef706958857f65bd602c86b815d02148e5d67c6a84051aca578
Opcode Fuzzy Hash: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction Fuzzy Hash: E0E0E566B1454646DB098F55C4549A963A2FF88F48F888235D60BD3614DE2CE9498B00

Function 00007FF655DB21D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655DB2200

Part of subcall function 00007FF655DB2F7C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF655DB2F85

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655DB2206

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 14867973fed18b2c44dc58e1bcd5f94848bfca26dcf41195b9c376eff134a452
Instruction ID: 0cced537a7ce37d3fa58467a3e8a434720c3196ba92268232fe76e2cd26e9342
Opcode Fuzzy Hash: 14867973fed18b2c44dc58e1bcd5f94848bfca26dcf41195b9c376eff134a452
Instruction Fuzzy Hash: 3EE0EC4BE0B10745FD1832E6982D1B900524F19FB8E5C5730DA3EE46D6AD1CAC958A18

Function 00007FF655DBD90C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF655DBD922
GetLastError.KERNEL32 ref: 00007FF655DBD934

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction ID: f22859bb4cdfd165b8831060a9ab0b631887a451e425d3f3c76fb0d34de98131
Opcode Fuzzy Hash: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction Fuzzy Hash: 62E0BF5AE0954786FF18BBB2984D6B413925F94F69B0C4334C90EE6252EE2CAD858A08

Function 00007FF655D833E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8388C

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: bdf8625448bd8dcd1def64a6508c1891a019ebdf0eaa44acf70db7eea19c6d5a
Instruction ID: 04a7d3ce75df96c457c3b89a4b2ef8fc141c6005d200f647d22d6129e2cf3ac4
Opcode Fuzzy Hash: bdf8625448bd8dcd1def64a6508c1891a019ebdf0eaa44acf70db7eea19c6d5a
Instruction Fuzzy Hash: A2D1C86BB0868156EB288B2599582B967A1FB05F88F0C1335CF1D977A1CF38EC658706

Function 00007FF655D95294 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D9551B

Part of subcall function 00007FF655DA13F4: CompareStringW.KERNEL32 ref: 00007FF655DA145A

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1017591355-0
Opcode ID: cc14dedd2e5cc10f866aa6caa5d21262f0f150b8de9e36933eecb23af5082f8f
Instruction ID: 4032643d82051cce544f3aefefe8def66906cfe591fb5ce7e44d49672b06d710
Opcode Fuzzy Hash: cc14dedd2e5cc10f866aa6caa5d21262f0f150b8de9e36933eecb23af5082f8f
Instruction Fuzzy Hash: B061E45BE0C64781FAA4AA15A42C27A53A1AF41FDCF5C4331DE4DE6AC5EE7CEC418209

Function 00007FF655DA1870 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655D9E948: ReleaseSemaphore.KERNEL32 ref: 00007FF655D9E974
Part of subcall function 00007FF655D9E948: CloseHandle.KERNELBASE ref: 00007FF655D9E993
Part of subcall function 00007FF655D9E948: DeleteCriticalSection.KERNEL32 ref: 00007FF655D9E9AA
Part of subcall function 00007FF655D9E948: CloseHandle.KERNEL32 ref: 00007FF655D9E9B7

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA1ACB

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteReleaseSectionSemaphore_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 904680172-0
Opcode ID: f80fe9d0374425f4e8acb8f242997014f41c4e78deea76494bb41970906826f3
Instruction ID: a5a0d94c1f9a08e48b2d8b3e693993611a6fa0dc03685b4212d8a4f7d847193c
Opcode Fuzzy Hash: f80fe9d0374425f4e8acb8f242997014f41c4e78deea76494bb41970906826f3
Instruction Fuzzy Hash: 4461F077B05785A2EE08DBA5D1580BD7365FB40F98F584332D72D97AC5CF28E8618308

Function 00007FF655D8EC9C Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8EEB8

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 90bbbe4b03adee6de0a9cfeccf93459ff6427d4f8da8a47d00f3fc41b718dbf5
Instruction ID: 58b26908faf98ba34e6fc8485b6cdd7bbf0706fdeafcf3e8690234346957dda2
Opcode Fuzzy Hash: 90bbbe4b03adee6de0a9cfeccf93459ff6427d4f8da8a47d00f3fc41b718dbf5
Instruction Fuzzy Hash: 3551D46BA0868290FA119B25D4483B96761FB85FDCF4C1336DE4DA7392CE3DE885C709

Function 00007FF655D8E7A8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655D93EC8: FindClose.KERNELBASE(?,?,00000000,00007FF655DA0811), ref: 00007FF655D93EFD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8E993

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: a98b459d02bd845be10ee4858e1a476889abeecdc2f1b3a80362524ddef0ea38
Instruction ID: 513011c640e62ce9220ebb0243b19243b7c2f72ec25d9f3da29a6fc329eb619b
Opcode Fuzzy Hash: a98b459d02bd845be10ee4858e1a476889abeecdc2f1b3a80362524ddef0ea38
Instruction Fuzzy Hash: FF517127A0868681FF609F25D44936D6361FB84F88F481336DA9DA76A5CF2CD841CB1A

Function 00007FF655D91794 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D9187D

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 2a7259d764eb0786ebfe04c0f82892bddeea34df329c5f9a795040d30637ea4b
Instruction ID: a99745e78601dcbc3985f310b599bbdc1f91475e08f6930261a83e26c17eec98
Opcode Fuzzy Hash: 2a7259d764eb0786ebfe04c0f82892bddeea34df329c5f9a795040d30637ea4b
Instruction Fuzzy Hash: 83412967B18A8142EE149A53E6183BAA261FB44FC4F4C8735EE5C97F4ADF3CD8518304

Function 00007FF655D92F58 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D930C8

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: ef3369d01a97c9aa4f3b4977493ba9f0ef8ebed8b0182d05534ad700cb30ef07
Instruction ID: 470194e0bbf48863bf386ddcc1bf545abea94a0e38271aac5287efee04222116
Opcode Fuzzy Hash: ef3369d01a97c9aa4f3b4977493ba9f0ef8ebed8b0182d05534ad700cb30ef07
Instruction Fuzzy Hash: 0741D16BA08A4581EE109F29E5693792371EB85FDCF081334EE4D97699DE3DE8808708

Function 00007FF655DBBDF8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF655DBBE20

Part of subcall function 00007FF655DBBFB0: GetModuleHandleExW.KERNEL32 ref: 00007FF655DBBFD0
Part of subcall function 00007FF655DBBFB0: GetProcAddress.KERNEL32 ref: 00007FF655DBBFE6
Part of subcall function 00007FF655DBBFB0: FreeLibrary.KERNEL32 ref: 00007FF655DBC00B

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction ID: d0e893894f7979dc3b507a431b2d6da47ce11573bc0f8fcfd95be9e560c896f9
Opcode Fuzzy Hash: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction Fuzzy Hash: 2841A13BA1861386FB14AB11D8581786252AF54F58F4C8736DA0EF76A1CF3EEC40CB48

Function 00007FF655D8129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655D81396

Part of subcall function 00007FF655D81F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF655D81F89

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: 9aea57e1cbc1acb0343bc23020ebe7367b53934ade50ddaffc586ce89fb7cfd6
Instruction ID: 4fe895deac073d0b3a93c66793edf64264b274df2c710c870748d45d408584d1
Opcode Fuzzy Hash: 9aea57e1cbc1acb0343bc23020ebe7367b53934ade50ddaffc586ce89fb7cfd6
Instruction Fuzzy Hash: 2521A127E0825185EA149B92A4082796250EB05FF4F6C1B30DE3DA7BC1DE7CE8518309

Function 00007FF655DC124C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF655DC1280

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction ID: 11454535fe2ae087b1bf2a0ca10c0d3701f576db5a6d41fd0c5e7eb6300aea84
Opcode Fuzzy Hash: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction Fuzzy Hash: 44113A2F91D653C6FA109B90E449639B2A5FB40B88F580335E68EE6695DF2CEC008B08

Function 00007FF655D83AD8 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D83B6C

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: e211765aad0e482f14211f193c2fa738a397cbf9b51fc622cf430de4bdc09e7c
Instruction ID: 9e1b4d81012d82fee40a12f7dd4cf60adb733a1486095992db5f2b00159146ae
Opcode Fuzzy Hash: e211765aad0e482f14211f193c2fa738a397cbf9b51fc622cf430de4bdc09e7c
Instruction Fuzzy Hash: 8401DBA7E1878581FE119728E84922D7361FFC5FA9F485331EA9C577A5DF2CE4408708

Function 00007FF655DB1558 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF655DB1604: GetModuleHandleW.KERNEL32(?,?,?,00007FF655DB1573,?,?,?,00007FF655DB192A), ref: 00007FF655DB162B

DloadProtectSection.DELAYIMP ref: 00007FF655DB15C9

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction ID: 173680f6c7c9cf6944043b8f6b3a7fe8c7ad40a62e0d08a67c3b204db5bd5aec
Opcode Fuzzy Hash: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction Fuzzy Hash: B811BE6BD0860781FB51AB45E85C37063A1AF14B5DF1C0734C90EE62A1EF3CAD968A08

Function 00007FF655D83BC0 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D83C3D

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: f404972482886fbac3784b7dd97a2e42dd32aefabf754c4576d9ee251be09c6c
Instruction ID: c9ef417e6a800fac6b2e7a067f60b72f95a130e67eafd108b289e419ee823ffc
Opcode Fuzzy Hash: f404972482886fbac3784b7dd97a2e42dd32aefabf754c4576d9ee251be09c6c
Instruction Fuzzy Hash: D2015A77704B8495DA04DF15E44826E7364FB48FC8F688635EB9C47B19DF38D8A08744

Function 00007FF655D93EC8 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655D940BC: FindFirstFileW.KERNELBASE ref: 00007FF655D9410B
Part of subcall function 00007FF655D940BC: FindFirstFileW.KERNELBASE ref: 00007FF655D9415E
Part of subcall function 00007FF655D940BC: GetLastError.KERNEL32 ref: 00007FF655D941AF

FindClose.KERNELBASE(?,?,00000000,00007FF655DA0811), ref: 00007FF655D93EFD

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction ID: ebe788a978279e2b750a924875e70db661b94d4284f2daa1ef318633b77b5cf3
Opcode Fuzzy Hash: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction Fuzzy Hash: 49F0AF6790828185EA50AF75A12827937709B1AFB8F1C1339EE3D572C7CE28D8848748

Function 00007FF655D81FA0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D81FFB

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 6bde38596525897290305d6296ffc8faf1d7b5cacafae584a3307f91b76bcc97
Instruction ID: 6bed8e7036947606c1b5ff9d365fa1d853ca78c767767b785536d8bbdc3a837d
Opcode Fuzzy Hash: 6bde38596525897290305d6296ffc8faf1d7b5cacafae584a3307f91b76bcc97
Instruction Fuzzy Hash: EAF0BEABB1068980EE189BA9C08C36C2362EB04F8CF581635C70C8BA55DF6CD884C309

Function 00007FF655D9273C Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF655D92755

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 182d9e1e92039184aab4081fafd09b1cf385b4bd914a3c272b872952a66d9790
Instruction ID: a2c5cb68ab2654f482d19ec9efeb2b356db108ffe199efc7cdd5e01780be8c6b
Opcode Fuzzy Hash: 182d9e1e92039184aab4081fafd09b1cf385b4bd914a3c272b872952a66d9790
Instruction Fuzzy Hash: 10E0CD1FB2051581EF209B76C8555741330EF4CF89F4C1230CE0C57321CF28CC818644

Function 00007FF655D92490 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF655D924A2

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction ID: aed268fcf87c59186f2303a9be5fd00f4eaad428f32628fd1695cc6ced86c326
Opcode Fuzzy Hash: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction Fuzzy Hash: 21D0121BD0945182DD1097759C6503C2360AFA2B3DFA80730D63EE16E1CF1D98D6A719

Function 00007FF655D97FC4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF655D97FD2

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction ID: a82955f656e8d712903fb98f9ab549ebc5c0f9341e289a9021c9f2f415534f4c
Opcode Fuzzy Hash: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction Fuzzy Hash: 4BC08C26F05502C1DE085B26C8CD01813A4BB40F08F684334D10CE1120CF2CC8EAA349

Function 00007FF655DBFA04 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF655DBFA59

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction ID: 3e18fb642c900b5d2673610076f46e51ba259cc7a0f883dca5ba39822491a79f
Opcode Fuzzy Hash: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction Fuzzy Hash: 7CF0629FB0A20745FE58BB61D5193B492925F49F6CF0C5730C90DE63C1ED2CED814A18

Function 00007FF655D920D0 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000001,00007FF655D9207E), ref: 00007FF655D920F6

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction ID: 0fd32b66e4e408040b0c69566a81b00e2da193c9edb36a0b4028c247f667105a
Opcode Fuzzy Hash: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction Fuzzy Hash: 9EF08C27A0968285FB248B60E45927D6670EB14F7CF4C5334D73CA11D4CF28DCA68308

Function 00007FF655DBD94C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF655DBD98A

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction ID: 0e7cd2ed0d93c801199799b9c8c7b3878d18ba47205de269b0a9d2dd2cbae05b
Opcode Fuzzy Hash: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction Fuzzy Hash: 91F0341BA0920B85FF147AA198093B413925F88FB8F4C5730D92EE62C1DE2CAC808A18

Non-executed Functions

Function 00007FF655D8C2F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 754fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655D8DE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF655D8CF4B), ref: 00007FF655D8DE27
Part of subcall function 00007FF655D8DE04: GetLastError.KERNEL32 ref: 00007FF655D8DE88
Part of subcall function 00007FF655D8DE04: CloseHandle.KERNEL32 ref: 00007FF655D8DE9B

wcscpy.LIBCMT ref: 00007FF655D8CBC8
wcscpy.LIBCMT ref: 00007FF655D8CBFE
CreateFileW.KERNEL32 ref: 00007FF655D8CC38
DeviceIoControl.KERNEL32 ref: 00007FF655D8CD01
CloseHandle.KERNEL32 ref: 00007FF655D8CD12
GetLastError.KERNEL32 ref: 00007FF655D8CD2E
RemoveDirectoryW.KERNEL32 ref: 00007FF655D8CD7D
DeleteFileW.KERNEL32 ref: 00007FF655D8CD88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8CE89
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8CE8F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8CE9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8CEA1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8CEAD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8CEB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8CEB9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8CEBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8CEC5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8CECB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8CED1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8CED7

Strings

SeRestorePrivilege, xrefs: 00007FF655D8C343
SeCreateSymbolicLinkPrivilege, xrefs: 00007FF655D8C34F
UNC\, xrefs: 00007FF655D8C53F, 00007FF655D8C55D
\??\, xrefs: 00007FF655D8C392, 00007FF655D8C3B8

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseErrorFileHandleLastwcscpy$ControlCreateCurrentDeleteDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2659423929-3508440684
Opcode ID: 86f3f34dae19e3e49c29d340f54b39a2d4150e9680d4af69a4817d617f67abfd
Instruction ID: a19bf9b2609ad3ef2308900f9a4dc89c53408db323e164d7ea07c3718d36b07e
Opcode Fuzzy Hash: 86f3f34dae19e3e49c29d340f54b39a2d4150e9680d4af69a4817d617f67abfd
Instruction Fuzzy Hash: F862C367F0864685FB00DBB4D4483BD2361AB45BACF185331DA6CA7AE5DF38D985C309

Function 00007FF655D9F180 Relevance: 43.2, APIs: 22, Strings: 2, Instructions: 1205COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF655DA0528

Part of subcall function 00007FF655D9AAE0: LoadStringW.USER32 ref: 00007FF655D9AB67
Part of subcall function 00007FF655D9AAE0: LoadStringW.USER32 ref: 00007FF655D9AB80

Part of subcall function 00007FF655DAB0DC: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF655DA0429), ref: 00007FF655DAB110
Part of subcall function 00007FF655DAB0DC: SetLastError.KERNEL32 ref: 00007FF655DAB153

Part of subcall function 00007FF655D8129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655D81396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA0490
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA0496
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA049C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA04A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA04A8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA04AE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA04B4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA04BA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA04C0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA04C6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA04CC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA04D2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA04D8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA04DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA04E4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA04EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA04F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA04F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA0532
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA0538

Strings

%ls, xrefs: 00007FF655D9F3AC, 00007FF655D9F3FF
%s: %s, xrefs: 00007FF655D9FC11

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastLoadString$Concurrency::cancel_current_taskInit_thread_footer
String ID: %ls$%s: %s
API String ID: 2539828978-2259941744
Opcode ID: ef8e59e36bf08a375103cf1b32b99524ab9e1731f1fb18bcb0ac3a481f952996
Instruction ID: 5eb749afb575a75b4ccbc7c054e62836507611191ecc59e123e7afc85c0de71e
Opcode Fuzzy Hash: ef8e59e36bf08a375103cf1b32b99524ab9e1731f1fb18bcb0ac3a481f952996
Instruction Fuzzy Hash: E7B2DD77A1868281EA109725D4582BF6321FFC5BD8F184336E69DA3BD6DF6CE940C708

Function 00007FF655DC2550 Relevance: 22.3, APIs: 8, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF655DC2C12
memcpy_s.LIBCMT ref: 00007FF655DC35BF
memcpy_s.LIBCMT ref: 00007FF655DC3666

Part of subcall function 00007FF655DC38BC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF655DC38EE

memcpy_s.LIBCMT ref: 00007FF655DC372F

Part of subcall function 00007FF655DBD008: _invalid_parameter_noinfo.LIBCMT ref: 00007FF655DBD02D

Strings

1#QNAN, xrefs: 00007FF655DC37E8
1#INF, xrefs: 00007FF655DC3807
1#SNAN, xrefs: 00007FF655DC37C9
1#IND, xrefs: 00007FF655DC37AA

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 1759834784-2761157908
Opcode ID: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction ID: b676b6959eea9b42e089dc321639b33fede2f55aeba15f9b6da2ca2938e9d855
Opcode Fuzzy Hash: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction Fuzzy Hash: 31B2C77BA081828AE7658E69D4487FD37A1FB44B8CF585335DA09A7B84DF38ED048B44

Function 00007FF655D91A48 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 375fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF655D91A97
GetLongPathNameW.KERNEL32 ref: 00007FF655D91AE0
GetShortPathNameW.KERNEL32 ref: 00007FF655D91B21
GetShortPathNameW.KERNEL32 ref: 00007FF655D91B6A

Part of subcall function 00007FF655DA13C4: CompareStringW.KERNEL32 ref: 00007FF655DA13E3

MoveFileW.KERNEL32 ref: 00007FF655D91DFE
MoveFileW.KERNEL32 ref: 00007FF655D91E65

Part of subcall function 00007FF655D92134: CreateFileW.KERNEL32 ref: 00007FF655D9223C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D91FE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D91FE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D91FED

Strings

rtmp, xrefs: 00007FF655D91CF4, 00007FF655D91D03

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: NamePath$File_invalid_parameter_noinfo_noreturn$LongMoveShort$CompareCreateString
String ID: rtmp
API String ID: 3587137053-870060881
Opcode ID: e1af406d9dd90cab9ebde2dc7b257a9c18519fdc4ea1c1791790fdf5b4aa1268
Instruction ID: 20cfd202510244479cf3811f2f1e34e1ce1afdcbe51daf3bd9292e7342a52ea0
Opcode Fuzzy Hash: e1af406d9dd90cab9ebde2dc7b257a9c18519fdc4ea1c1791790fdf5b4aa1268
Instruction Fuzzy Hash: 6FF1F427B08A4281EB00DBA5D4581BD6771FB85BC8F581335EA4DE3AA9DF3CD884C748

Function 00007FF655D95B60 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF655D95BC2
GetFullPathNameW.KERNEL32 ref: 00007FF655D95C0E
GetFullPathNameW.KERNEL32 ref: 00007FF655D95D2B
GetFullPathNameW.KERNEL32 ref: 00007FF655D95D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D95EE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D95EE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D95EEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D95EF2

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: 42882c5e1b64cf364603feffb0a4dffa6fd5e54fa856c7804417c031547eb997
Instruction ID: 970b178cddb855b7498b68fd2faa0834862bfd5f79e5f53f7069716b7291fdac
Opcode Fuzzy Hash: 42882c5e1b64cf364603feffb0a4dffa6fd5e54fa856c7804417c031547eb997
Instruction Fuzzy Hash: 21A1C467F15A5184FE108BB9C8581BD2371AF45FE8B185335DE2DA7BC4DE3CE8818248

Function 00007FF655DB3170 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF655DB318C
RtlCaptureContext.KERNEL32 ref: 00007FF655DB31B9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF655DB31D3
RtlVirtualUnwind.KERNEL32 ref: 00007FF655DB3214
IsDebuggerPresent.KERNEL32 ref: 00007FF655DB3268
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF655DB3289
UnhandledExceptionFilter.KERNEL32 ref: 00007FF655DB3294

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction ID: 3e7866c5b8085a623aa50da1ebfcd51bbfe0be9d0faec87c0c99710bed6ccdbb
Opcode Fuzzy Hash: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction Fuzzy Hash: FD317277609B818AEB609F60E8547ED3365FB84B48F484239DA4D97B88DF3CD948CB04

Function 00007FF655DB76D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF655DB7751
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF655DB7769
RtlVirtualUnwind.KERNEL32 ref: 00007FF655DB77A4
IsDebuggerPresent.KERNEL32 ref: 00007FF655DB77DD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF655DB77E7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF655DB77F2

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction ID: 9dfac987894566ff78b56343755f37dc29e901effedd8a140e27363546465a8f
Opcode Fuzzy Hash: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction Fuzzy Hash: DB31943B608B8186D7609F24E8446AE33A1FB84B58F540335EE8D93B94DF3CD545CB04

Function 00007FF655D81AA4 Relevance: 6.3, APIs: 4, Instructions: 285COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D81EA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D81EAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D81EB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D81EBB

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 47fe9767bcb5ae1d9a882eaa5a8596545d0350934ab6dbf56b44417d7b0c6152
Instruction ID: ee8def34ed67b06f2080e10d4e26537b1700e61f31e4098ced69b823d1ad2854
Opcode Fuzzy Hash: 47fe9767bcb5ae1d9a882eaa5a8596545d0350934ab6dbf56b44417d7b0c6152
Instruction Fuzzy Hash: BCB1FA6BB14A8686EB109BA5D8482ED2361FF85B9CF482331DA4CA77D5DF3CD944C308

Function 00007FF655DBFA94 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF655DBFAC4

Part of subcall function 00007FF655DB7934: GetCurrentProcess.KERNEL32(00007FF655DC0CCD), ref: 00007FF655DB7961

Strings

., xrefs: 00007FF655DBFEE4
*?, xrefs: 00007FF655DBFAEB

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction ID: 0931147da4d08bd54197dc947c97eb648ba5dfb11d94a36cb46048df51807c51
Opcode Fuzzy Hash: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction Fuzzy Hash: 3751E46BB14A5681EF10EF62D4544B8A3A2FB48FECB484731DE5DA7B84DE3CD8418708

Function 00007FF655DC2080 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF655DC210B

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction ID: 63669398bd5ec0f5e0ee5861cc67c5284951ec64d25227e81dc062463475162a
Opcode Fuzzy Hash: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction Fuzzy Hash: 30D19437B1928687D724CF55A18866AB691F798B48F188334DB8EA7B44DF3CEC41CB04

Function 00007FF655D8B6D8 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF655D8BA9D), ref: 00007FF655D8B6E5
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF655D8BA9D), ref: 00007FF655D8B719
LocalFree.KERNEL32(?,?,?,?,?,?,?,00007FF655D8BA9D), ref: 00007FF655D8B743

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction ID: e7ead6fcc9a331151209f9548ca433bf39864c79436f046aecefa0c13b68a4bb
Opcode Fuzzy Hash: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction Fuzzy Hash: F901447760C74182E7109F12B85457A6391FB89FC4F0C5234DA8D97B45CF3CD9459705

Function 00007FF655DBFCA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF655DBFEE4

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction ID: e2501cf829a0526194e26055ec67edc2046b92deb2fe2b8eef9054cea3b86107
Opcode Fuzzy Hash: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction Fuzzy Hash: E7313B27B0869145F760AB36D8087B9AA92EB44FF8F088335DE5C97BC5CE3CD9018704

Function 00007FF655DC5AF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF655DC5D45
RaiseException.KERNEL32 ref: 00007FF655DC5D56

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction ID: caf122ea3478b06bf343431e71adcbe63ed1140ea5c696667e5ab5c215999447
Opcode Fuzzy Hash: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction Fuzzy Hash: 88B14A77611B898AEB15CF29C84A36C3BA0F744F8CF198A21DA5D977A8CF39D851C704

Function 00007FF655DA8DF4 Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655DA85E0: GetDC.USER32 ref: 00007FF655DA85EC
Part of subcall function 00007FF655DA85E0: GetDeviceCaps.GDI32 ref: 00007FF655DA85FD
Part of subcall function 00007FF655DA85E0: ReleaseDC.USER32 ref: 00007FF655DA860A

GetObjectW.GDI32 ref: 00007FF655DA8E48

Part of subcall function 00007FF655DA90B0: GetDC.USER32 ref: 00007FF655DA90D9
Part of subcall function 00007FF655DA90B0: GetObjectW.GDI32 ref: 00007FF655DA9107
Part of subcall function 00007FF655DA90B0: ReleaseDC.USER32 ref: 00007FF655DA91BB

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID:
API String ID: 1061551593-0
Opcode ID: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction ID: a919cce647419c62bcecde389eef7816e4b2f3acaea125d1a08314df0ce1112d
Opcode Fuzzy Hash: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction Fuzzy Hash: AD81283BB18A1586EB208F6AD4586AD7771FB88F88F044222DE0DA7B24DF39D945C744

Function 00007FF655DAA2CC Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF655DAA315
GetNumberFormatW.KERNEL32 ref: 00007FF655DAA371

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction ID: 220b5271020f780e6e9d7014b852c92c5709b727f56486880e3042eed29bcdc6
Opcode Fuzzy Hash: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction Fuzzy Hash: 9D11383BA08B8195E7618B11E8146AA7360FF88B48F884335DA4D93764DF3CA945CB48

Function 00007FF655D9126C Relevance: 1.7, APIs: 1, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655D924C0: CreateFileW.KERNELBASE ref: 00007FF655D9259B
Part of subcall function 00007FF655D924C0: GetLastError.KERNEL32 ref: 00007FF655D925AE
Part of subcall function 00007FF655D924C0: CreateFileW.KERNEL32 ref: 00007FF655D9260E
Part of subcall function 00007FF655D924C0: GetLastError.KERNEL32 ref: 00007FF655D92617

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D915D0

Part of subcall function 00007FF655D93980: MoveFileW.KERNEL32 ref: 00007FF655D939BD
Part of subcall function 00007FF655D93980: MoveFileW.KERNEL32 ref: 00007FF655D93A34

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: File$CreateErrorLastMove$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 34527147-0
Opcode ID: e551f5cd72cc32021c0545c09a5d852fa8adbb9b535e4bd48ae0dc113e77b3ec
Instruction ID: 6de402d1ac18da19498d9203fa1301ea8a40503380bc0e3dee13a7cb37c42202
Opcode Fuzzy Hash: e551f5cd72cc32021c0545c09a5d852fa8adbb9b535e4bd48ae0dc113e77b3ec
Instruction Fuzzy Hash: 6E91C02BB1864282EB50DBA2D4582AD6371FB54FC8F485332EE0DA7B95DE38D945C704

Function 00007FF655D951A4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF655D951D5

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 6220f8f0736b52f52a4f9f0684f7fcd1da0b773ba531a70ae5974f71c0de4052
Instruction ID: c9cfa48701ec88cf247583d98cd6807f64ee4e78b411d8925d4c1fe69976366a
Opcode Fuzzy Hash: 6220f8f0736b52f52a4f9f0684f7fcd1da0b773ba531a70ae5974f71c0de4052
Instruction Fuzzy Hash: C301137BA086428BF7248B10E85877A72A1FB98B58F580334D65DA2790DF3CF8008E08

Function 00007FF655DB8C1C Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF655DB8DD3

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction ID: e33ff00c4520b450ff3442af17f58cfbe177768b735ae8a512b05a8d21d87c55
Opcode Fuzzy Hash: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction Fuzzy Hash: A481E72BA182424AEAA4AA15C04867D2292EF50F6CF5C1736DD09F7795CF3EEC45CF48

Function 00007FF655DB89A0 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF655DB8B3A

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction ID: 4f436d3f6533f2e98c1f5c416f591fb278f587a8ddfb30d355668646241d5cfc
Opcode Fuzzy Hash: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction Fuzzy Hash: B571E69BA0C28246EB64AA25C04827D67A29F41F6CF1C1735CD09F76D6CE2DEC468F4D

Function 00007FF655D9C96C Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

gj, xrefs: 00007FF655D9C97B

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction ID: 1afd4ab6ff48ba90891a1a0a15351c6dc41f8a30dddd75dc7fe194609ea63da1
Opcode Fuzzy Hash: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction Fuzzy Hash: CC5191377286908BD754CF25E404A9EB3A5F388758F445226EF4A93B05CB3DE945CF40

Function 00007FF655DBC838 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF655DBC874

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction ID: 470e5ef5fbd2c68f15365652f3f1960c868d1716d3d493770d463189a8c1441c
Opcode Fuzzy Hash: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction Fuzzy Hash: 0D41BB37714A4986EF04DF2AE5182A973A2B748FD8B4D9236DE0DA7764DE3CD842C704

Function 00007FF655DC0D20 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF655DC0D24

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction ID: 1170403f3da3340da39c49d94010967cf413b0146d0dc04008f2ebb97f8f7ec6
Opcode Fuzzy Hash: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction Fuzzy Hash: 8AB09229E17A06C2EA082B116C8A29422A4BF48B04F989238C10CE1320DE3C28AA4704

Function 00007FF655DA3964 Relevance: .9, Instructions: 931COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e830777a8553980f5fe243353a36f6d8d27a5fc8052bc9569f2c684e316ecf
Instruction ID: f77cd53d95847caf72bc9e23e8f6e534157d89c7fe8f91d8750911888c5e4719
Opcode Fuzzy Hash: 93e830777a8553980f5fe243353a36f6d8d27a5fc8052bc9569f2c684e316ecf
Instruction Fuzzy Hash: E082DFBBA096C186D715CE28D4082BD7BA2E755F88F1D833ACE4A97786DE3CD845C314

Function 00007FF655D876C0 Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction ID: 582a8a6971b7101303946b7fa4c12723c434b59456113e2097f48a7e13759505
Opcode Fuzzy Hash: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction Fuzzy Hash: FA627D9AD3AF9A1EE303A53954131D2E35C0EF74C9551E31BFCE431E66EB92A6832314

Function 00007FF655DA53F0 Relevance: .9, Instructions: 891COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569adc29ececf777b1726fc3f5cd67d4b9927b4b604ee9515eb09b13eba64041
Instruction ID: 4099ce18ba71148ea11b6c6514abe9f9e122b866c67ca7385c114247b40c37c9
Opcode Fuzzy Hash: 569adc29ececf777b1726fc3f5cd67d4b9927b4b604ee9515eb09b13eba64041
Instruction Fuzzy Hash: FF82F1BBA096C18ADB24CE24D4486FD7BA1E755F88F088336CA4D97789DE3CD885C714

Function 00007FF655D9BB90 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction ID: 343b91b916cca0e1674adbc058789550d2d528dfdfcb889cef1c3487b68ad94f
Opcode Fuzzy Hash: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction Fuzzy Hash: 3E22E477B246508BD728CF25C89AE5E3766F798748B4B8228DF0ACB785DB38D505CB40

Function 00007FF655DA4B98 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction ID: ad78243f7c1170ddae81740b7f98bd514e8b9eca4fc6857278f986889b629759
Opcode Fuzzy Hash: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction Fuzzy Hash: 8332CE77A041918BE7188F24D558ABD37A1F754B48F098339DA4AA7B88DF3CEC51C744

Function 00007FF655D87288 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction ID: 945d022247b33673737396859920b77fa20413c338a92f9ae136bf9ba997c158
Opcode Fuzzy Hash: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction Fuzzy Hash: B7C1AEB7B281908FE350CF7AE400A9D3BB1F39878CB555225DF59A3B09D639DA45CB40

Function 00007FF655DA2D58 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction ID: 3f840d13d82276e42602f16098551fbe9aee52a3f8648eba9278f77b56690ea0
Opcode Fuzzy Hash: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction Fuzzy Hash: 71A13677A0818146EB25DA66D4087BE2692EB90B4CF0D4735DE49A7B86CE3CEDC1C308

Function 00007FF655D9AF18 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction ID: 83e17b1bafa8e9b1dc549331561ae6a2d6b6aae58f088d97855e49223888c7cb
Opcode Fuzzy Hash: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction Fuzzy Hash: F8C10577A291E04DF302CBB5A4348FD3FB1E71E74DB4A4252EF9666B4AC6285201DF20

Function 00007FF655D8A310 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction ID: 47ad2da55cc0bd9aca2305fab5176670ef9659e64bb26affbefbfc7f7e0408a5
Opcode Fuzzy Hash: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction Fuzzy Hash: 90912167B1858196EB11DF29D4542FD2721FB95B8CF481331EE4EA7B49EE38EA06C700

Function 00007FF655D9B534 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction ID: ffcad084d716644d761b51447f423803c5834fb82963199fa5de18077627197b
Opcode Fuzzy Hash: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction Fuzzy Hash: E461F43BB181D149FB018F7585284FD7FB1A749B88B4A8332CE99A7646CE38E905CB14

Function 00007FF655DA21D0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction ID: a067c1164cdcc39853c3ba6abf49e8f5031ac7bfbc20f1660d44f3a1bfd6b82b
Opcode Fuzzy Hash: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction Fuzzy Hash: 07510173B181514BE7288F6AD0087AE3762FB90F58F484334DB4997688DE3DE985CB04

Function 00007FF655DA2AB0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction ID: 455557a9ba992a7cb93275322b282f45f5ebbdf51b8c263b149a067cb9ceab47
Opcode Fuzzy Hash: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction Fuzzy Hash: 8C31D2B3A086814BD718DE66D6A42BE77A1B744B49F088239DF4AD3B46DE3CE841C700

Function 00007FF655DC58E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20052d42666034676028b01d15d2cffdefdd266dec7e2dd0f98b8d8f07818195
Instruction ID: faaaf21ae4d932b86455fa799a3b32338cf42dfa95f6189fa71434ce9c7624e5
Opcode Fuzzy Hash: 20052d42666034676028b01d15d2cffdefdd266dec7e2dd0f98b8d8f07818195
Instruction Fuzzy Hash: 27F068767192568BDFA5DF29A44662977D0F7087C4F548239D58DC3B04DA3C98508F08

Function 00007FF655DB3354 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction ID: b3a4bcebb07c197799417ff7adc547d7df035d4952f33fb579449e3cdd367f99
Opcode Fuzzy Hash: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction Fuzzy Hash: CEA0026B90CC42D0E6449B14E8688712331FB50B18B581331F40DE21A4DF3CAC01D70C

Function 00007FF655D8D7D0 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 98COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8D964

Strings

::$OBJECT_ID, xrefs: 00007FF655D8D880
:$I30:$INDEX_ALLOCATION, xrefs: 00007FF655D8D849
::$DATA, xrefs: 00007FF655D8D812
::$ATTRIBUTE_LIST, xrefs: 00007FF655D8D7FC
:$EFS:$LOGGED_UTILITY_STREAM, xrefs: 00007FF655D8D86A
::$EA_INFORMATION, xrefs: 00007FF655D8D828
::$REPARSE_POINT, xrefs: 00007FF655D8D88B
::$BITMAP, xrefs: 00007FF655D8D807
::$LOGGED_UTILITY_STREAM, xrefs: 00007FF655D8D85F
::$INDEX_ROOT, xrefs: 00007FF655D8D854
::$EA, xrefs: 00007FF655D8D81D
:$TXF_DATA:$LOGGED_UTILITY_STREAM, xrefs: 00007FF655D8D875
::$INDEX_ALLOCATION, xrefs: 00007FF655D8D83E
::$FILE_NAME, xrefs: 00007FF655D8D833

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: :$EFS:$LOGGED_UTILITY_STREAM$:$I30:$INDEX_ALLOCATION$:$TXF_DATA:$LOGGED_UTILITY_STREAM$::$ATTRIBUTE_LIST$::$BITMAP$::$DATA$::$EA$::$EA_INFORMATION$::$FILE_NAME$::$INDEX_ALLOCATION$::$INDEX_ROOT$::$LOGGED_UTILITY_STREAM$::$OBJECT_ID$::$REPARSE_POINT
API String ID: 3668304517-727060406
Opcode ID: 2f19ab4c30c8eac6d144c901c4549240b956f6a692c877d1095a563e450749ff
Instruction ID: c7f36a215adc0f4735e69275d29e323858814084a8296f7284ef95f8353290e8
Opcode Fuzzy Hash: 2f19ab4c30c8eac6d144c901c4549240b956f6a692c877d1095a563e450749ff
Instruction Fuzzy Hash: 3641E83BA05B01D9EB009F60D4483E933B5EB48B98F481336DA5DA3798EF38D955C348

Function 00007FF655DB2A10 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF655DB2A26
GetModuleHandleW.KERNEL32 ref: 00007FF655DB2A33
GetModuleHandleW.KERNEL32 ref: 00007FF655DB2A48
GetProcAddress.KERNEL32 ref: 00007FF655DB2A60
GetProcAddress.KERNEL32 ref: 00007FF655DB2A73
CreateEventW.KERNEL32 ref: 00007FF655DB2A9F
DeleteCriticalSection.KERNEL32 ref: 00007FF655DB2AEB
CloseHandle.KERNEL32 ref: 00007FF655DB2AFD

Strings

kernel32.dll, xrefs: 00007FF655DB2A41
SleepConditionVariableCS, xrefs: 00007FF655DB2A56
WakeAllConditionVariable, xrefs: 00007FF655DB2A66
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF655DB2A2C

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction ID: f1dcab4b2a7dc0130f81a67f6a7ba5885d0e43736209a259e0afcd03e25d36ed
Opcode Fuzzy Hash: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction Fuzzy Hash: 7621E06FE19A0381FE55EB51E85D57473A1AF44F99F8C0735C90EA26A0DF3CEC458608

Function 00007FF655D96A0C Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 444COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D970A6

Part of subcall function 00007FF655D82004: std::_Xinvalid_argument.LIBCPMT ref: 00007FF655D8200F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D970B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D970B8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D970C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D970D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D970DC

Strings

UNC, xrefs: 00007FF655D96BBF
\\?\, xrefs: 00007FF655D96A57, 00007FF655D96A66
DXGIDebug.dll, xrefs: 00007FF655D96A18

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: DXGIDebug.dll$UNC$\\?\
API String ID: 4097890229-4048004291
Opcode ID: 84a8d5924325d9694cefe69853777e32b6ff0efedf48cba38b0c2889e3b1290b
Instruction ID: 3d9e43163f276e6675285fbb600148f9689cde063692ea3262f625f5fc42bc94
Opcode Fuzzy Hash: 84a8d5924325d9694cefe69853777e32b6ff0efedf48cba38b0c2889e3b1290b
Instruction Fuzzy Hash: 1C12DD2BB08A4280EB10DB64D0581AD6372EB81F9CF544335DA5DA7BE9DF3DD989C348

Function 00007FF655DAA440 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655D8129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655D81396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAA72F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAA735
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAA73B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAA741
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DAA747
EndDialog.USER32 ref: 00007FF655DAA7BA

Strings

Software\WinRAR SFX, xrefs: 00007FF655DAA52B, 00007FF655DAA53A
GETPASSWORD1, xrefs: 00007FF655DAA773

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 431506467-1315819833
Opcode ID: cbdb2342dbc27246140afa92192789482b4dc38f3de2603255fba98438e470aa
Instruction ID: 0cd6b1fc1cf3cad2289a5764de4bd05ced582d933e64a3dd76668331404eedc4
Opcode Fuzzy Hash: cbdb2342dbc27246140afa92192789482b4dc38f3de2603255fba98438e470aa
Instruction Fuzzy Hash: 58B1A267F1974285FB009BA4D4482BD2372AB85B9CF584335DA5CB6AD9DF3CE845C308

Function 00007FF655DA6E80 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF655DA7E9B), ref: 00007FF655DA7080
CreateStreamOnHGlobal.COMBASE ref: 00007FF655DA70B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA717B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA7181
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA7187

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF655DA6F2C, 00007FF655DA6F3B
</html>, xrefs: 00007FF655DA6F72, 00007FF655DA6F81
<html>, xrefs: 00007FF655DA6F13
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF655DA6ED5, 00007FF655DA6EE4

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Global$AllocCreateStream
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2868844859-1533471033
Opcode ID: d8862c3025e57af8a5778f9936a91020890481e3bad1d2e12bbb9941efaf755e
Instruction ID: 9ba00f233c1f2ffa63c8dcaeb5e5924d6602a19785de0c4411d6f123771452d6
Opcode Fuzzy Hash: d8862c3025e57af8a5778f9936a91020890481e3bad1d2e12bbb9941efaf755e
Instruction Fuzzy Hash: 91819167F19A4285FB00DBA5D4482ED2372AB45B9CF481335DE1DA7699DF38E906C308

Function 00007FF655DBE650 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF655DBE7CD

Strings

INF, xrefs: 00007FF655DBE6C3
nan, xrefs: 00007FF655DBE6B8
nan(ind), xrefs: 00007FF655DBE706
NAN(SNAN), xrefs: 00007FF655DBE6E5
inf, xrefs: 00007FF655DBE6D6
nan(snan), xrefs: 00007FF655DBE6F0
NAN, xrefs: 00007FF655DBE6B1
NAN(IND), xrefs: 00007FF655DBE6FB

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction ID: 95c2e05b85998b90196a059c868e52361f8c2c585bd46b61d9ab0c4cabbcd440
Opcode Fuzzy Hash: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction Fuzzy Hash: E441D07BA09B45C9EB00DF21E8457A933A5EB18B98F084336DE5CA7B54DE3CD425C748

Function 00007FF655DAF390 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF655DAF3CF
GetClassNameW.USER32 ref: 00007FF655DAF3FC
GetWindowLongPtrW.USER32 ref: 00007FF655DAF41D
SendMessageW.USER32 ref: 00007FF655DAF437
GetObjectW.GDI32 ref: 00007FF655DAF452
SendMessageW.USER32 ref: 00007FF655DAF487
DeleteObject.GDI32 ref: 00007FF655DAF490
GetWindow.USER32 ref: 00007FF655DAF49E

Strings

STATIC, xrefs: 00007FF655DAF402

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassDeleteLongName
String ID: STATIC
API String ID: 2845197485-1882779555
Opcode ID: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction ID: 2f9371fd23298f2fffca648511a7fe8dac2510b5679e9327b2ae622ed422941f
Opcode Fuzzy Hash: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction Fuzzy Hash: F9317E3BA0864346FA609B21E5587BAA3A1EB89F88F080730DD4D97B55DE3CDC068744

Function 00007FF655DAAE90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF655DAAEAE

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ItemTextWindow
String ID: LICENSEDLG
API String ID: 2478532303-2177901306
Opcode ID: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction ID: 2f5a02dec4a316576e6774b917b6ea801dec600cd34d849440525cb55beaaf55
Opcode Fuzzy Hash: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction Fuzzy Hash: CD416F3BB0865282FB548B11E85877A6261EB85F8DF0C4335D90EA7B95CF3CED468708

Function 00007FF655D9B9B4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF655D9BA12
GetProcAddress.KERNEL32 ref: 00007FF655D9BA2D
GetCurrentProcessId.KERNEL32 ref: 00007FF655D9BACA

Part of subcall function 00007FF655D9DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF655D9DDDF

Strings

Crypt32.dll, xrefs: 00007FF655D9B9F0
CryptProtectMemory, xrefs: 00007FF655D9BA08
CryptUnprotectMemory failed, xrefs: 00007FF655D9BAC1
CryptUnprotectMemory, xrefs: 00007FF655D9BA1F
CryptProtectMemory failed, xrefs: 00007FF655D9BA80

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: 6794cfd2df2083ddb130d433e4ca33b69faefb70ddab7dfcfa84983386d80e8a
Instruction ID: d59ffd9c47f3950bfd7aafdf8b7599128f390007226389430462754e51abc957
Opcode Fuzzy Hash: 6794cfd2df2083ddb130d433e4ca33b69faefb70ddab7dfcfa84983386d80e8a
Instruction Fuzzy Hash: 7431163BA0EA4780FA55CB15A86817977A0AF44F98F0D5335C85EA33A5DFBCED418309

Function 00007FF655DA87D8 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA8DB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA8DC2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA8DCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA8DDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655DA8DE0

Strings

, xrefs: 00007FF655DA88BE
, xrefs: 00007FF655DA8A55

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: 3e5c1c837bf5b094cbf702a79e584555beddaf0efbc8773bf26ad6af60c03e6c
Instruction ID: 778900021a5d7f9fe003b42394dc4fb7471b45bb62e69ca3ac646156d15249a4
Opcode Fuzzy Hash: 3e5c1c837bf5b094cbf702a79e584555beddaf0efbc8773bf26ad6af60c03e6c
Instruction Fuzzy Hash: 2BF19C7BF1564684EE009B64D4482AE2362AB44FACF485731CE5DA7BD9DF7CE980C348

Function 00007FF655DB57EC Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF655DB598A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF655DB5CAD
abort.LIBCMT ref: 00007FF655DB5CE1

Strings

csm, xrefs: 00007FF655DB58D1
csm, xrefs: 00007FF655DB59B1
csm, xrefs: 00007FF655DB5933

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction ID: 5c8e266ff621f9d3a9842a4d681c89adbfc2ef7dc6936593223dde1a10908462
Opcode Fuzzy Hash: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction Fuzzy Hash: ACE1B4779087828AE710AF24D4493AD77A2FB45BACF184335DA8DA7655DF38E881CF04

Function 00007FF655D94F38 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655D94E24: SysAllocString.OLEAUT32 ref: 00007FF655D94E5F

VariantClear.OLEAUT32 ref: 00007FF655D95125

Strings

SELECT * FROM Win32_OperatingSystem, xrefs: 00007FF655D95017
Name, xrefs: 00007FF655D950F9
ROOT\CIMV2, xrefs: 00007FF655D94F7B
Windows 10, xrefs: 00007FF655D9510A
WQL, xrefs: 00007FF655D9502A

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: AllocClearStringVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 1959693985-3505469590
Opcode ID: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction ID: 26f24b2591d9ee6b6cfb958600f9e9c0d0eb9552b5b75be39deb6e94a02a74f1
Opcode Fuzzy Hash: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction Fuzzy Hash: A371093BA15A1585EB20CF25E8A45AD77B4FB88F9CB485332DA4E93B64DF38D944C304

Function 00007FF655DB72EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF655DB74F3,?,?,?,00007FF655DB525E,?,?,?,00007FF655DB5219), ref: 00007FF655DB7371
GetLastError.KERNEL32(?,?,00000000,00007FF655DB74F3,?,?,?,00007FF655DB525E,?,?,?,00007FF655DB5219), ref: 00007FF655DB737F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF655DB74F3,?,?,?,00007FF655DB525E,?,?,?,00007FF655DB5219), ref: 00007FF655DB73A9
FreeLibrary.KERNEL32(?,?,00000000,00007FF655DB74F3,?,?,?,00007FF655DB525E,?,?,?,00007FF655DB5219), ref: 00007FF655DB73EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF655DB74F3,?,?,?,00007FF655DB525E,?,?,?,00007FF655DB5219), ref: 00007FF655DB73FB

Strings

api-ms-, xrefs: 00007FF655DB7391

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction ID: bd58764512775972a874a2f97521de29fc6f2cf39af2b17d47b7f6048b622348
Opcode Fuzzy Hash: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction Fuzzy Hash: 6431F82BB1A64182EE51AB06E8085752395FF44FB8F1D4735DD2DAB790DF3CE8408B18

Function 00007FF655DB1604 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF655DB1573,?,?,?,00007FF655DB192A), ref: 00007FF655DB162B
GetProcAddress.KERNEL32(?,?,?,00007FF655DB1573,?,?,?,00007FF655DB192A), ref: 00007FF655DB1648
GetProcAddress.KERNEL32(?,?,?,00007FF655DB1573,?,?,?,00007FF655DB192A), ref: 00007FF655DB1664

Strings

KERNEL32.DLL, xrefs: 00007FF655DB1624
ReleaseSRWLockExclusive, xrefs: 00007FF655DB1653
AcquireSRWLockExclusive, xrefs: 00007FF655DB163E

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction ID: e7217e575d41fb2009b0f007a899698b0adf4cf72cfa33f3a13188cf9a59b838
Opcode Fuzzy Hash: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction Fuzzy Hash: 3511522BA1AB0381FD555B80F94827462966F09FACF4C4735C81DA6354EE3CEC858A08

Function 00007FF655D9ED24 Relevance: 9.1, APIs: 6, Instructions: 120timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655D951A4: GetVersionExW.KERNEL32 ref: 00007FF655D951D5

FileTimeToLocalFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF655D85AB4), ref: 00007FF655D9ED8C
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF655D85AB4), ref: 00007FF655D9ED98
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF655D85AB4), ref: 00007FF655D9EDA8
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF655D85AB4), ref: 00007FF655D9EDB6
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF655D85AB4), ref: 00007FF655D9EDC4
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF655D85AB4), ref: 00007FF655D9EE05

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction ID: 452d4a433ac1bcf6919f0bd4d53321823d000d102bfe361132f9de0abcedcbb5
Opcode Fuzzy Hash: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction Fuzzy Hash: 68518DB7B106518AEB04CFA4D4585AC77B1F748B8CB64423ADE0EA7B58DF38D945CB04

Function 00007FF655D9F010 Relevance: 9.1, APIs: 6, Instructions: 80timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF655D9F074

Part of subcall function 00007FF655D951A4: GetVersionExW.KERNEL32 ref: 00007FF655D951D5

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF655D9F096
FileTimeToSystemTime.KERNEL32 ref: 00007FF655D9F0A2
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF655D9F0B2
SystemTimeToFileTime.KERNEL32 ref: 00007FF655D9F0C0
SystemTimeToFileTime.KERNEL32 ref: 00007FF655D9F0CE

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction ID: fdf773cf98dcafff7b4e4b8e5061777e305e7c691c95408af703339c0ac8ccd5
Opcode Fuzzy Hash: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction Fuzzy Hash: DA313C67B10A518DFB00CFB5D8941AC7770FB08B5CB58512ADE0EA7A58EF38D895C704

Function 00007FF655D97918 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D97C8C

Strings

exe, xrefs: 00007FF655D979AF, 00007FF655D979BE
sfx, xrefs: 00007FF655D979F3, 00007FF655D97A02
rar, xrefs: 00007FF655D97A9B, 00007FF655D97AAA, 00007FF655D97B67, 00007FF655D97B7C
.rar, xrefs: 00007FF655D97969, 00007FF655D97978

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: .rar$exe$rar$sfx
API String ID: 3668304517-630704357
Opcode ID: 93dbb7d74f849ef92666457f8e9f641f008dc657da5001eee78cfd1c0618c12a
Instruction ID: de12a874eee7293988b33f9b570b8542d061968929819a11bf381328e65ee5c6
Opcode Fuzzy Hash: 93dbb7d74f849ef92666457f8e9f641f008dc657da5001eee78cfd1c0618c12a
Instruction Fuzzy Hash: 4FA1A12BA1460A80EA409B65D4692BC2371AF41FACF581335DD1DA76D6DF3CE945C348

Function 00007FF655DB5CE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF655DB5D58

Part of subcall function 00007FF655DB5210: abort.LIBCMT ref: 00007FF655DB5223

_CallSETranslator.LIBVCRUNTIME ref: 00007FF655DB5DA3
abort.LIBCMT ref: 00007FF655DB5FD1

Strings

RCC, xrefs: 00007FF655DB5D74
MOC, xrefs: 00007FF655DB5D6C

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction ID: 6e4acfbd2831a185f91dec516ef0a199e73930ecfbcadced6f5b601859196758
Opcode Fuzzy Hash: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction Fuzzy Hash: 7B91D177A08B818AEB10DB64D4842AD77A1F704B9CF184329EF8CA7754DF38D595CB04

Function 00007FF655DB4F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF655DB4FAB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF655DB5040
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF655DB2F5E), ref: 00007FF655DB508F

Strings

csm, xrefs: 00007FF655DB5026
f, xrefs: 00007FF655DB4FBE

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction ID: ce60bbc00894ec73fbeeb719cb6268723991cb5fcfe93a14a9527094c2fea296
Opcode Fuzzy Hash: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction Fuzzy Hash: 5651C73BA1660286DB54EB15E448A293356FB40FECF588330D95EA7748FF78EC418B48

Function 00007FF655D8CEE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF655D8D03D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8D0D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8D0D7

Part of subcall function 00007FF655D8DE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF655D8CF4B), ref: 00007FF655D8DE27
Part of subcall function 00007FF655D8DE04: GetLastError.KERNEL32 ref: 00007FF655D8DE88
Part of subcall function 00007FF655D8DE04: CloseHandle.KERNEL32 ref: 00007FF655D8DE9B

Strings

SeRestorePrivilege, xrefs: 00007FF655D8CF5E
SeSecurityPrivilege, xrefs: 00007FF655D8CF3F

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo_noreturn$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2102711378-639343689
Opcode ID: 4ad8962ae40659baaf1511d456c0931157e13c4a94880edc0a22eb1ae19da66a
Instruction ID: 8002413db59987673146cbd651366ebff04fb3387b0c9d1f6a129987f7638520
Opcode Fuzzy Hash: 4ad8962ae40659baaf1511d456c0931157e13c4a94880edc0a22eb1ae19da66a
Instruction Fuzzy Hash: 6151D36BF0864285FB00EB60D8492BD2361AF44BACF481335DE1DA76D6DF3CAC85C209

Function 00007FF655DA7B28 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF655DA7B6F
GetWindowRect.USER32 ref: 00007FF655DA7BC0
ShowWindow.USER32 ref: 00007FF655DA7C96
ShowWindow.USER32 ref: 00007FF655DA7CC3

Strings

RarHtmlClassName, xrefs: 00007FF655DA7C4B

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: 95333b9ad2bfddc98b100d65ee3ae7a1141886215ecc40d0d40dcbf9cb340d19
Instruction ID: a58abc1d0a297d02e63a3807ab8464bbd88bb40acc62be130ec3330032c1a2a5
Opcode Fuzzy Hash: 95333b9ad2bfddc98b100d65ee3ae7a1141886215ecc40d0d40dcbf9cb340d19
Instruction Fuzzy Hash: 2C51943BA0874286EA649F21E45837AB361FB85F88F084735DE4E97B55DF3CE8458B04

Function 00007FF655DAFED4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 00007FF655DAFF34, 00007FF655DAFF99
RENAMEDLG, xrefs: 00007FF655DAFF60

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction ID: ac314bffa3257076bd6115a495ceebb27695619ffb58ec1dbdedf4b86443b5b9
Opcode Fuzzy Hash: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction Fuzzy Hash: FF21C43E909A8781EA508B15E84C175B3A0EB49F8CF1C0776DA4DE7764DE3CE9998348

Function 00007FF655DBBFB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF655DBBFD0
GetProcAddress.KERNEL32 ref: 00007FF655DBBFE6
FreeLibrary.KERNEL32 ref: 00007FF655DBC00B

Strings

CorExitProcess, xrefs: 00007FF655DBBFDF
mscoree.dll, xrefs: 00007FF655DBBFC7

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction ID: f92728afd2a80969098caceadeae4c30bc9da211805594b3a5145b6e57fc9113
Opcode Fuzzy Hash: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction Fuzzy Hash: 29F0A42BA19A4681EE449B10E45867963A1BF88F98F0C1335D94F92274CF3CD8848B04

Function 00007FF655DC45C0 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF655DC4605

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction ID: 7613af7d20565defef9a11a3c652441306e17a4bade7ecd8824aa5ce3da20784
Opcode Fuzzy Hash: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction Fuzzy Hash: 2F81DC2BE1865289F7209B65C8486BD66A1BF45F9DF084335CE0EA3AD5DF3CAC41C708

Function 00007FF655D93AF8 Relevance: 7.7, APIs: 5, Instructions: 164filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF655D93BBB
CreateFileW.KERNEL32 ref: 00007FF655D93C24
SetFileTime.KERNEL32 ref: 00007FF655D93CEC
CloseHandle.KERNEL32 ref: 00007FF655D93CF6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D93D2C

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: 8c9e27b33bb60ec2ca70bdd01c92279f10c16d884dcde86fae8fb32e95875df8
Instruction ID: a582d7ac250bc819917e89e5976ea172ecf50d2b3f2fae67dcfb5f2c0514b5ba
Opcode Fuzzy Hash: 8c9e27b33bb60ec2ca70bdd01c92279f10c16d884dcde86fae8fb32e95875df8
Instruction Fuzzy Hash: 6A51C22BB04A4289FB50DB65E4683BD2371AB84FACF184735DE1DE67D4DE3898558308

Function 00007FF655DC3F34 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF655DC4767), ref: 00007FF655DC3F91
WideCharToMultiByte.KERNEL32 ref: 00007FF655DC406D
WriteFile.KERNEL32 ref: 00007FF655DC4093
WriteFile.KERNEL32 ref: 00007FF655DC40D2
GetLastError.KERNEL32 ref: 00007FF655DC410A

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction ID: 5693a7d0c4ce6b89c9aa5f1e58d0e7afd2cfc85e74798a8269060c6c318b9620
Opcode Fuzzy Hash: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction Fuzzy Hash: 8351BF37A14A5189E710CB65D4483BC3BB1FB44B9CF088335DE4AA7A98DF38D986C704

Function 00007FF655DB1E00 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF655D94DF4), ref: 00007FF655DB1E87
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF655D94DF4), ref: 00007FF655DB1F09
SysAllocString.OLEAUT32 ref: 00007FF655DB1F16

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 78f40180803c07e16f725ce8caa782a98fbfbfcb68ebd86bc368cce44f009025
Instruction ID: 805e5444084376404c1444b9319b2067e2904dc697ff4e65bcce35d376af5938
Opcode Fuzzy Hash: 78f40180803c07e16f725ce8caa782a98fbfbfcb68ebd86bc368cce44f009025
Instruction Fuzzy Hash: A741D42BA0964689EB14AFA1D4482782292EF08FBCF1C4734EA6DE77D5DF3CD8418704

Function 00007FF655DBF414 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF655DBF536

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction ID: eedc04f8fb42ad9faa0f57676b150d4c765052bec9e4c4128ed2d4ae3aa1212f
Opcode Fuzzy Hash: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction Fuzzy Hash: BE41C22BB09A4281FA15AB12E848575A2D6BF44FA8F0D4735DD1DEB744EF3CE9408B08

Function 00007FF655DC56D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF655DC56FF
_set_statfp.LIBCMT ref: 00007FF655DC571A
_set_statfp.LIBCMT ref: 00007FF655DC5736
_set_statfp.LIBCMT ref: 00007FF655DC5772

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: 61c78877b5c58691b31a81f0059f69fd2648141e26fb697c6f092e0c9e9cd1f4
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: 8F118F7FE1CA0781FA641168E5CE3791141AF55BE8E4C4334EA7EEA6D6DF6CAC80420D

Function 00007FF655DAFE24 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF655DAFE41
GetMessageW.USER32 ref: 00007FF655DAFE58
TranslateMessage.USER32 ref: 00007FF655DAFE63
DispatchMessageW.USER32 ref: 00007FF655DAFE6E
WaitForSingleObject.KERNEL32 ref: 00007FF655DAFE7C

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction ID: 2d3497b3bb560d7a16595550dd42d79a954c6b9b51e9a4a6d25dd0b3f0916758
Opcode Fuzzy Hash: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction Fuzzy Hash: 81F03C3AB2954782F7108720E858A3AA251FFA4F09F481230E54A95895DF2CDA89CB04

Function 00007FF655DB625C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF655DB6286
abort.LIBCMT ref: 00007FF655DB64EA

Strings

csm, xrefs: 00007FF655DB62AB
csm, xrefs: 00007FF655DB641A

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction ID: 9a3b4c9671985aa1ac207eb6cb49bbd62d32b033928dda003b2ead26899c5ae9
Opcode Fuzzy Hash: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction Fuzzy Hash: C371B277508A8186DB60AB25D05877D7BA2EB01FACF088335DA8DA7785CF2DD890CB45

Function 00007FF655DB80F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF655DB811B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF655DB82ED

Strings

, xrefs: 00007FF655DB8276
*, xrefs: 00007FF655DB8221

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction ID: 1147d7c287542c82c747c805965e738392a8293d5178b43e6b5efd4a9afe6535
Opcode Fuzzy Hash: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction Fuzzy Hash: 6451147BD1D6428AEB65AE28C44D37837A2EB05F6DF1C1335C64AA5199CF38DC81CE09

Function 00007FF655DC1758 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF655DC17CB
MultiByteToWideChar.KERNEL32 ref: 00007FF655DC1894
GetStringTypeW.KERNEL32 ref: 00007FF655DC18AE

Strings

$%s, xrefs: 00007FF655DC175A

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction ID: 647c2ce5aff1fbb49c8cd62fd506b3b8a187d4aa63a6c96b097f91dc51eb44da
Opcode Fuzzy Hash: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction Fuzzy Hash: F5419D27B08B919AEB609FA5D8082A86291FF44FACF4C0335DA1DA77C4DF3CE8458304

Function 00007FF655DB66A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655DB5210: abort.LIBCMT ref: 00007FF655DB5223

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF655DB674A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF655DB6776

Strings

csm, xrefs: 00007FF655DB6876

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction ID: baff35f4e4fd9097eb30dbf1e70c7afab6d9163a607b6897692cb6a11fee40a9
Opcode Fuzzy Hash: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction Fuzzy Hash: 68516D7BA1974187DA60EB16E04526E77A5FB88FA4F080334EB8D97B55DF38E850CB04

Function 00007FF655DC4360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF655DC4446
WriteFile.KERNEL32 ref: 00007FF655DC4479
GetLastError.KERNEL32 ref: 00007FF655DC449B

Strings

U, xrefs: 00007FF655DC4424

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction ID: 360c05efdcd77704f6089be8feb2fdea8d68a2ae1f54bacafb79750a4469bb77
Opcode Fuzzy Hash: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction Fuzzy Hash: A941B427619A8182EB108F65E4487B97761FB98B98F584331EE4DD7784EF7CD841CB04

Function 00007FF655DA90B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF655DA90D9
GetObjectW.GDI32 ref: 00007FF655DA9107
ReleaseDC.USER32 ref: 00007FF655DA91BB

Strings

, xrefs: 00007FF655DA9153

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction ID: 442ce358695c0fcc83a90a04f1d0f98d6844edf05cdaa26e8ca7e313c9987da4
Opcode Fuzzy Hash: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction Fuzzy Hash: 81314E3A60874287EB04DF12B81862AB761F789FD5F444635ED4A93B58CE3CD889CB04

Function 00007FF655D9E870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,00007FF655DA317F,?,?,00001000,00007FF655D8E51D), ref: 00007FF655D9E8BB
CreateSemaphoreW.KERNEL32(?,?,?,00007FF655DA317F,?,?,00001000,00007FF655D8E51D), ref: 00007FF655D9E8CB
CreateEventW.KERNEL32(?,?,?,00007FF655DA317F,?,?,00001000,00007FF655D8E51D), ref: 00007FF655D9E8E4

Strings

Thread pool initialization failed., xrefs: 00007FF655D9E900

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction ID: cf9b4f23dbdf95334e9acdc07494cc162479760ada4652e6d582b20d54ab6b66
Opcode Fuzzy Hash: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction Fuzzy Hash: 13219037A1564286F7508F64D4587AD36E2EB98F0CF1C8334CA0D9A295CF7EAC56C788

Function 00007FF655DA85E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF655DA85EC
GetDeviceCaps.GDI32 ref: 00007FF655DA85FD
ReleaseDC.USER32 ref: 00007FF655DA860A

Strings

, xrefs: 00007FF655DA8610

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction ID: 540f58bd9ba3aecc6fbaf22424aefac632a092803faa2359a6a283a439a70d94
Opcode Fuzzy Hash: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction Fuzzy Hash: C0E08C26B0864282EB085BB6B58D12AA261EB4CFD0F198235DA1A87798CE3CC8C44304

Function 00007FF655D8D1A8 Relevance: 6.2, APIs: 4, Instructions: 238timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32 ref: 00007FF655D8D46C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8D554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8D55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8D560

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileTime
String ID:
API String ID: 1137671866-0
Opcode ID: ad0c369e97bd27df0bd8571ae047a7ba3ec338b5cc8231976b3225e174adef6f
Instruction ID: 654366bf6caac3a79c70c11c23b2701d4e00154ac851294fd2d7202299c61aaf
Opcode Fuzzy Hash: ad0c369e97bd27df0bd8571ae047a7ba3ec338b5cc8231976b3225e174adef6f
Instruction Fuzzy Hash: 7DA1F667A1868281EA10EB65D4482AD6371FF81F9CF442331EA4DA7BD9DF3CE944C709

Function 00007FF655DA0548 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF655DA05FC
SetLastError.KERNEL32 ref: 00007FF655DA0697

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 54200ff8d853bda438b9724302bbe7c4cb5cd052152846316c4389ee66fe2230
Instruction ID: 7f9779c30f2cbdde2387bd78166122f08c6261cb25f482f764501f4a08fa7c7e
Opcode Fuzzy Hash: 54200ff8d853bda438b9724302bbe7c4cb5cd052152846316c4389ee66fe2230
Instruction Fuzzy Hash: F151A17BB14A4295FB009B65D4492AD2322EB84F9CF484336DA1CA7BD6DF2CE945C348

Function 00007FF655DA9D90 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF655DA9DBC
GetLastError.KERNEL32 ref: 00007FF655DA9E08
CreateDirectoryW.KERNEL32 ref: 00007FF655DA9F10
LocalFree.KERNEL32 ref: 00007FF655DA9F20

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: c706cd24276746ab5e2fa6f684baf4bd7a284fdc318c0cb51509761d2b1b6963
Instruction ID: 0925c5df2c7959d2538af25a8134ae03072bf5340b5797cd359fdc016f98309e
Opcode Fuzzy Hash: c706cd24276746ab5e2fa6f684baf4bd7a284fdc318c0cb51509761d2b1b6963
Instruction Fuzzy Hash: C4516037618B4286EB508F61E8487AE7364FB84F88F541335EA4DA7A58DF3CD944CB44

Function 00007FF655DBDB5C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF655DBDBAF
WideCharToMultiByte.KERNEL32 ref: 00007FF655DBDC81
GetLastError.KERNEL32 ref: 00007FF655DBDCA4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF655DBDCD6

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction ID: ae329a9a5ed01dc7207b721863f5d5839971ef0a9e1352fb3efe04e17d07d91a
Opcode Fuzzy Hash: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction Fuzzy Hash: 2A41732BA0864246F765BE10D04837962A2EF84FB8F1C4335DA4DE6A99DF7CDC418E08

Function 00007FF655D93980 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00007FF655D939BD
MoveFileW.KERNEL32 ref: 00007FF655D93A34
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D93AEB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D93AF1

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: FileMove_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3823481717-0
Opcode ID: 9a9a58264430c11791c0c606b390f78d08ba3037c1fa37d6a31b7cedc8df9908
Instruction ID: 24bd394c1981de28badd96ca64ee39d00f54a78404c29d0e8f01166d1cd527c4
Opcode Fuzzy Hash: 9a9a58264430c11791c0c606b390f78d08ba3037c1fa37d6a31b7cedc8df9908
Instruction Fuzzy Hash: F7419D67F14B5284FB00DBA9D8591AC2372BB44FACB185335DE5DA7A99DF38D841C208

Function 00007FF655DC0B78 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF655DBC45B), ref: 00007FF655DC0B91
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF655DBC45B), ref: 00007FF655DC0BF3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF655DBC45B), ref: 00007FF655DC0C2D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF655DBC45B), ref: 00007FF655DC0C57

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction ID: e437f79ecf8abcc7355904c1d569a1d8ef75869c71d403cb45cc47b251711671
Opcode Fuzzy Hash: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction Fuzzy Hash: 28216636B18B5181D6249F11654402DB6A5FB94FD4B4C4334DE9EB3B94DF3CE8528708

Function 00007FF655DBD440 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF655DB7F28,?,?,?,00007FF655DB9D35), ref: 00007FF655DBD44A
SetLastError.KERNEL32(?,?,?,00007FF655DB7F28,?,?,?,00007FF655DB9D35), ref: 00007FF655DBD4B2
SetLastError.KERNEL32(?,?,?,00007FF655DB7F28,?,?,?,00007FF655DB9D35), ref: 00007FF655DBD4C8
abort.LIBCMT ref: 00007FF655DBD4CE

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction ID: 1c71fe3122a10512a126000d2f6bb9ca07ca70e8d107a95a2454ab91460d8c0f
Opcode Fuzzy Hash: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction Fuzzy Hash: A9016D2EA0960342FA587721E55D63812525F44FA8F1C0738D91EA67D6ED2CBC444A09

Function 00007FF655DA8590 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF655DA8598
GetDeviceCaps.GDI32 ref: 00007FF655DA85AE
GetDeviceCaps.GDI32 ref: 00007FF655DA85C2
ReleaseDC.USER32 ref: 00007FF655DA85D3

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction ID: 1d2d4ee6a7599e2077baa32ca94afa9cd9cee2a769fcdbfeb8d7245c2525b1f1
Opcode Fuzzy Hash: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction Fuzzy Hash: 70E0ED6AE0964382FF499BB1A85D13AB190EF48F49F4C4739CC1EE6360DD3CA885C618

Function 00007FF655D8E34C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D8E549

Strings

DXGIDebug.dll, xrefs: 00007FF655D8E35A

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DXGIDebug.dll
API String ID: 3668304517-540382549
Opcode ID: 59f5a07f3fb2ea719f45a05ba6c1ae5c7d9afb2a0aed67dbb2f715f9973f08e5
Instruction ID: 18f617e160636928ccc386f0fb7f71f3c87e41bd476cd2dff601684c10b1cb63
Opcode Fuzzy Hash: 59f5a07f3fb2ea719f45a05ba6c1ae5c7d9afb2a0aed67dbb2f715f9973f08e5
Instruction Fuzzy Hash: 4071CC73A04B8182EB14CB65E4483ADB3A5FB54B98F484336DBAC57B95DF38D461C308

Function 00007FF655DBE1F4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF655DBE237

Strings

gfff, xrefs: 00007FF655DBE362
e+000, xrefs: 00007FF655DBE2DF

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction ID: cfac185f77c173808af710695f89b5654a8020810f75d3ae1783738028bd701f
Opcode Fuzzy Hash: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction Fuzzy Hash: 81510667B187C146EB259B35D8453696B92EB81FA4F0C9331CA9CD7BD5CE2CE844CB04

Function 00007FF655D99408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655D995A8: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF655D995E6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D9959C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655D995A2

Strings

SIZE, xrefs: 00007FF655D99443

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: 95182320ee7b3a48c420107a4992996f84afbbac13f0d5532198c1d22c251322
Instruction ID: fac404be6a17a153a75b1f22d10fc3901d3a03544b7870be1b8396bc0ea5f338
Opcode Fuzzy Hash: 95182320ee7b3a48c420107a4992996f84afbbac13f0d5532198c1d22c251322
Instruction Fuzzy Hash: F6410567A1874282EF50DB54E4593BE6321EF85BA8F484331EA9D936D6EF3CD940C708

Function 00007FF655DBC2C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF655DBC2EA
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF655DB2CD5), ref: 00007FF655DBC30B

Strings

C:\Users\user\Desktop\0438.pdf.exe, xrefs: 00007FF655DBC2F9

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\0438.pdf.exe
API String ID: 3307058713-2094305049
Opcode ID: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction ID: 78d7ccef1bf09ba8ed97e62658c470c21a8bb7d7b22ce26e824b7097acf2f15e
Opcode Fuzzy Hash: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction Fuzzy Hash: 6041B23BA08A4786EB14AF21E4441BC7795FF44FA8B484336E94EA7755DE3CE8418B08

Function 00007FF655DA9B40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655D8255C: GetDlgItem.USER32 ref: 00007FF655D825AC
Part of subcall function 00007FF655D8255C: SetWindowTextW.USER32 ref: 00007FF655D825C8

EndDialog.USER32 ref: 00007FF655DA9C24
SetDlgItemTextW.USER32 ref: 00007FF655DA9CAA

Strings

ASKNEXTVOL, xrefs: 00007FF655DA9B72

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 97ebd98f0834f70bd8f3ada112357d921bc9d5e9383391aa045354938bfaeae3
Instruction ID: 1a830f00edf42e4bc07dc9b98f20b394219626878075e02929d8baae876dfec5
Opcode Fuzzy Hash: 97ebd98f0834f70bd8f3ada112357d921bc9d5e9383391aa045354938bfaeae3
Instruction Fuzzy Hash: 9841803BA08A8281FA509B11E4582BE63A1AF85FCCF184335DE4DE7795CE3CEC558348

Function 00007FF655D99638 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF655D996EA

Part of subcall function 00007FF655DA0F68: WideCharToMultiByte.KERNEL32 ref: 00007FF655DA0F99

Strings

$%s, xrefs: 00007FF655D996D7
@%s, xrefs: 00007FF655D996CE

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction ID: 3a337a8a745547f3a4596016769a3f61f0e94f5f4beb84fdcf35666427fd6b60
Opcode Fuzzy Hash: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction Fuzzy Hash: 6431E47BB19A8685EA109F66D4582E923B0FB44F8CF481332DE0C67B95EE3CE905C704

Function 00007FF655DBEB04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF655DBEB76
GetFileType.KERNEL32 ref: 00007FF655DBEB8C

Strings

@, xrefs: 00007FF655DBEBB7

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction ID: 3cb064b876eee3fc8a1de8dc71698b34f67f9815bfad852b3a96e256cf792e48
Opcode Fuzzy Hash: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction Fuzzy Hash: 8321F52BA08B8240EB609B25D4981382662EB45F79F2C0335D66FA77E4CE3CDC85C70C

Function 00007FF655DB4078 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF655DB1D3E), ref: 00007FF655DB40BC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF655DB1D3E), ref: 00007FF655DB4102

Strings

csm, xrefs: 00007FF655DB40EF

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction ID: ff1d26db3e96216df830ccf1d3ad8daa4fb97caf3e42e1b6bcf7437273a3e032
Opcode Fuzzy Hash: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction Fuzzy Hash: 89112B36618B8182EB208B15E44426977A2FB88F98F184331EE8D57754DF3CD995CB04

Function 00007FF655D9EA5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF655D9E95F,?,?,?,00007FF655D9463A,?,?,?), ref: 00007FF655D9EA63
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF655D9E95F,?,?,?,00007FF655D9463A,?,?,?), ref: 00007FF655D9EA6E

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF655D9EA78

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction ID: 2e24d2c9f5fabd8e5ce1302da00b9c38abba75ef0195a9a2200bedf1d2c0caca
Opcode Fuzzy Hash: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction Fuzzy Hash: ACE01A2BE1984382F600A7219C4E5782250BF61F78F9C1330D13EE11F19F2CAE8AC309

Function 00007FF655D9A43C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF655D9A447
FindResourceW.KERNEL32 ref: 00007FF655D9A45D

Strings

RTL, xrefs: 00007FF655D9A453

Memory Dump Source

Source File: 00000000.00000002.2158580642.00007FF655D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655D80000, based on PE: true

Associated: 00000000.00000002.2158552411.00007FF655D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158674879.00007FF655DC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158736744.00007FF655DE4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2158843061.00007FF655DEE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655d80000_0438.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction ID: 863c3f330d32c5038fc1334a47e86b772910e4336b1f2b3f8e4e3411e82b2732
Opcode Fuzzy Hash: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction Fuzzy Hash: 11D05E9BF0A60282FF194B71A44D77422A05F18F8AF4C4338C84E96390EF2DE8C8C758

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0438.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\533825.rbs

C:\Program Files (x86)\LiteManager Pro - Server\AledensoftIpcServer.dll

C:\Program Files (x86)\LiteManager Pro - Server\EULA.rtf

C:\Program Files (x86)\LiteManager Pro - Server\English.lg

C:\Program Files (x86)\LiteManager Pro - Server\HookDrv.dll

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Taiwan.lg

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Turkish.lg

C:\Program Files (x86)\LiteManager Pro - Server\Lang\Ukrainian.lg

C:\Program Files (x86)\LiteManager Pro - Server\ROMFUSClient.exe

C:\Program Files (x86)\LiteManager Pro - Server\ROMServer.exe

C:\Program Files (x86)\LiteManager Pro - Server\ROMwln.dll

C:\Program Files (x86)\LiteManager Pro - Server\Russian.lg

C:\Program Files (x86)\LiteManager Pro - Server\files\ROMServer.exe

C:\Program Files (x86)\LiteManager Pro - Server\files\ROMViewer.exe

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Windows Analysis Report
0438.pdf.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre