Edit tour

Windows Analysis Report
J4zGPhVRV3.exe

Overview

General Information

Sample name:	J4zGPhVRV3.exe renamed because original name is a hash value
Original sample name:	55cb5fa83a98b9d7cc70cad5fe59f44f8d48956b363df2fbf7ad649b9c4970e5.exe
Analysis ID:	1544725
MD5:	3bca758ce1d5c3858ac8e10a2a38b514
SHA1:	0f9de1a1b10f85941f89dbf603cc587323e2c003
SHA256:	55cb5fa83a98b9d7cc70cad5fe59f44f8d48956b363df2fbf7ad649b9c4970e5
Tags:	873901exeRemoteManipulatoruser-JAMESWT_MHT
Infos:

Detection

RMSRemoteAdmin

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Changes security center settings (notifications, updates, antivirus, firewall)

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

IP address seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Use Short Name Path in Command Line

Stores large binary data to the registry

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected RMS RemoteAdmin tool

Yara signature match

Classification

Process Tree

System is w10x64

svchost.exe (PID: 6772 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2356 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1512 cmdline: C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6648 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 5828 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 5832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

J4zGPhVRV3.exe (PID: 2440 cmdline: "C:\Users\user\Desktop\J4zGPhVRV3.exe" MD5: 3BCA758CE1D5C3858AC8E10A2A38B514)

Acrobat.exe (PID: 7220 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\file.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7488 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7696 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1740,i,9168305141304841160,3939740794304371731,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

msiexec.exe (PID: 7276 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user~1\AppData\Local\Temp\winrar.msi" /qn MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7380 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 8180 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 454D404CF2CD6CFC0CCDA935FCCB9601 MD5: 9D09DC1EDA745A5F87553048E57620CF)

rfusclient.exe (PID: 8384 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\Users\user~1\AppData\Local\Temp\winrar.msi" MD5: 2F0D3D1ABD463AC64AA4E743B50AA055)

rutserv.exe (PID: 8508 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall MD5: 4251BB135CC9A31DD42F0BE1FBC30A86)

rutserv.exe (PID: 8556 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall MD5: 4251BB135CC9A31DD42F0BE1FBC30A86)

rutserv.exe (PID: 8588 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start MD5: 4251BB135CC9A31DD42F0BE1FBC30A86)

svchost.exe (PID: 7552 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7788 cmdline: C:\Windows\system32\svchost.exe -k LocalService -s W32Time MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

rutserv.exe (PID: 8624 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -service MD5: 4251BB135CC9A31DD42F0BE1FBC30A86)

rutserv.exe (PID: 8684 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall MD5: 4251BB135CC9A31DD42F0BE1FBC30A86)

rfusclient.exe (PID: 8720 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" MD5: 2F0D3D1ABD463AC64AA4E743B50AA055)

rfusclient.exe (PID: 3920 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray MD5: 2F0D3D1ABD463AC64AA4E743B50AA055)

rfusclient.exe (PID: 8728 cmdline: "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray MD5: 2F0D3D1ABD463AC64AA4E743B50AA055)

svchost.exe (PID: 2584 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x3a30b0:$s1: rman_message 0x454704:$s3: rms_host_ 0x4550bc:$s3: rms_host_ 0x818d8c:$s4: rman_av_capture_settings 0x45b888:$s7: _rms_log.txt 0x4c0790:$s8: rms_internet_id_settings
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x39f9a8:$s1: rman_message 0x46eaa8:$s3: rms_host_ 0x46f460:$s3: rms_host_ 0x82c4f4:$s4: rman_av_capture_settings 0x8788cc:$s5: rman_registry_key 0x878918:$s5: rman_registry_key 0x545320:$s6: rms_system_information 0x2f2dac:$s7: _rms_log.txt 0x5046f0:$s8: rms_internet_id_settings

Memory Dumps

Source	Rule	Description	Author
00000010.00000000.1422949051.00000000010D9000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000018.00000002.3760276212.0000000004DF8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000017.00000002.3745548454.000000000329A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000018.00000002.3748231450.000000000325A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000017.00000002.3745548454.0000000003276000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000015.00000002.3800200492.00000000041C8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000018.00000002.3748231450.0000000003228000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000018.00000002.3760276212.0000000004E3C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000015.00000003.1568447250.0000000005E6A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000012.00000000.1478283984.00000000019E5000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000015.00000002.3759250551.00000000026C8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rfusclient.exe PID: 8384	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rutserv.exe PID: 8508	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rutserv.exe PID: 8624	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
16.0.rfusclient.exe.620000.0.unpack	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
16.0.rfusclient.exe.620000.0.unpack	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x3a30b0:$s1: rman_message 0x454704:$s3: rms_host_ 0x4550bc:$s3: rms_host_ 0x818d8c:$s4: rman_av_capture_settings 0x45b888:$s7: _rms_log.txt 0x4c0790:$s8: rms_internet_id_settings

Sigma Signatures

System Summary

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 111.90.140.51, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: , Initiated: true, ProcessId: , Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 57717

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\file.pdf", CommandLine: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\file.pdf", CommandLine|base64offset|contains: , Image: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe, NewProcessName: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe, OriginalFileName: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe, ParentCommandLine: "C:\Users\user\Desktop\J4zGPhVRV3.exe", ParentImage: C:\Users\user\Desktop\J4zGPhVRV3.exe, ParentProcessId: 2440, ParentProcessName: J4zGPhVRV3.exe, ProcessCommandLine: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\file.pdf", ProcessId: 7220, ProcessName: Acrobat.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, CommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, ProcessId: 6772, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	ReversingLabs: Detection: 26%
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	ReversingLabs: Detection: 26%

Multi AV Scanner detection for submitted file

Source: J4zGPhVRV3.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.8% probability

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 16_2_6C493760 rmsEncEncryptData,	16_2_6C493760
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 16_2_6C494000 rmsEncRsaPublicDecrypt,memcpy,memcpy,memcpy,	16_2_6C494000
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 16_2_6C493D30 rmsEncRsaPrivateDecrypt,memcpy,memcpy,memcpy,	16_2_6C493D30
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 16_2_6C4938C0 rmsEncDecryptData,	16_2_6C4938C0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 16_2_6C4942D0 rmsEncRsaPrivateEncrypt,memcpy,memcpy,memcpy,	16_2_6C4942D0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 16_2_6C493AE0 rmsEncRsaPublicEncrypt,memcpy,	16_2_6C493AE0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 16_2_6C4945A0 rmsEncInitSimpleEncryption,memcpy,memcpy,	16_2_6C4945A0

Source: rfusclient.exe, 00000010.00000000.1422949051.00000000010D9000.00000002.00000001.01000000.0000000B.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_713197f1-4

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Unpacked PE file: 16.2.rfusclient.exe.620000.0.unpack

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

File created: C:\ProgramData\Remote Manipulator System\install.log

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf

Jump to behavior

Source: J4zGPhVRV3.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: J4zGPhVRV3.exe, 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmp, J4zGPhVRV3.exe, 00000004.00000000.1278503492.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: d:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5840BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	4_2_00007FF69E5840BC
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E59B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	4_2_00007FF69E59B190
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5AFCA0 FindFirstFileExA,	4_2_00007FF69E5AFCA0

Source: global traffic	TCP traffic: 192.168.2.7:57244 -> 111.90.140.51:8080
Source: global traffic	TCP traffic: 192.168.2.7:57245 -> 65.21.245.7:8080
Source: global traffic	TCP traffic: 192.168.2.7:57248 -> 111.90.140.34:5651

Source: Joe Sandbox View

IP Address: 65.21.245.7 65.21.245.7

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.160.189
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.51
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.51
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.51
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.51
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.51
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.51
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.51
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.51
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.51
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.51
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.51
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.51
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 65.21.245.7
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34
Source: unknown	TCP traffic detected without corresponding DNS query: 111.90.140.34

Source: global traffic

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1614665709.0000000001FC7000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2204497712.00000000073A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: rutserv.exe, 00000015.00000003.2207010706.0000000001FB4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1614665709.0000000001FAD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3747982904.0000000001FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/
Source: rutserv.exe, 00000015.00000002.3747982904.0000000001FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3755525600.0000000002031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0V
Source: rutserv.exe, 00000015.00000003.2510641067.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2416091502.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2480577049.0000000002022000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3753492646.000000000201D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crlmF
Source: rutserv.exe, 00000015.00000003.2510641067.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1614665709.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2416091502.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2480577049.0000000002022000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2480577049.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3753492646.000000000201D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl
Source: rutserv.exe, 00000015.00000003.1614665709.000000000201D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl.
Source: rutserv.exe, 00000015.00000003.2510641067.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1614665709.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2416091502.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2480577049.0000000002022000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3753492646.000000000201D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl/
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2510641067.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2206774620.0000000007352000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2416091502.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2480577049.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3816497054.0000000007350000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3753492646.000000000201D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: rutserv.exe, 00000015.00000003.1612834790.00000000073BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crltyD
Source: rutserv.exe, 00000015.00000003.2207010706.0000000001FB4000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1614665709.0000000001FAD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3747982904.0000000001FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/p
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2203008371.0000000002031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: svchost.exe, 0000000A.00000002.2755374124.0000020074212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1614665709.0000000001FC7000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2204497712.00000000073A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: svchost.exe, 0000000A.00000003.1313129110.0000020074110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: rfusclient.exe, 00000010.00000000.1420516401.000000000066F000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 00000012.00000000.1464455991.00000000004F1000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000015.00000003.1552738592.000000007B750000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1563013943.000000007CC50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://madExcept.comU
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1614665709.0000000001FC7000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2204497712.00000000073A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: rutserv.exe, 00000015.00000003.2206774620.0000000007352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/
Source: rutserv.exe, 00000015.00000003.2206774620.0000000007352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/bX
Source: rutserv.exe, 00000015.00000003.1614665709.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2416091502.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2480577049.0000000002022000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3753492646.000000000201D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6N
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: rutserv.exe, 00000015.00000003.2203008371.0000000002031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr45http://crl.globalsign.com/codesigningrootr45.crlOF
Source: rutserv.exe, 00000015.00000003.2206774620.0000000007352000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2206774620.0000000007360000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1612834790.00000000073BD000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3816497054.0000000007360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBTLuA3ygnKW%2F7xuSx%2
Source: rutserv.exe, 00000015.00000003.2206774620.0000000007360000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3816497054.0000000007360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCUABBTLuA3ygnKW%2F7xuSx%2F0
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2510641067.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2206774620.0000000007352000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2416091502.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2480577049.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3816497054.0000000007350000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3753492646.000000000201D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: rutserv.exe, 00000015.00000003.2510641067.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2416091502.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2480577049.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3753492646.000000000201D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca2020http://crl.globalsign.com/gsgccr45codesignca2020.cr
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2203008371.0000000002031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: rutserv.exe, 00000015.00000003.2206774620.0000000007352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr3http://crl.globalsign.com/root-r3.crlbBby
Source: rutserv.exe, 00000015.00000002.3747982904.0000000001F48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com:80
Source: rutserv.exe, 00000012.00000000.1478283984.00000000019E5000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000015.00000002.3800200492.0000000004225000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3800200492.00000000041C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rmansys.ru/internet-id/
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: rfusclient.exe, 00000010.00000000.1420516401.000000000066F000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 00000012.00000000.1464455991.00000000004F1000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000015.00000003.1552738592.000000007B750000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1563013943.000000007CC50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3755525600.0000000002031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2510641067.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2206774620.0000000007352000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2416091502.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2480577049.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3816497054.0000000007350000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3753492646.000000000201D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: rutserv.exe, 00000015.00000003.1614665709.0000000002037000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3755525600.0000000002031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt1.3.6.1.5.5.7.48.1http://ocsp.globalsi
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2203008371.0000000002031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: rfusclient.exe, 00000010.00000000.1422949051.00000000010D9000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 00000012.00000000.1478283984.00000000019E5000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd
Source: svchost.exe, 00000002.00000002.3741897939.0000026853318000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3740763162.0000026852A87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://standards.iso.org/iso/19770/-2/2009/schema.xsd
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: rutserv.exe, 00000012.00000000.1464455991.00000000004F1000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://update.tektonit.ru/upgrade.ini
Source: rutserv.exe, 00000012.00000000.1464455991.00000000004F1000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://update.tektonit.ru/upgrade_beta.ini
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.flexerasoftware.com0
Source: rfusclient.exe, 00000010.00000003.1451319761.0000000003143000.00000004.00001000.00020000.00000000.sdmp, rfusclient.exe, 00000010.00000000.1420516401.0000000000E7D000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 00000012.00000003.1498771327.0000000003713000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000012.00000000.1464455991.0000000001471000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000013.00000003.1532539824.0000000003C03000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000014.00000003.1578680590.0000000003B53000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3759250551.000000000261C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: rfusclient.exe, 00000010.00000000.1422949051.00000000010D9000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 00000012.00000000.1478283984.00000000019E5000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.inkscape.org/namespaces/inkscape
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: rutserv.exe, 00000012.00000002.1516529381.000000006C9D7000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: rutserv.exe, 00000012.00000002.1516529381.000000006C9D7000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: rfusclient.exe, 00000010.00000002.1462099404.000000006C910000.00000002.00000001.01000000.0000000C.sdmp, rutserv.exe, 00000012.00000002.1516529381.000000006C9D7000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: svchost.exe, 0000000A.00000003.1313129110.0000020074169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000A.00000003.1313129110.0000020074110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: rutserv.exe, 00000012.00000002.1516529381.000000006C9EF000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://gcc.gnu.org/bugsrg/bugs/):
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B25A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rmansys.ru/IS_PREVENT_DOWNGRADE_EXITZ_DOWNGRADE_DETECTED;Z_UPGRADE_DETECTED;COMPANYNAME;INST
Source: rutserv.exe, 00000015.00000002.3759250551.000000000261C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rmansys.ru/remote-access/
Source: rutserv.exe, 00000015.00000002.3759250551.000000000261C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rmansys.ru/remote-access//rmansys.ru/remote-access/
Source: rutserv.exe, 00000015.00000002.3759250551.000000000261C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rmansys.ru/remote-access//rmansys.ru/remote-access/O
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2510641067.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1566536646.0000000001FA5000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2206774620.0000000007352000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3755525600.0000000002031000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2416091502.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2203008371.0000000002031000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2480577049.000000000201D000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3816497054.0000000007350000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3753492646.000000000201D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: rfusclient.exe, 00000010.00000000.1422949051.00000000010D9000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 00000012.00000000.1478283984.00000000019E5000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.remoteutilities.com/about/privacy-policy.php
Source: rfusclient.exe, 00000010.00000000.1422949051.00000000010D9000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 00000012.00000000.1478283984.00000000019E5000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.remoteutilities.com/buy/money-back-guarantee.php
Source: rfusclient.exe, 00000010.00000000.1422949051.00000000010D9000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 00000012.00000000.1478283984.00000000019E5000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.remoteutilities.com/support/docs/installing-and-uninstalling/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7	Jump to dropped file
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BD92F95DED26541D3AF7F44DC7914843	Jump to dropped file
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164	Jump to dropped file
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A62E94087F64223B9812F11186592BA	Jump to dropped file
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 16.0.rfusclient.exe.620000.0.unpack, type: UNPACKEDPE	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, type: DROPPED	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, type: DROPPED	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe

Code function: 4_2_00007FF69E57C2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

4_2_00007FF69E57C2F0

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Code function: 21_2_0096E6AC CreateProcessAsUserW,CreateProcessAsUserW,CreateProcessW,

21_2_0096E6AC

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\41737e.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7E5B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{827D98D4-CA0D-43D0-8133-225659FBBC61}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8830.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\417381.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\417381.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\ARPPRODUCTICON.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A62E94087F64223B9812F11186592BA
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A62E94087F64223B9812F11186592BA
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BD92F95DED26541D3AF7F44DC7914843
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BD92F95DED26541D3AF7F44DC7914843

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI7E5B.tmp

Jump to behavior

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E575E24	4_2_00007FF69E575E24
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E59CE88	4_2_00007FF69E59CE88
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E591F20	4_2_00007FF69E591F20
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5A0754	4_2_00007FF69E5A0754
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E584928	4_2_00007FF69E584928
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E57F930	4_2_00007FF69E57F930
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E58A4AC	4_2_00007FF69E58A4AC
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E593484	4_2_00007FF69E593484
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E59B190	4_2_00007FF69E59B190
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5B2080	4_2_00007FF69E5B2080
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E592D58	4_2_00007FF69E592D58
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5A0754	4_2_00007FF69E5A0754
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E598DF4	4_2_00007FF69E598DF4
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E58AF18	4_2_00007FF69E58AF18
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E594B98	4_2_00007FF69E594B98
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E58BB90	4_2_00007FF69E58BB90
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E585B60	4_2_00007FF69E585B60
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5A8C1C	4_2_00007FF69E5A8C1C
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5A89A0	4_2_00007FF69E5A89A0
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E593964	4_2_00007FF69E593964
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E58C96C	4_2_00007FF69E58C96C
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E571AA4	4_2_00007FF69E571AA4
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E592AB0	4_2_00007FF69E592AB0
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5AFA94	4_2_00007FF69E5AFA94
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E581A48	4_2_00007FF69E581A48
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5B5AF8	4_2_00007FF69E5B5AF8
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5AC838	4_2_00007FF69E5AC838
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E574840	4_2_00007FF69E574840
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5B2550	4_2_00007FF69E5B2550
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5776C0	4_2_00007FF69E5776C0
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5953F0	4_2_00007FF69E5953F0
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E58B534	4_2_00007FF69E58B534
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E58F180	4_2_00007FF69E58F180
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5921D0	4_2_00007FF69E5921D0
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E577288	4_2_00007FF69E577288
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E58126C	4_2_00007FF69E58126C
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E57A310	4_2_00007FF69E57A310
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E57C2F0	4_2_00007FF69E57C2F0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 16_2_6C546850	16_2_6C546850
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 16_2_6C8D7080	16_2_6C8D7080
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 16_2_6C845AE0	16_2_6C845AE0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Code function: 16_2_6C845800	16_2_6C845800
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Code function: 21_2_0096E6AC	21_2_0096E6AC

Source: unires_vpd.dll.8.dr	Static PE information: Resource name: None type: COM executable for DOS
Source: unires_vpd.dll0.8.dr	Static PE information: Resource name: None type: COM executable for DOS
Source: rutserv.exe.8.dr	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: rfusclient.exe.8.dr	Static PE information: Resource name: RT_STRING type: PDP-11 separate I&D executable not stripped
Source: rfusclient.exe.8.dr	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: unidrvui_rppd.dll0.8.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: libasset32.dll.8.dr	Static PE information: Number of sections : 19 > 10
Source: libcodec32.dll.8.dr	Static PE information: Number of sections : 20 > 10
Source: rutserv.exe.8.dr	Static PE information: Number of sections : 11 > 10
Source: rfusclient.exe.8.dr	Static PE information: Number of sections : 11 > 10

Source: unires_vpd.dll0.8.dr	Static PE information: No import functions for PE file found
Source: unires_vpd.dll.8.dr	Static PE information: No import functions for PE file found

Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameISRegSvr.dll vs J4zGPhVRV3.exe
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B303000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs J4zGPhVRV3.exe
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B35A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs J4zGPhVRV3.exe
Source: J4zGPhVRV3.exe, 00000004.00000003.1298816778.00000183794B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsiexec.exe.muiX vs J4zGPhVRV3.exe
Source: J4zGPhVRV3.exe, 00000004.00000002.1303027978.00000183794B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsiexec.exe.muiX vs J4zGPhVRV3.exe
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs J4zGPhVRV3.exe
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B277000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSetAllUsers.dll< vs J4zGPhVRV3.exe
Source: J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B3BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs J4zGPhVRV3.exe

Source: 16.0.rfusclient.exe.620000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, type: DROPPED	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, type: DROPPED	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT

Source: unires_vpd.dll0.8.dr	Static PE information: Section .rsrc
Source: unires_vpd.dll.8.dr	Static PE information: Section .rsrc

Source: classification engine

Classification label: mal88.evad.winEXE@48/135@2/5

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe

Code function: 4_2_00007FF69E57B6D8 GetLastError,FormatMessageW,LocalFree,

4_2_00007FF69E57B6D8

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe

Code function: 4_2_00007FF69E598624 FindResourceExW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

4_2_00007FF69E598624

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Code function: 21_2_00A03498 StartServiceCtrlDispatcherW,

21_2_00A03498

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Code function: 21_2_00A03498 StartServiceCtrlDispatcherW,

21_2_00A03498

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Manipulator System - Host

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$216c
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RManFUSTray
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$20c0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: NULL
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$213c
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$2218
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5832:120:WilError_03
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \BaseNamedObjects\HookTThread$21b0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$218c
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RManFUSLocal
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \BaseNamedObjects\madExceptSettingsMtx$21b0
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$2218
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$2210
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Mutant created: \BaseNamedObjects\madExceptSettingsMtx$21ec
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$f50
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$2210

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_4287359

Jump to behavior

Source: J4zGPhVRV3.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: J4zGPhVRV3.exe

ReversingLabs: Detection: 47%

Source: rfusclient.exe	String found in binary or memory: ENGINESDIR: "E:/dev/vcpkg/installed/x86-mingw-static/lib/engines-3"
Source: rfusclient.exe	String found in binary or memory: MODULESDIR: "E:/dev/vcpkg/installed/x86-mingw-static/lib/ossl-modules"
Source: rfusclient.exe	String found in binary or memory: E:/dev/vcpkg/installed/x86-mingw-static/lib/engines-3
Source: rfusclient.exe	String found in binary or memory: E:/dev/vcpkg/installed/x86-mingw-static/lib/ossl-modules

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe

File read: C:\Users\user\Desktop\J4zGPhVRV3.exe

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Users\user\Desktop\J4zGPhVRV3.exe "C:\Users\user\Desktop\J4zGPhVRV3.exe"
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\file.pdf"
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user~1\AppData\Local\Temp\winrar.msi" /qn
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1740,i,9168305141304841160,3939740794304371731,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 454D404CF2CD6CFC0CCDA935FCCB9601
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\Users\user~1\AppData\Local\Temp\winrar.msi"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
Source: unknown	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -service
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\file.pdf"	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user~1\AppData\Local\Temp\winrar.msi" /qn	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 454D404CF2CD6CFC0CCDA935FCCB9601	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\Users\user~1\AppData\Local\Temp\winrar.msi"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1740,i,9168305141304841160,3939740794304371731,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray

Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: w32time.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptnet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: webio.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_is2022.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_g18030.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: c_iscii.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: shfolder.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: faultrep.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dbgcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: libasset32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: security.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: idndl.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: msxml6.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Section loaded: wtsapi32.dll

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File written: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.ini

Jump to behavior

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: J4zGPhVRV3.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: J4zGPhVRV3.exe

Static file information: File size 25298721 > 1048576

Source: J4zGPhVRV3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: J4zGPhVRV3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: J4zGPhVRV3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: J4zGPhVRV3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: J4zGPhVRV3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: J4zGPhVRV3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: J4zGPhVRV3.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: J4zGPhVRV3.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: J4zGPhVRV3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: J4zGPhVRV3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: J4zGPhVRV3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: J4zGPhVRV3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: J4zGPhVRV3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Unpacked PE file: 16.2.rfusclient.exe.620000.0.unpack

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_4287359

Jump to behavior

Source: J4zGPhVRV3.exe	Static PE information: section name: .didat
Source: J4zGPhVRV3.exe	Static PE information: section name: _RDATA
Source: eventmsg.dll.8.dr	Static PE information: section name: .didata
Source: webmvorbisencoder.dll.8.dr	Static PE information: section name: _RDATA
Source: vp8encoder.dll.8.dr	Static PE information: section name: .rodata
Source: vp8decoder.dll.8.dr	Static PE information: section name: .rodata
Source: webmvorbisdecoder.dll.8.dr	Static PE information: section name: _RDATA
Source: libasset32.dll.8.dr	Static PE information: section name: /4
Source: libasset32.dll.8.dr	Static PE information: section name: /14
Source: libasset32.dll.8.dr	Static PE information: section name: /29
Source: libasset32.dll.8.dr	Static PE information: section name: /41
Source: libasset32.dll.8.dr	Static PE information: section name: /55
Source: libasset32.dll.8.dr	Static PE information: section name: /67
Source: libasset32.dll.8.dr	Static PE information: section name: /78
Source: libasset32.dll.8.dr	Static PE information: section name: /94
Source: libasset32.dll.8.dr	Static PE information: section name: /110
Source: libcodec32.dll.8.dr	Static PE information: section name: .rodata
Source: libcodec32.dll.8.dr	Static PE information: section name: /4
Source: libcodec32.dll.8.dr	Static PE information: section name: /14
Source: libcodec32.dll.8.dr	Static PE information: section name: /29
Source: libcodec32.dll.8.dr	Static PE information: section name: /41
Source: libcodec32.dll.8.dr	Static PE information: section name: /55
Source: libcodec32.dll.8.dr	Static PE information: section name: /67
Source: libcodec32.dll.8.dr	Static PE information: section name: /78
Source: libcodec32.dll.8.dr	Static PE information: section name: /94
Source: libcodec32.dll.8.dr	Static PE information: section name: /110
Source: vccorlib120.dll.8.dr	Static PE information: section name: minATL
Source: rutserv.exe.8.dr	Static PE information: section name: .didata
Source: rfusclient.exe.8.dr	Static PE information: section name: .didata
Source: vccorlib120.dll0.8.dr	Static PE information: section name: minATL
Source: eventmsg.dll.21.dr	Static PE information: section name: .didata

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5B5156 push rsi; retf		4_2_00007FF69E5B5157
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5B5166 push rsi; retf		4_2_00007FF69E5B5167

Source: VPDAgent.exe.8.dr	Static PE information: section name: .text entropy: 6.812931691200469
Source: msvcr120.dll.8.dr	Static PE information: section name: .text entropy: 6.95576372950548

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7E5B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	Jump to dropped file
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	File created: C:\ProgramData\Remote Manipulator System\eventmsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\libasset32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\libcodec32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll	Jump to dropped file

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

File created: C:\ProgramData\Remote Manipulator System\eventmsg.dll

Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7E5B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	Jump to dropped file

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

File created: C:\ProgramData\Remote Manipulator System\install.log

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf

Jump to behavior

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Remote Manipulator System - host\Remote Manipulator System - host service

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Config

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Code function: 21_2_00A03498 StartServiceCtrlDispatcherW,

21_2_00A03498

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Registry key monitored for changes: HKEY_USERS.DEFAULT\Software\Classes
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Windows\System32\msiexec.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\RMS Host Installer Security

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: rutserv.exe, 00000012.00000000.1464455991.0000000000EF1000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000014.00000002.1613537037.0000000002148000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: rutserv.exe, 00000012.00000002.1504952203.0000000001C28000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000014.00000002.1613537037.0000000002148000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEE
Source: rutserv.exe, 00000012.00000002.1504952203.0000000001C28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: rutserv.exe, 00000012.00000002.1504952203.0000000001C28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE9

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Window / User API: threadDelayed 1576
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Window / User API: threadDelayed 1747
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Window / User API: threadDelayed 3038
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Window / User API: threadDelayed 9535

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7E5B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	Jump to dropped file
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Dropped PE file which has not been started: C:\ProgramData\Remote Manipulator System\eventmsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\ARPPRODUCTICON.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\libcodec32.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll	Jump to dropped file

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

API coverage: 1.4 %

Source: C:\Windows\System32\svchost.exe TID: 7640	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7660	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8656	Thread sleep count: 1576 > 30
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8656	Thread sleep time: -1576000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8680	Thread sleep time: -50000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8752	Thread sleep time: -180000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8772	Thread sleep time: -60000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8736	Thread sleep count: 1747 > 30
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8904	Thread sleep time: -60000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8628	Thread sleep count: 40 > 30
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8628	Thread sleep count: 51 > 30
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8628	Thread sleep count: 40 > 30
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8656	Thread sleep count: 3038 > 30
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe TID: 8656	Thread sleep time: -3038000s >= -30000s
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe TID: 9036	Thread sleep time: -4767500s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5840BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	4_2_00007FF69E5840BC
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E59B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	4_2_00007FF69E59B190
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5AFCA0 FindFirstFileExA,	4_2_00007FF69E5AFCA0

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe

Code function: 4_2_00007FF69E5A16A4 VirtualQuery,GetSystemInfo,

4_2_00007FF69E5A16A4

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Thread delayed: delay time: 50000
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Thread delayed: delay time: 60000
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Thread delayed: delay time: 60000

Source: svchost.exe, 0000000A.00000002.2747249915.000002006EC2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW l%t
Source: rfusclient.exe, 00000010.00000002.1454050125.000000000178C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllw
Source: svchost.exe, 00000001.00000002.3737049606.0000022CEE24E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: svchost.exe, 00000001.00000002.3736668443.0000022CEE238000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: rutserv.exe, 00000012.00000000.1478283984.00000000015A8000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: +YQEmU0
Source: svchost.exe, 00000001.00000002.3738500353.0000022CEE285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000001.00000002.3736668443.0000022CEE22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000001.00000002.3738141196.0000022CEE265000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000g
Source: svchost.exe, 0000000A.00000002.2755702839.0000020074254000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2206774620.0000000007352000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3747982904.0000000001F48000.00000004.00000020.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.2207010706.0000000001F7A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000001.00000002.3736339596.0000022CEE200000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 00000001.00000002.3736668443.0000022CEE22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: svchost.exe, 00000001.00000002.3739147823.0000022CEE302000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000001.00000002.3737049606.0000022CEE24E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000C.00000002.3739280742.000002699A431000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe

Code function: 4_2_00007FF69E5A76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_00007FF69E5A76D8

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe

Code function: 4_2_00007FF69E5B0D20 GetProcessHeap,

4_2_00007FF69E5B0D20

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start

Jump to behavior

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5A76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FF69E5A76D8
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5A3354 SetUnhandledExceptionFilter,	4_2_00007FF69E5A3354
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5A2510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00007FF69E5A2510
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Code function: 4_2_00007FF69E5A3170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FF69E5A3170

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe

Code function: 4_2_00007FF69E59B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

4_2_00007FF69E59B190

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\file.pdf"	Jump to behavior
Source: C:\Users\user\Desktop\J4zGPhVRV3.exe	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user~1\AppData\Local\Temp\winrar.msi" /qn	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall	Jump to behavior

Source: rfusclient.exe, 00000010.00000000.1420516401.000000000066F000.00000020.00000001.01000000.0000000B.sdmp

Binary or memory string: Shell_TrayWndTrayNotifyWndSV

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe

Code function: 4_2_00007FF69E58DC70 cpuid

4_2_00007FF69E58DC70

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

4_2_00007FF69E59A2CC

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Code function: 21_2_00CFB958 CreateNamedPipeW,ConnectNamedPipe,ReadFile,DisconnectNamedPipe,

21_2_00CFB958

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe

Code function: 4_2_00007FF69E5A0754 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

4_2_00007FF69E5A0754

Source: C:\Users\user\Desktop\J4zGPhVRV3.exe

Code function: 4_2_00007FF69E584EB0 GetVersionExW,

4_2_00007FF69E584EB0

Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE

Jump to behavior

Source: rutserv.exe, 00000012.00000000.1464455991.0000000000EF1000.00000020.00000001.01000000.0000000D.sdmp	Binary or memory string: OLLYDBG.EXE
Source: svchost.exe, 00000003.00000002.3742830304.000001D0D1D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: rutserv.exe, 00000014.00000002.1613537037.0000000002148000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe

Source: C:\Windows\System32\msiexec.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD Blob

Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Source: Yara match	File source: 16.0.rfusclient.exe.620000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000000.1422949051.00000000010D9000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3760276212.0000000004DF8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3745548454.000000000329A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3748231450.000000000325A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3745548454.0000000003276000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3800200492.00000000041C8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3748231450.0000000003228000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3760276212.0000000004E3C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.1568447250.0000000005E6A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.1478283984.00000000019E5000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3759250551.00000000026C8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rfusclient.exe PID: 8384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rutserv.exe PID: 8508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rutserv.exe PID: 8624, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	12 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	1 Replication Through Removable Media	2 Command and Scripting Interpreter	1 Valid Accounts	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	22 Windows Service	1 Valid Accounts	12 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Access Token Manipulation	1 DLL Side-Loading	NTDS	66 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	22 Windows Service	1 File Deletion	LSA Secrets	1 Query Registry	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	13 Process Injection	22 Masquerading	Cached Domain Credentials	361 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	131 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	131 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	13 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
J4zGPhVRV3.exe	47%	ReversingLabs	Win64.Spyware.TektonIt

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll	2%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll	2%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe	2%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll	4%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll	2%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll	3%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\libasset32.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\libcodec32.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe	26%	ReversingLabs	Win32.Spyware.TektonIt
C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe	26%	ReversingLabs	Win32.Spyware.TektonIt
C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll	0%	ReversingLabs
C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll	0%	ReversingLabs
C:\ProgramData\Remote Manipulator System\eventmsg.dll	3%	ReversingLabs
C:\Windows\Installer\MSI7E5B.tmp	0%	ReversingLabs
C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\ARPPRODUCTICON.exe	0%	ReversingLabs
C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe	0%	ReversingLabs
C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe	0%	ReversingLabs
C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_start_C00864331B9D4391A8A26292A601EBE2.exe	0%	ReversingLabs
C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV21C:	0%	URL Reputation	safe
http://www.indyproject.org/	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe
https://g.live.com/odclientsettings/Prod1C:	0%	URL Reputation	safe
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	0%	URL Reputation	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		unknown
time.windows.com	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.remoteutilities.com/support/docs/installing-and-uninstalling/	rfusclient.exe, 00000010.00000000.1422949051.00000000010D9000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 00000012.00000000.1478283984.00000000019E5000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
https://curl.se/docs/http-cookies.html	rfusclient.exe, 00000010.00000002.1462099404.000000006C910000.00000002.00000001.01000000.0000000C.sdmp, rutserv.exe, 00000012.00000002.1516529381.000000006C9D7000.00000002.00000001.01000000.0000000C.sdmp	false		unknown
http://update.tektonit.ru/upgrade.ini	rutserv.exe, 00000012.00000000.1464455991.00000000004F1000.00000020.00000001.01000000.0000000D.sdmp	false		unknown
http://update.tektonit.ru/upgrade_beta.ini	rutserv.exe, 00000012.00000000.1464455991.00000000004F1000.00000020.00000001.01000000.0000000D.sdmp	false		unknown
http://madExcept.comU	rfusclient.exe, 00000010.00000000.1420516401.000000000066F000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 00000012.00000000.1464455991.00000000004F1000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000015.00000003.1552738592.000000007B750000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1563013943.000000007CC50000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/envelope/	rfusclient.exe, 00000010.00000000.1420516401.000000000066F000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 00000012.00000000.1464455991.00000000004F1000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000015.00000003.1552738592.000000007B750000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000015.00000003.1563013943.000000007CC50000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000A.00000003.1313129110.0000020074110000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 0000000A.00000002.2755374124.0000020074212000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.indyproject.org/	rfusclient.exe, 00000010.00000003.1451319761.0000000003143000.00000004.00001000.00020000.00000000.sdmp, rfusclient.exe, 00000010.00000000.1420516401.0000000000E7D000.00000020.00000001.01000000.0000000B.sdmp, rutserv.exe, 00000012.00000003.1498771327.0000000003713000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000012.00000000.1464455991.0000000001471000.00000020.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000013.00000003.1532539824.0000000003C03000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000014.00000003.1578680590.0000000003B53000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3759250551.000000000261C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://curl.se/docs/alt-svc.html	rutserv.exe, 00000012.00000002.1516529381.000000006C9D7000.00000002.00000001.01000000.0000000C.sdmp	false		unknown
http://www.symauth.com/cps0(	J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://rmansys.ru/internet-id/	rutserv.exe, 00000012.00000000.1478283984.00000000019E5000.00000002.00000001.01000000.0000000D.sdmp, rutserv.exe, 00000015.00000002.3800200492.0000000004225000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000015.00000002.3800200492.00000000041C8000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://standards.iso.org/iso/19770/-2/2009/schema.xsd	svchost.exe, 00000002.00000002.3741897939.0000026853318000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3740763162.0000026852A87000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://curl.se/docs/hsts.html	rutserv.exe, 00000012.00000002.1516529381.000000006C9D7000.00000002.00000001.01000000.0000000C.sdmp	false		unknown
https://g.live.com/odclientsettings/Prod1C:	svchost.exe, 0000000A.00000003.1313129110.0000020074169000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gcc.gnu.org/bugsrg/bugs/):	rutserv.exe, 00000012.00000002.1516529381.000000006C9EF000.00000002.00000001.01000000.0000000C.sdmp	false		unknown
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	rfusclient.exe, 00000010.00000000.1422949051.00000000010D9000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 00000012.00000000.1478283984.00000000019E5000.00000002.00000001.01000000.0000000D.sdmp	false	URL Reputation: safe	unknown
http://www.symauth.com/rpa00	J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rmansys.ru/remote-access//rmansys.ru/remote-access/	rutserv.exe, 00000015.00000002.3759250551.000000000261C000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://rmansys.ru/remote-access//rmansys.ru/remote-access/O	rutserv.exe, 00000015.00000002.3759250551.000000000261C000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://rmansys.ru/remote-access/	rutserv.exe, 00000015.00000002.3759250551.000000000261C000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.flexerasoftware.com0	J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2B5000.00000004.00000020.00020000.00000000.sdmp, J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B2F2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://rmansys.ru/IS_PREVENT_DOWNGRADE_EXITZ_DOWNGRADE_DETECTED;Z_UPGRADE_DETECTED;COMPANYNAME;INST	J4zGPhVRV3.exe, 00000004.00000003.1291857327.000001837B25A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.inkscape.org/namespaces/inkscape	rfusclient.exe, 00000010.00000000.1422949051.00000000010D9000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 00000012.00000000.1478283984.00000000019E5000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
https://www.remoteutilities.com/buy/money-back-guarantee.php	rfusclient.exe, 00000010.00000000.1422949051.00000000010D9000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 00000012.00000000.1478283984.00000000019E5000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
https://www.remoteutilities.com/about/privacy-policy.php	rfusclient.exe, 00000010.00000000.1422949051.00000000010D9000.00000002.00000001.01000000.0000000B.sdmp, rutserv.exe, 00000012.00000000.1478283984.00000000019E5000.00000002.00000001.01000000.0000000D.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
111.90.140.51	unknown	Malaysia	45839	SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	false
111.90.140.34	unknown	Malaysia	45839	SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	false
96.6.160.189	unknown	United States	16625	AKAMAI-ASUS	false
65.21.245.7	unknown	United States	199592	CP-ASDE	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544725
Start date and time:	2024-10-29 16:50:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	J4zGPhVRV3.exe renamed because original name is a hash value
Original Sample Name:	55cb5fa83a98b9d7cc70cad5fe59f44f8d48956b363df2fbf7ad649b9c4970e5.exe
Detection:	MAL
Classification:	mal88.evad.winEXE@48/135@2/5
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 20.101.57.9, 184.28.88.176, 172.64.41.3, 162.159.61.3, 52.5.13.197, 54.227.187.23, 23.22.254.206, 52.202.204.11, 184.28.90.27, 2.23.197.184, 93.184.221.240, 2.19.126.149, 2.19.126.143, 104.18.20.226, 104.18.21.226
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, cdn.globalsigncdn.com.cdn.cloudflare.net, twc.trafficmanager.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wu.azureedge.net, acroipm2.adobe.com, ocsp.globalsign.com, dns.msftncsi.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, global.prd.cdn.globalsign.com, crl.globalsign.com, geo2.adobe.com
Execution Graph export aborted for target rutserv.exe, PID 8508 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: J4zGPhVRV3.exe

Simulations

Behavior and APIs

Time	Type	Description
11:51:47	API Interceptor	3x Sleep call for process: svchost.exe modified
11:51:57	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
13:01:30	API Interceptor	2718268x Sleep call for process: rutserv.exe modified
13:01:37	API Interceptor	799706x Sleep call for process: rfusclient.exe modified
13:02:03	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
111.90.140.34	044f.pdf.scr	Get hash	malicious	RMSRemoteAdmin	Browse
65.21.245.7	FPPhfkcDCh.exe	Get hash	malicious	Remcos	Browse
	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	0438.pdf.exe	Get hash	malicious	Unknown	Browse
	044f.pdf.scr	Get hash	malicious	RMSRemoteAdmin	Browse
	3e#U043c.scr	Get hash	malicious	RMSRemoteAdmin	Browse
	3e#U043c.scr	Get hash	malicious	RMSRemoteAdmin	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	FPPhfkcDCh.exe	Get hash	malicious	Remcos	Browse	101.99.93.169
	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse	111.90.140.76
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	111.90.140.76
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	111.90.140.76
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	111.90.140.76
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	111.90.140.76
	b.cmd	Get hash	malicious	Unknown	Browse	101.99.92.203
	rrwzOU7A9F.exe	Get hash	malicious	XWorm	Browse	101.99.92.203
	3xlcP3DFLm.exe	Get hash	malicious	XWorm	Browse	101.99.92.203
	JruZmEO5Dm.exe	Get hash	malicious	XWorm	Browse	101.99.92.203
SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY	FPPhfkcDCh.exe	Get hash	malicious	Remcos	Browse	101.99.93.169
	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse	111.90.140.76
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	111.90.140.76
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	111.90.140.76
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	111.90.140.76
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	111.90.140.76
	b.cmd	Get hash	malicious	Unknown	Browse	101.99.92.203
	rrwzOU7A9F.exe	Get hash	malicious	XWorm	Browse	101.99.92.203
	3xlcP3DFLm.exe	Get hash	malicious	XWorm	Browse	101.99.92.203
	JruZmEO5Dm.exe	Get hash	malicious	XWorm	Browse	101.99.92.203
CP-ASDE	FPPhfkcDCh.exe	Get hash	malicious	Remcos	Browse	65.21.245.7
	gBYz86HSwI.msi	Get hash	malicious	Unknown	Browse	65.21.245.7
	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	65.21.245.7
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	65.21.245.7
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	65.21.245.7
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	65.21.245.7
	iQPxJrxxaj.exe	Get hash	malicious	PikaBot	Browse	65.20.66.218
	iQPxJrxxaj.exe	Get hash	malicious	PikaBot	Browse	65.20.66.218
	http://www.thegioimoicau.com/	Get hash	malicious	Unknown	Browse	65.21.45.74
AKAMAI-ASUS	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.50.140
	Oakville_Service_Update_d76b33a1-3420-40be-babd-e82e253ad25c.pdf	Get hash	malicious	HTMLPhisher	Browse	184.28.88.176
	CARDFACTORYAccess Program, Tuesday, October 29, 2024.eml	Get hash	malicious	HTMLPhisher	Browse	23.38.98.84
	buNtKcYHCa.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Jo Smalley shared _Harbour Healthcare Ltd Project_ with you..eml	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27
	Jo Smalley shared _Harbour Healthcare Ltd Project_ with you..eml	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	96.17.237.137
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.50.150
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.50.145
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	104.93.21.152

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe	SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	044f.pdf.scr	Get hash	malicious	RMSRemoteAdmin	Browse
	3e#U043c.scr	Get hash	malicious	RMSRemoteAdmin	Browse
	3e#U043c.scr	Get hash	malicious	RMSRemoteAdmin	Browse
	GkLbUGixzx.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	GkLbUGixzx.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	3C77C16EE21FF2F584B1EB5DF4882976A934D50D1D4E0.exe	Get hash	malicious	RMSRemoteAdmin	Browse

Created / dropped Files

C:\Config.Msi\417380.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	30807
Entropy (8bit):	5.366179396583254
Encrypted:	false
SSDEEP:	768:Tyt4t4t+gTp1M3Ub0iM01HuECiwAw0Nwsj9jet1h/0:6Tpy3Ub0eHuECiwAwwwsj9jetb0
MD5:	FD8976471AAAEA4921D0EA6C6B049C02
SHA1:	03D9CB396E947FB953FC01928D77D942D03090A4
SHA-256:	29C2329B35D8FE965A9636FC8452275705C4179D4F269E8B11CD245156ED16E0
SHA-512:	5A270216D31A7E4DFD4BDD4D33BBD844B7D32D9485BA62A55B7451F307CA722A165793182846F397ECBD0E3EF7438C242783450ED2DA1B7007BB76051CA5983F
Malicious:	false
Preview:	...@IXOS.@.....@{^]Y.@.....@.....@.....@.....@.....@......&.{827D98D4-CA0D-43D0-8133-225659FBBC61} .Remote Manipulator System - Host..winrar.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{C457692F-C69F-4EF4-B4C9-3DF451F76F30}.....@.....@.....@.....@.......@.....@.....@.......@.... .Remote Manipulator System - Host......Rollback....B.:.0.B. .4.5.9.A.B.2.8.O.:...[1]..RollbackCleanup..#.4.0.;.5.=.8.5. .2.@.5.<.5.=.=.K.E. .D.0.9.;.>.2...$.0.9.;.:. .[.1.].....ProcessComponents"...1.=.>.2.;.5.=.8.5. .@.5.3.8.A.B.@.0.F.8.8. .:.>.<.?.>.=.5.=.B.>.2...&.{74F2505E-B20A-4AED-968F-AE5B278DB38A}&.{827D98D4-CA0D-43D0-8133-225659FBBC61}.@......&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}&.{827D98D4-CA0D-43D0-8133-225659FBBC61}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{827D98D4-CA0D-43D0-8133-225659FBBC61}.@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}&.{00000000-0000-0000-0000-000000000000}.@......&.{182310A2-CD9E-4171-ACD1-3AEDD260A15F}&.{827D98D4-CA0D-43D0-8133-225659FBBC61}.@......&.{3244

C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	140524
Entropy (8bit):	4.705761523836363
Encrypted:	false
SSDEEP:	768:wu3K4JDvJNJt2cGTXxl5loUWDTEhkClEgoKt9ai1IYdO5NVSUeDfydxqXJe2JNC0:wu93dN2OqrYZlKhIiSEGQ4wL
MD5:	65B04B706AC06E31210F4FFB1E92994E
SHA1:	B005637B3DE903CBD7960637D77FF993897C5A63
SHA-256:	E9ACC22A02BC2148AE07EC7CBE741E6E1CBC90DE3856AAE8F32A31FB5C338566
SHA-512:	5B708D069434A384738EFD5F4621F257FC79A7F5A32D8AE9C1D29E21EFE1EEB2C393EC67DA39714C0C73F2217B68091EE7196C72331838A0A7ECA872FAF09A09
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}..{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0204

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15680
Entropy (8bit):	6.579534230870796
Encrypted:	false
SSDEEP:	192:XxgSABvdm4Yy3EA39QKoEp0Fm7qFAmL8x2fLWwsU7K6CYv7+C:Xx0FmW3Ea1KmexmMK6jr
MD5:	C2F009D6317D1BA4E722938A1408478A
SHA1:	66D702BC9FA98D1E7FE9BBC16AFF9AE711019E9B
SHA-256:	6A8D4FB6F90B53D986B2AC6BF3BFCC56D6A54A2E8AF5670129566F5D344ED0FA
SHA-512:	4D8060EC77EB9B95B57BC20AF2685064FA1E1FCC9403EFE95572C37D72ACD39B8005831EA0BAE95C365E945E50962B7FE1BFD964C5776D3E99CE5E474F726BFE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe, Detection: malicious, Browse Filename: 044f.pdf.scr, Detection: malicious, Browse Filename: 3e#U043c.scr, Detection: malicious, Browse Filename: 3e#U043c.scr, Detection: malicious, Browse Filename: GkLbUGixzx.exe, Detection: malicious, Browse Filename: GkLbUGixzx.exe, Detection: malicious, Browse Filename: 3C77C16EE21FF2F584B1EB5DF4882976A934D50D1D4E0.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3.j.]Oj.]Oj.]Og..Oh.]Og..Oh.]Og..Oy.]Og..Oh.]Oc..Oc.]Oj.\OY.]O..Ok.]Og..Ok.]O..Ok.]ORichj.]O........................PE..L......S..................................... ....@..........................`.......J....@.................................."..x....@..................@....P..\|....!..8............................!..@............ ...............................text...2........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..\|....P......................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2673984
Entropy (8bit):	6.865614554810881
Encrypted:	false
SSDEEP:	49152:BE8JxHX5r9sDQl7wDSMSFxvQ/qpyr0k0ha5XLDaDMPNw2x8pWTUKA76AeF8:BE8XHX5riUl7wDP6vQ/qpyr0kR5XLWDB
MD5:	10CD2135C0C5D9D3E5A0A5B679F2FAAE
SHA1:	A0617D8C6876F98B9A1819A71F2A56B965C1C75D
SHA-256:	D7A97387505CA740AC88E85CAC3AA3CA73C666CC3BFD977C7E40B1D9D6CA6C12
SHA-512:	6A1F81127FF26DCC235D7CE454E69F9A3784AC54BBC8486CB5022AAC47C2FB6003641A0F8AAFDD3B89812FE3C1C90569AD73C1C135687C042CE92C5DD2FFBDD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............zz..zz..zz.M...zz.+...zz.+...zz.+...zz.+...zz.f...zz..zz..zz.f..Oxz..z{..{z......zz.f...zz..(...zz..z...zz.f...zz.Rich.zz.........PE..L...h3.\............................5u............@.......................... ).......(...@.................................<.&.......'.H.............(.@.....'..n..................................0:&.@............................................text...5........................... ..`.rdata..............................@..@.data...<.....&..d....&.............@....rsrc...H.....'......8'.............@..@.reloc...n....'..p...>'.............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1110848
Entropy (8bit):	6.491478844569486
Encrypted:	false
SSDEEP:	24576:TqSQS800orApz53PI2GVqH7kpf/V57GGcP6T5m+moXafzb:tQSX0oAtkpf/bfcyTTmoozb
MD5:	AB3E77FC94445A18C9376F98CE10102F
SHA1:	9424736FB3DB517C5584A14A482F84D81A671F8D
SHA-256:	EEE325D9AC6A7B24B8ED3742110BD042803D6DA065F2E51153151E69D51CE4A3
SHA-512:	454115C621434E98D39AEC605FCEB349C7AFB938B3E822F5950EE60E54FBFCB5CDBFE750015FE947C07FB991B4E966E535640343294D885ED2661353D3FD6EC9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........[.:..:..:....l.:....n.7:....o.:..d..:..d...:..d..:..u.V.:..?d...:..?d..:..?d..:..:..T:..?d..:..?d..:..:db.:..?d..:..Rich.:..........................PE..L......\...........!......................................................................@.............................\|....&..d.......................@........l......p...............................@............................................text............................... ..`.rdata..p;.......<..................@..@.data...H;...@...*..................@....gfids..$............X..............@..@.rsrc................d..............@..@.reloc...l.......n...f..............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22848
Entropy (8bit):	6.464002114523214
Encrypted:	false
SSDEEP:	384:2+b57Gk7g+iy21oCiDuK9jkrtpgjKMpFmexmMK6j8qF2:7/210DuVrtsKM3ZxBKghF2
MD5:	2DE35EAAE57A6BAA02D9E8ED0661F042
SHA1:	82D14A58D5188F5B7606365BE0E3F968A8E81E93
SHA-256:	BB43036D202D3DBD765A12D1C4C243E7AB8328FFC1941AEA838D8B1553700E64
SHA-512:	02F1D530C1469431A94074A057FCE3FE60735D3B15DD767E8F39F29B702B98B061954063D83D5FA426D7684CC86359E87424F0CC54FFB0AC3F388AA7E48D6DE0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9Gf.}&.I}&.I}&.I;w.I\|&.I;w.In&.I;w.Iy&.I;w.Iy&.It^.Ix&.I}&.I?&.I..I\|&.Ipt.I\|&.I}&.I\|&.I..I\|&.IRich}&.I................PE..L...k3.\.....................8......e".......0....@.......................................@.................................49..d....`..@............:..@....p......@1..8............................5..@............0...............................text...k........................... ..`.rdata..:....0......................@..@.data........@......................@....rsrc...@....`.......0..............@..@.reloc.......p.......6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4005696
Entropy (8bit):	6.809616089473951
Encrypted:	false
SSDEEP:	98304:lbR+lDT6t58JcKdTG57M06POn9rvBAUZLM8FAK:FR+lDOt5kgFvVwmd
MD5:	2C5987EA1E87A5C073B780F8102AE09C
SHA1:	78DAA99D8C59A4A2E0D3B59E5427F854D8613080
SHA-256:	22AC34380064C0FFEE59AD892CA4695E94EE8F97B78C18565251295817A784FE
SHA-512:	7D6432960C5F3BEC27B13D06D4126C91A1DD7DD702DE97F1001855D8572BE68D6526F419BB58F5E5238E8E8F81C801BDAD8F351EF0AE75564835146F3DD3434D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.............3.......3.......3.............................fP8.............,......,.......,...Z...,.......).......,.......Rich....................PE..L......\...........!.....b"..0................"...............................=.....3.=...@.........................pA:......p:.d.....;...............=.@.....;.$.....6.p.....................6.....p.6.@.............".d............................text...9a"......b"................. ..`.rdata..(....."......f".............@..@.data.........:..j...f:.............@....gfids........;.......:.............@..@.tls..........;.......:.............@....rsrc.........;.......:.............@..@.reloc..$.....;.. ....:.............@..B................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39744
Entropy (8bit):	6.36744082696392
Encrypted:	false
SSDEEP:	384:TkzqOI138e1y6JMKxTrAogoAoaP7+qFXYiLxjdQzUQ9LSk3E0gTSsn2TkhI3K0Jn:TLqokSaddQzUNk3EXSsn2Tk4ZZxBKgfP
MD5:	9ED8BAA9DEC76C6AFAFC1C71193A0AE8
SHA1:	843727F195BF194CFF3736B80FB5249713F1E116
SHA-256:	CD2C60402D46C339147ADDF110C904F78A783F23106CCAD147EFA156175D66DE
SHA-512:	40D85540176AB0170B7341D6A8A808FD351B35C6444D468E7707B35D2B2E8F3322DBF0BF31E0578E3A12E1A62B310DD7983B7EFB0F2C72D0C4104AEB0BBCEFF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............b..b..b..3...b..3+..b..3*..b..3...b.Z....b...X..b..b..b.Z....b..0...b..b\..b.Z....b.Rich.b.................PE..L....3.\.................D...8.......I.......`....@.......................................@..................................s.......................\|..@............b..8............................j..@............`...............................text....C.......D.................. ..`.rdata.......`... ...H..............@..@.data................h..............@....rsrc................l..............@..@.reloc...............t..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	179520
Entropy (8bit):	5.239011393842513
Encrypted:	false
SSDEEP:	1536:+vQrKBVxKfGkHM5ZZ+HHJOWfuXO8zIJ1k9XHX8t0wk7UAjKQpmErUaDO3nG:3kjiTGD+JOWGT00XHXo0w+mErBO3G
MD5:	FF197487BFE7E9D3396E0793B83811ED
SHA1:	D92CA066B79DF28BF22BB051AEDFE10E4FA4A2A6
SHA-256:	E6D0CA844514FDD105772E72C7C30D47099112AB68A4A5F9E4A2B28C0372A05A
SHA-512:	33A13B0EE7E3DD038B35B5E4220278016397D003DCEECA56C3EE264608E053940AAFC09AE582C0FD67DFA919F38265883269F6C1A93E5BB9047B97F4A51CACCE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z............X.1....X......X.3....X........m......}....D3.........D.......5......y....D0....Rich...........................PE..L....3.\.................\..........8........p....@..........................0......T.....@.................................,5.......`..V...............@....... ....z..8...........................(...@............0..,............................text....[.......\.................. ..`.rdata...D...p...F...`..............@..@.data....l..........................@....idata...$...0...&..................@..@.rsrc...V....`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\rppd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53056
Entropy (8bit):	6.556803642202102
Encrypted:	false
SSDEEP:	768:AqfYixknAt1kJSwlxeZQHPFtuEK+XLxSzELK4ZHZxBKgCu:8ixknqaxxeZ09tVr7xkyZ5ncu
MD5:	A7A19BFD82EEAE7D4DC00144F3B949F4
SHA1:	FBD6EF10A7D519386CB32B093AE7E42852BAECBD
SHA-256:	A32A93B71A5628EDFC19FD31D26AC60DAF364E89CFDA2C82071718814042BE55
SHA-512:	5AC0F6A0FDAAB8B832B0021948101ABD1C8AF8B79E0C02D60770DF22D945D669AE7D588BD3264F9991E11CBAB01A445AAC9B594B47171C68A6A7BDC3FBB8D962
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3..3..3..uO..1..uO.. ..uO,.7..uO..6..3..S..:fb.4.....1..>L*.2..3.f.2.../.2..Rich3..........................PE..L...j3.\.................v...:......Ez............@.................................Ul....@.................................t...x.......@...............@...............8..............................@...............\|............................text....u.......v.................. ..`.rdata... ......."...z..............@..@.data...............................@....rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2772288
Entropy (8bit):	6.917291195041145
Encrypted:	false
SSDEEP:	49152:UuZqJvz7GHYFVw8vfMVDpaLGtH3uSvQ/qpyr0kiU6HoCPLG5gzyUxChRebU:UuZqJvz7GHGVfvfMVDNNxvQ/qpyr0kpj
MD5:	9FD469846E628F44A4147743875FFBC0
SHA1:	6065C496D7C2695F3678D945FFA3FEFFBCD83C53
SHA-256:	129C2D91F085E54FD9E333C6F580A16907A1D9659D823D6C7CB25F5D3CE55CC8
SHA-512:	5AF5DD95BE604E039337D153CED2B9D3FE33F2E05818E3A222FDD9F7B3381197CCF3CA39324F46CA95B81DF76624F0EF4A0CF045195640E58B9A233D092F43AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u.&.1fH.1fH.1fH....8fH.w7..<fH.w7..<fH.w7..5fH.w7..6fH.8..$fH.1fI.^gH.1fH.&fH......dH......fH.....,fH.....0fH.<4..0fH.....0fH.Rich1fH.................PE..L...,..[...........!.........j......#......... ....................................N....@.........................p.'..:..T.(.......)...............*.@.....).8\|..0. .8............................8'.@............. .h............................text............................... ..`.rdata...-.... ....... .............@..@.data........@(..~...0(.............@....rsrc.........).......(.............@..@.reloc..8\|....)..~....(.............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpdisp.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2991424
Entropy (8bit):	6.7900679594310915
Encrypted:	false
SSDEEP:	49152:kz1BQT/9rrcXgJoHt3LhNSTuHo6E7hVNO8B/3LUvQ/qpyr0kRZTKjEKMUP9isAxI:kz1BI5U3lNS6Ho6E7vBRIvQ/qpyr0kuF
MD5:	829DD10CD377386A2040897F5288DDB0
SHA1:	A7B1C7A6C0E1C9641750E8150EE810530FB67DD0
SHA-256:	5753F66DBC480901955DE247117F3C1E99777B1A610C90931E50C374F8B1D888
SHA-512:	C6B915EBF7B1C023FBB2E06FB169857539253CFA2B5B5C770DF5A43896AF8A0C847796E3F82C6109778F11D7FE3976DA172E1E0E6EACCD1C82DBAEB80ADAB4F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$............j...j...j..V.u..j...;m..j...;R..j...;o..j...;S..j....!..j..}.o..j...j...j..}.R.3h..}.S..j.._4...j...j..Ah..}.W..j..}.n..j...8i..j...j%..j..}.l..j..Rich.j..........................PE..L....3.\..................!...........!......."...@...........................-.....;.....@...........................+.+.....+.......,.@.............-.@.....,..C...................................w+.@............."..............................text...g.!.......!................. ..`.rdata..$.....".......".............@..@.data....~....,..N....+.............@....rsrc...@.....,......<,.............@..@.reloc...C....,..D...B,.............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	660128
Entropy (8bit):	6.339798513733826
Encrypted:	false
SSDEEP:	12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
MD5:	46060C35F697281BC5E7337AEE3722B1
SHA1:	D0164C041707F297A73ABB9EA854111953E99CF1
SHA-256:	2ABF0AAB5A3C5AE9424B64E9D19D9D6D4AEBC67814D7E92E4927B9798FEF2848
SHA-512:	2CF2ED4D45C79A6E6CEBFA3D332710A97F5CF0251DC194EEC8C54EA0CB85762FD19822610021CCD6A6904E80AFAE1590A83AF1FA45152F28CA56D862A3473F0A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;..h..h..h..[h..h..h..h..Mh..hIAWh..h..Oh..h..qh..h..ph..h..uh..h..Lh..h..Kh..h..Nh..hRich..h................PE..d.....OR.........." .....@...................................................`......a.....`.........................................pU.. ....2..<....@...........G.......>...P.......X..................................p............P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P...8...B..............@....pdata...G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\msvcr120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	963232
Entropy (8bit):	6.634408584960502
Encrypted:	false
SSDEEP:	24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
MD5:	9C861C079DD81762B6C54E37597B7712
SHA1:	62CB65A1D79E2C5ADA0C7BFC04C18693567C90D0
SHA-256:	AD32240BB1DE55C3F5FCAC8789F583A17057F9D14914C538C2A7A5AD346B341C
SHA-512:	3AA770D6FBA8590FDCF5D263CB2B3D2FAE859E29D31AD482FBFBD700BCD602A013AC2568475999EF9FB06AE666D203D97F42181EC7344CBA023A8534FB13ACB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ck.."..".."..D...".."..-"...s..$ ...s.."...s.."...s.. "...s.."...s.."...s.."..Rich."..........................PE..d.....OR.........." .....h...:.......)..............................................].....`.................................................@...(............@...s...t...>......8...p................................2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................^..............@..@.reloc..8............b..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\ntprint.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9698
Entropy (8bit):	3.8395767056459316
Encrypted:	false
SSDEEP:	192:jxUPudWfG9sPEd5yVplXhzPGeQ6cGIDGzBs+2o5WcicJXoNaTXy:jyxFeGIDIFXoNT
MD5:	6476F7217D9D6372361B9E49D701FB99
SHA1:	E1155AB2ACC8A9C9B3C83D1E98F816B84B5E7E25
SHA-256:	6135D3C9956A00C22615E53D66085DABBE2FBB93DF7B0CDF5C4F7F7B3829F58B
SHA-512:	B27ABD8ED640A72424B662AE5C529CDDA845497DC8BD6B67B0B44AE9CDD5E849F627E1735108B2DF09DD6EF83AD1DE6FAA1AD7A6727B5D7A7985F92A92CA0779
Malicious:	false
Preview:	..............;. .N.T.P.R.I.N.T...I.N.F. .(.f.o.r. .W.i.n.d.o.w.s. .S.e.r.v.e.r. .2.0.0.3. .f.a.m.i.l.y.).....;.....;. .L.i.s.t. .o.f. .s.u.p.p.o.r.t.e.d. .p.r.i.n.t.e.r.s.,. .m.a.n.u.f.a.c.t.u.r.e.r.s.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....P.r.o.v.i.d.e.r.=.".M.i.c.r.o.s.o.f.t.".....C.l.a.s.s.G.U.I.D.=.{.4.D.3.6.E.9.7.9.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s.=.P.r.i.n.t.e.r.....C.a.t.a.l.o.g.F.i.l.e.=.n.t.p.r.i.n.t...c.a.t.....D.r.i.v.e.r.I.s.o.l.a.t.i.o.n.=.2.....D.r.i.v.e.r.V.e.r.=.0.6./.2.1./.2.0.0.6.,.6...1...7.6.0.0...1.6.3.8.5.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....".M.i.c.r.o.s.o.f.t.".=.M.i.c.r.o.s.o.f.t.,.N.T.a.m.d.6.4.........[.M.i.c.r.o.s.o.f.t...N.T.a.m.d.6.4.].....".{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.". .=. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.,. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17415
Entropy (8bit):	4.618177193109944
Encrypted:	false
SSDEEP:	384:U1EQCr2g2t2g2F2s2J2m2p2z2ZOgoNJUTIZah25Dy:3oLILwfcV86ZO3eTIZzy
MD5:	8EE7FD65170ED9BD408E0C821171B62A
SHA1:	9D14A87A049C3B576CEC4B28210F0C95B94E08E0
SHA-256:	EE1E4D9869188CC3FA518C445ECF071845E5BD8BE56767A9F7F7DD3ACE294BA5
SHA-512:	5740AB3545D2217BA2156C58BA9AF6681D73116AB5DFBEAA5AB615D9CD0C77716C25865E67188E9D7892B340776755D4CBB1A3E98FAEAF8B6BB4B2CCA00D8AE6
Malicious:	false
Preview:	GPDSpecVersion: "1.0"..GPDFileVersion: "1.0"..GPDFileName: "*.GPD"..Include: "STDNAMES_VPD.GPD"..ModelName: "**"..MasterUnits: PAIR(40800, 117600)..ResourceDLL: "UNIRES_VPD.DLL"..PrinterType: PAGE..MaxCopies: 99....Feature: Orientation..{.. rcNameID: =ORIENTATION_DISPLAY.. DefaultOption: PORTRAIT.. Option: PORTRAIT.. {.. rcNameID: =PORTRAIT_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }.. Option: LANDSCAPE_CC270.. {.. rcNameID: =LANDSCAPE_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }..}..Feature: InputBin..{.. rcNameID: =PAPER_SOURCE_DISPLAY.. DefaultOption: AUTO...Option: AUTO.. {.. rcNameID: =AUTO_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.9.. Cmd: "".. }.. }.. Option: CASSETTE.. {.. rcNameID:

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.479503224130278
Encrypted:	false
SSDEEP:	3:z8ANyq3jII7Vc:z8cy2lc
MD5:	035B163A3E4C308F617C05E0137FAFD0
SHA1:	484238C9C05805F1CA5A97FA58950253B7F9FCBE
SHA-256:	00CA9230DBAC7FF222CA837AA796496FF4B9B15E0552D3D5AD26B040E2BAB8D7
SHA-512:	3EB65CF86C3C71944C8100F90C60604DB4EA69CB187F8E473601845EB4520148CF3779762EF997DC5C14FE8A2269B928448DDF0338A4F172C0460FA0D6F29798
Malicious:	false
Preview:	[OEMFiles] ..OEMConfigFile1=rppdui.dll ..

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdpm.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35648
Entropy (8bit):	6.365966080243848
Encrypted:	false
SSDEEP:	768:nE2YHORRn1SNBaiAL3X8jARHb2Os7fAK6ncZxBKg1xDo:E862HbPs7otEnzNo
MD5:	68EA0EC529B7B9D3284D860F5ABD9BB4
SHA1:	1A3951538D9E79F09792C8B118F010834A6C1273
SHA-256:	EE963C5960F6687789004175C3DF0098331BEBBCE992BF9C73EF9EF6ED73C1E0
SHA-512:	E62D2CFCA2433F4D647A5658141D63093D75491C60D1647F41FFDE74308BDF1A512DEBCC4A4535CE6FC9DE1ACB149D135D89366FE75FC9C52AA709C8887D7A28
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.....................i'......i1......i6.........z....i!.............i ......i;..............i&......i#.....Rich............PE..d....4.\.........." .....V..........\|P....................................................@..........................................d..W....[..................`....l..@........... ................................................................................text...'U.......V.................. ..`.data...4....p.......Z..............@....pdata..`............b..............@..@.rsrc................f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\rppdui.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	204096
Entropy (8bit):	5.820956822859452
Encrypted:	false
SSDEEP:	3072:co2/UxSJBXgK5IsZsYMNV7jWCQQD9KdtvB1WOAahmRF:co284/XgGfbuYAKdf1WOAaO
MD5:	126C2BCC9112266CE33F9835A1E44B9C
SHA1:	B16C0D19797C7A0CC665BC8346ECF453234A83A4
SHA-256:	2736C2919966D17F27A34D69A7253CD4C2D09C6F7CF9FC03597F27BC73C0BDC2
SHA-512:	C25FC46CA2D8DAAD868FA2B5F1BA6CCAAC7F919C8C7CBB86952741B493D27E79EC8C7FD5F124A704B78F4197E6F3812D0FE0F64BC00117EE2AC09B41FAE85308
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$................dD....\....c....^....b..........R.......5Zf...5Zb...5Z_....X........5Z]...Rich...........................PE..d....4.\.........." .................~....................................................`..........................................G..l...\H..........(.......<.......@...............................................p............................................text...-........................... ..`.rdata..Z...........................@..@.data...ph...`.......@..............@....pdata..<............X..............@..@.rsrc...(............n..............@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\setupdrv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	102208
Entropy (8bit):	6.071111727952987
Encrypted:	false
SSDEEP:	1536:8Fqz3IwGZjZ8lt0nt0NhuGO7o6LJ/TJhjYEOYULzEnr:MwYrZNQCnKhnOtthUEOYULzEr
MD5:	CC0E2455CFF19B3585C9FA781428E88E
SHA1:	93EC9326F0CEE4E7F385525B03DDF0DF89A409E8
SHA-256:	AF24B7E339CC6B80ECF7B45050533E8227D6491EED2FD8C3FF2BF22406B027AA
SHA-512:	B995CD999B36B9BD3DC8BE60A7576701CB91D18DF21934521C578047CD135C91F1027058198B1867A4D46804C0514523B370ECEC0E6691A041189011E31166A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.."..."..."..+.l.."...st.."...sK.."...sv.."...sJ.."...Z8.."..."..."....N.."...pp.."..."<.."....u.."..Rich."..................PE..d...)4.\.........."............................@....................................R.....`..................................................[..........x............p..@...............8............................7..p...............P............................text...=........................... ..`.rdata...g.......h..................@..@.data........p.......V..............@....pdata...............X..............@..@.rsrc................d..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\stdnames_vpd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14366
Entropy (8bit):	4.1817849062232195
Encrypted:	false
SSDEEP:	192:NjThm8JC986ITRCzEzEpYNwtd29u7ZTl8hF:yFzOnS7z0
MD5:	7162D8977515A446D2C1E139DA59DED5
SHA1:	952F696C463B8410B1FA93A3B2B6DAE416A81867
SHA-256:	2835A439C6AE22074BC3372491CB71E6C2B72D0C87AE3EEE6065C6CAADF1E5C8
SHA-512:	508F7CA3D4BC298534AB058F182755851051684F8D53306011F03875804C95E427428BD425DD13633EEC79748BB64E78AAD43E75B70CC5A3F0F4E6696DBB6D8E
Malicious:	false
Preview:	%%% Copyright (c) 1997-1999 Microsoft Corporation..%%% value macros for standard feature names and standard option names..%%% used in older Unidrv's.....CodePage: 1252 % Windows 3.1 US (ANSI) code page....Feature: RESDLL..{.. Name: "resource dll files".. ConcealFromUI?: TRUE.... Option: UniresDLL.. {.. Name: "unires_vpd.dll".. }..}....*Macros: StdFeatureNames..{.. ORIENTATION_DISPLAY: RESDLL.UniresDLL.11100.. PAPER_SIZE_DISPLAY: RESDLL.UniresDLL.11101.. PAPER_SOURCE_DISPLAY: RESDLL.UniresDLL.11102.. RESOLUTION_DISPLAY: RESDLL.UniresDLL.11103.. MEDIA_TYPE_DISPLAY: RESDLL.UniresDLL.11104.. TEXT_QUALITY_DISPLAY: RESDLL.UniresDLL.11105.. COLOR_PRINTING_MODE_DISPLAY: RESDLL.UniresDLL.11106.. PRINTER_MEMORY_DISPLAY: RESDLL.UniresDLL.11107.. TWO_SIDED_PRINTING_DISPLAY: RESDLL.UniresDLL.11108.. PAGE_PROTECTION_

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	487232
Entropy (8bit):	6.340203111317007
Encrypted:	false
SSDEEP:	6144:MgjhSyqP1a/eVqxFxNCAiG3XyJ/2TxbfsEkhy+0F+K8lJrZdwwSvr:MglSTPaRxFdLXyJ/ebEEkx0rqJduJ
MD5:	AD6C433A57BE03EE0C75076D6FE99CD5
SHA1:	219EE785F2C8127DAA44B298B5B2B096FCCE8D12
SHA-256:	8A180D92A2C879A3384D24A38EC8C9FD6BFD183935E61DA0B97F1C67A7EC9EA7
SHA-512:	041FB9165068D0EA879632B883B3E247336A3BB159ED46AE053B60D074A0BB231FA2DEEDD6CB2BA17AACB771413A86A3F970480AF7A2311E51702288D3B9A30E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................&.....7.......W.... .....0.....!.....:...d......'....."....Rich............................PE..d...w.[J.........." .........8......d..........t.....................................b....@..........................................4..........x....p.......@...(...P..@............!..8............................................0...............................text...O........................... ..`.rdata.......0......................@..@.data...x.... ......................@....pdata...(...@...*..................@..@.rsrc........p.......B..............@..@.reloc...............F..............@..B..[J@...+.[JK.....[JU.....[Jb...+.[JK.....[Jo.....[Jy...........msvcrt.dll.NTDLL.DLL.WINSPOOL.DRV.KERNEL32.dll.ole32.dll.GDI32.dll..............................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrv_rppd.hlp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows 3.1 help, Tue Apr 17 13:11:56 2001, 21225 bytes
Category:	dropped
Size (bytes):	21225
Entropy (8bit):	3.9923245636306675
Encrypted:	false
SSDEEP:	192:g8qo9MqLEGX9WkaNWvbAsmrEGckkwy95/HLQdu:g8rMqLwkW8AsqEHkkwy7N
MD5:	6798F64959C913673BD66CD4E47F4A65
SHA1:	C50FAA64C8267AC7106401E69DA5C15FC3F2034C
SHA-256:	0C02B226BE4E7397F8C98799E58B0A512515E462CCDAAC04EDC10E3E1091C011
SHA-512:	8D208306B6D0F892A2F16F8070A89D8EDB968589896CB70CF46F43BF4BEFB7C4CA6A278C35FE8A2685CC784505EFB77C32B0AABF80D13BCC0D10A39AE8AFB55A
Malicious:	false
Preview:	?_...........R..r...i.....(),.aabo.utadvanc.edAllows.andareas.assigned.availabl.ebebookl.etc-.hang.e..racter@Clickc. o.de..sColo.rc.0..scon.taindefa.ultdepth.directlyi.0or..sh..PD.isplaysd.ocument.P.sdraftse.n, ex..nal.featuref.ilesfl.....PrFor..m..-.to-trayf.romgraph$ic.@sh@.to.neH.@dhig.herIfima.gesininE..atio..sta.ll.@..itLe.t..Listsl.o..*.nualm.em..meta..2mS.tM!...enhoto..Oy.w.o.per\.ngop.timizh ...@.nsor..p.......spa3.Pri.ntp.0..ed.0..0er.@-spe.cific.@s1 .m.q..ityQ.0.relaB.RET.k.ghseese.l..edsets.oftSomes0ourc}.P ed.S.@sb.'.poo...gsuchsu.pporttak.est..tha...eT..'.oTo...TrueType...l.usevie@wWhenw. e.1.rw..hwil.lyouyour.;bynewof.fs/...&....;)....z4..............................N.......\|CF0.lR..\|CF1..R..\|CF2..R..\|CF4..R..\|CF5..R..\|CONTEXT..)..\|CTXOMAP.. ..\|FONT.. ..\|Petra..2..\|PhrImage.....\|PhrIndex.....\|SYSTEM.2...\|TOPIC.....\|TTLBTREE..!..\|TopicId.=J.......................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unidrvui_rppd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	892224
Entropy (8bit):	6.044434154548935
Encrypted:	false
SSDEEP:	12288:qpvsrQZu8F/bY6Pgx2B8UNG2Ql20gcwtH2qMP23so2:kZ5F/bYogxJUB9cwtHFMDp
MD5:	BB98224B0CB6F17D61AA24D7A46A08C5
SHA1:	DB78D1161EAA0C691DF76D1B6D7CC98793007BCE
SHA-256:	23A30F94360D710BB020DF76E7846AB991EDD6CA3C7F685AECF6CD1A019D451A
SHA-512:	D74291E8556911B77588D63EB20DB5D6642C31FEDD9EE186AE62D53C705F0CDBE14725ECBB8FC5FE770F45DFF05731EEBB2063A33BB78DF70B73CDCF4E86C465
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y'..I...I...I..`...I..`...I...H.R.I..`...I..`...I..`...I..`...I...7...I..`...I..`...I.Rich..I.................PE..d.....[J.........." .....$...V.................v....................................O.....@........................................../..{.... .................../...~..@...........`...................................................0............................text...[".......$.................. ..`.data....5...@...0...(..............@....pdata.../.......0...X..............@..@.rsrc...............................@..@.reloc..0............j..............@..B..[J`...+.[Jk...5.[Ju.....[J......[J......[J....+.[Jk.....[J......[J......[J......[J............msvcrt.dll.NTDLL.DLL.RPCRT4.dll.ole32.dll.USER32.dll.KERNEL32.dll.VERSION.dll.WINSPOOL.DRV.GDI32.dll.OLEAUT32.dll...............................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\unires_vpd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	770368
Entropy (8bit):	5.630939020655746
Encrypted:	false
SSDEEP:	12288:+kozBEoNh3bBPc/s4430ye84TF1dbua5TVhRre3kf8IKHgikinLd:SzBEGbL4Np84TQazCSiRd
MD5:	A0D2853BE8043F5FC4FEE04CFE5A8293
SHA1:	4FDF21E578739ABB4BCC938568F27897E733E229
SHA-256:	1D8C77B674F8294DB39B2CDE2873BDE5A2F6EBD65E14CAEEB58FBA94C92C1F3D
SHA-512:	FC5CE23DF55EF277D6DB898D5620697A3A061A5DD9BE63145CE71B966905CAC41B9785121709A2A0DCF8F90B76F484FAB619EB8DB40A873A867468ECF1620F99
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..d.....[J.........." ..........................@...........................................@.............................................................0...............@............................................................................................rsrc...............................@..@........................................0...8.......P.......................@...........................................r.......s...x...t...8...u.......v.......w...0...x.......y...........(...............................X.......(...............................h...............P....................................................................................................... .......8.......P.......h............................................................................................... .......0...

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x64\vccorlib120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	356528
Entropy (8bit):	5.917051105867173
Encrypted:	false
SSDEEP:	6144:0g5dgFfqaKFJyHrByeUIRAHq0KzS9OAgfVgYCDlSv:0OdcUIRAHqAeX0a
MD5:	BDD8AE768DBF3E6C65D741CB3880B8A7
SHA1:	91B01FD48A586822C1D81CA80B950F8639CCE78C
SHA-256:	602ADD77CBD807D02306DE1D0179CB71A908EECB11677116FC206A7E714AB6D6
SHA-512:	7840554A66F033E556CF02772B8B3749C593657CA254E0F2DBD93B05F4600E11BA821EBA8FC038115C038B5E5AF2F8D2CF0A5AE1F1362E813CF0B5041BBBFF94
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.@.'.@.'.@....!.@.a...#.@.....&.@.a...%.@.a...*.@.a.../.@..P.. .@.'.A.T.@.a...6.@.a...&.@.a...&.@.a...&.@.Rich'.@.........PE..d...}.OR.........." .....n...........L...................................................`..............................................>...D.......P..........."...2...>...`......................................`...p............................................text....l.......n.................. ..`.rdata...............r..............@..@.data...x....`.......F..............@....pdata...".......$..................@..@minATL.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	455328
Entropy (8bit):	6.698367093574994
Encrypted:	false
SSDEEP:	12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
MD5:	FD5CABBE52272BD76007B68186EBAF00
SHA1:	EFD1E306C1092C17F6944CC6BF9A1BFAD4D14613
SHA-256:	87C42CA155473E4E71857D03497C8CBC28FA8FF7F2C8D72E8A1F39B71078F608
SHA-512:	1563C8257D85274267089CD4AEAC0884A2A300FF17F84BDB64D567300543AA9CD57101D8408D0077B01A600DDF2E804F7890902C2590AF103D2C53FF03D9E4A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.N+.N+.N.3wN).N+.N..Nm.aN(.Nm.cN#.Nm.]N..Nm.\Ne.Nm.YN-.Nm.`N.Nm.gN.Nm.bN*.NRich+.N........................PE..L....\|OR.........."!.........................0.......................................x....@..........................W..L...<...<........................>.......D...................................K..@...............<............................text...<........................... ..`.data....^...0...0... ..............@....idata...............P..............@..@.rsrc................j..............@..@.reloc...D.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\msvcr120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970912
Entropy (8bit):	6.9649735952029515
Encrypted:	false
SSDEEP:	12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5:	034CCADC1C073E4216E9466B720F9849
SHA1:	F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
SHA-256:	86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
SHA-512:	5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....\|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\ntprint.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	9698
Entropy (8bit):	3.8395767056459316
Encrypted:	false
SSDEEP:	192:jxUPudWfG9sPEd5yVplXhzPGeQ6cGIDGzBs+2o5WcicJXoNaTXy:jyxFeGIDIFXoNT
MD5:	6476F7217D9D6372361B9E49D701FB99
SHA1:	E1155AB2ACC8A9C9B3C83D1E98F816B84B5E7E25
SHA-256:	6135D3C9956A00C22615E53D66085DABBE2FBB93DF7B0CDF5C4F7F7B3829F58B
SHA-512:	B27ABD8ED640A72424B662AE5C529CDDA845497DC8BD6B67B0B44AE9CDD5E849F627E1735108B2DF09DD6EF83AD1DE6FAA1AD7A6727B5D7A7985F92A92CA0779
Malicious:	false
Preview:	..............;. .N.T.P.R.I.N.T...I.N.F. .(.f.o.r. .W.i.n.d.o.w.s. .S.e.r.v.e.r. .2.0.0.3. .f.a.m.i.l.y.).....;.....;. .L.i.s.t. .o.f. .s.u.p.p.o.r.t.e.d. .p.r.i.n.t.e.r.s.,. .m.a.n.u.f.a.c.t.u.r.e.r.s.....;.........[.V.e.r.s.i.o.n.].....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....P.r.o.v.i.d.e.r.=.".M.i.c.r.o.s.o.f.t.".....C.l.a.s.s.G.U.I.D.=.{.4.D.3.6.E.9.7.9.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s.=.P.r.i.n.t.e.r.....C.a.t.a.l.o.g.F.i.l.e.=.n.t.p.r.i.n.t...c.a.t.....D.r.i.v.e.r.I.s.o.l.a.t.i.o.n.=.2.....D.r.i.v.e.r.V.e.r.=.0.6./.2.1./.2.0.0.6.,.6...1...7.6.0.0...1.6.3.8.5.........[.M.a.n.u.f.a.c.t.u.r.e.r.].....".M.i.c.r.o.s.o.f.t.".=.M.i.c.r.o.s.o.f.t.,.N.T.a.m.d.6.4.........[.M.i.c.r.o.s.o.f.t...N.T.a.m.d.6.4.].....".{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.". .=. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.E.7.9.F.0.}.,. .{.D.2.0.E.A.3.7.2.-.D.D.3.5.-.4.9.5.0.-.9.E.D.8.-.A.6.3.3.5.A.F.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\printer.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 6 icons, 32x32, 4 bits/pixel, 16x16, 4 bits/pixel
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	5.364629779133003
Encrypted:	false
SSDEEP:	96:75LkqDCmLVf89uqywWrvNCB4isySOc3AOv2B+YT1/44tuU+3:1OmLVf4dErvNCB5tSOc3AY2BP944g
MD5:	6F70BD62A17EC5B677EC1129F594EE6F
SHA1:	4FB95EB83A99C0DA62919C34886B0A3667F3911E
SHA-256:	FC8570D50C1773A1B34AA4E31143FD0776E26FF032EE3EEB6DB8BFAB42B4A846
SHA-512:	615A7E8738B2CF1BC47C8D5FC1357C1299080D0BAA1E54129D0DEBDB6BA60CD366364BE0BDAFDABCBA60F16544B0516A50B4B0182E8BCF01F59171003CE9B244
Malicious:	false
Preview:	...... ..........f...........(...N... ..........v...........h....... .... ............... .h....#..(... ...@.....................................................................................................................................................x..............wx.............ww.............ww.x...........ww.xx..........ww.wxx..........w.wwxx...........wwwxx..........xwwwxx..........xwwwx...........xwww..x.........xww.wx.x........xw.wwwx.x.......x.w\|.x.x.x........z.x.ww..x......x.x.ww....x......x..w....x.x......x.....p.x........x................x....................p................................p..........................................................................................................................................................................................................?...........?............(....... ..........................................................................................................x......w......w.x......wx.....wwx.....w

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17415
Entropy (8bit):	4.618177193109944
Encrypted:	false
SSDEEP:	384:U1EQCr2g2t2g2F2s2J2m2p2z2ZOgoNJUTIZah25Dy:3oLILwfcV86ZO3eTIZzy
MD5:	8EE7FD65170ED9BD408E0C821171B62A
SHA1:	9D14A87A049C3B576CEC4B28210F0C95B94E08E0
SHA-256:	EE1E4D9869188CC3FA518C445ECF071845E5BD8BE56767A9F7F7DD3ACE294BA5
SHA-512:	5740AB3545D2217BA2156C58BA9AF6681D73116AB5DFBEAA5AB615D9CD0C77716C25865E67188E9D7892B340776755D4CBB1A3E98FAEAF8B6BB4B2CCA00D8AE6
Malicious:	false
Preview:	GPDSpecVersion: "1.0"..GPDFileVersion: "1.0"..GPDFileName: "*.GPD"..Include: "STDNAMES_VPD.GPD"..ModelName: "**"..MasterUnits: PAIR(40800, 117600)..ResourceDLL: "UNIRES_VPD.DLL"..PrinterType: PAGE..MaxCopies: 99....Feature: Orientation..{.. rcNameID: =ORIENTATION_DISPLAY.. DefaultOption: PORTRAIT.. Option: PORTRAIT.. {.. rcNameID: =PORTRAIT_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }.. Option: LANDSCAPE_CC270.. {.. rcNameID: =LANDSCAPE_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.6.. Cmd: "".. }.. }..}..Feature: InputBin..{.. rcNameID: =PAPER_SOURCE_DISPLAY.. DefaultOption: AUTO...Option: AUTO.. {.. rcNameID: =AUTO_DISPLAY.. Command: CmdSelect.. {.. Order: DOC_SETUP.9.. Cmd: "".. }.. }.. Option: CASSETTE.. {.. rcNameID:

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.479503224130278
Encrypted:	false
SSDEEP:	3:z8ANyq3jII7Vc:z8cy2lc
MD5:	035B163A3E4C308F617C05E0137FAFD0
SHA1:	484238C9C05805F1CA5A97FA58950253B7F9FCBE
SHA-256:	00CA9230DBAC7FF222CA837AA796496FF4B9B15E0552D3D5AD26B040E2BAB8D7
SHA-512:	3EB65CF86C3C71944C8100F90C60604DB4EA69CB187F8E473601845EB4520148CF3779762EF997DC5C14FE8A2269B928448DDF0338A4F172C0460FA0D6F29798
Malicious:	false
Preview:	[OEMFiles] ..OEMConfigFile1=rppdui.dll ..

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppd.lng

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	98650
Entropy (8bit):	4.192473934109759
Encrypted:	false
SSDEEP:	768:5rENOwVRq6rZmor3CmRxhESLGZ0s1JP2PY6rZIshvwmE2uJJ6rZqDJK1YRo6rZGx:S9miFao0WDn
MD5:	1614E6CDF119FD284D476F7E6723B3AD
SHA1:	3FF9164C9E5FC47169CC1C6EECA22AAB099F2EA3
SHA-256:	C8DF350F95FFEEED30060092DC8666EADCE040A4DDCB98E7A9293F87D19387A8
SHA-512:	8FBCB156B2F9637BC15FA71758A361CB2500F5A19875EE6BE2B52FC3171C38353A6CDC623E36777D052E0B319C7AF934D2D1DBE92E69666C9B9AD749610BA471
Malicious:	false
Preview:	..[.E.n.g.l.i.s.h.].....L.a.n.g.I.D.=.1.0.3.3.....;. .l.o.o.k. .f.o.r. .l.a.n.g.u.a.g.e. .i.d.e.n.t.i.f.i.e.r.s. .i.n. .M.S.D.N. .-. .'.T.a.b.l.e. .o.f. .L.a.n.g.u.a.g.e. .I.d.e.n.t.i.f.i.e.r.s.'. .t.o.p.i.c.........;. .S.T.A.N.D.A.R.D. .D.I.A.L.O.G. .B.U.T.T.O.N.S.:.........1.=.O.K.....2.=.C.a.n.c.e.l.........;. .P.R.I.N.T.I.N.G. .P.R.E.F.E.R.E.N.C.E.S.:.........;. .C.o.m.m.o.n. .s.t.r.i.n.g.s.....;. .b.i.t.s. .p.e.r. .p.i.x.e.l.....5.0.0.0. .=. .1. .b.i.t. .-. .b.l.a.c.k. .a.n.d. .w.h.i.t.e.....5.0.0.1. .=. .4. .b.i.t.s. .-. .1.6. .c.o.l.o.r.s.....5.0.0.2. .=. .8. .b.i.t.s. .-. .2.5.6. .c.o.l.o.r.s.....5.0.0.3. .=. .2.4. .b.i.t.s. .-. .t.r.u.e. .c.o.l.o.r.........;. .C.o.m.p.r.e.s.s.i.o.n.....5.0.0.4. .=. .N.o.n.e.....5.0.0.5. .=. .A.u.t.o.m.a.t.i.c.....5.0.0.6. .=. .C.C.I.T.T. .m.o.d.i.f.i.e.d. .H.u.f.f.m.a.n. .R.L.E.....5.0.0.7. .=. .C.C.I.T.T. .G.r.o.u.p. .3. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.8. .=. .C.C.I.T.T. .G.r.o.u.p. .4. .f.a.x. .e.n.c.o.d.i.n.g.....5.0.0.9. .=. .L.e.m.p.e.

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdpm.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33600
Entropy (8bit):	6.281064018328684
Encrypted:	false
SSDEEP:	384:az2vV5RqtDcvnyQW7I+Ud26uiGKjzAVQjXzPishb8pe+7mNwSumexmMK6jcy:hgo7WcDGuB3Upe2m9uZxBKg3
MD5:	BED53AB8B9E406D1A8D6A85924E44282
SHA1:	19628BD3DE2BEF0EDC3622E4A7184162BD979040
SHA-256:	E5A10A74CFC36A4DCFCC9B25573B92A37B55062153EF9120B93154DB5792B3DA
SHA-512:	6F5C6945B0A982E8C94A826685158286D16173F51B10FDF1F5B9F4F93562240736A09B5F0997E995C0AF07360BACD51FA46CB8E4A3FA319519F3727FF87613E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......pZ.Y4;..4;..4;...4..:;..=C'.<;..=C6.9;..4;...;..=C!.7;..=C .5;..=C1.q;......5;..=C&.5;..=C#.5;..Rich4;..........PE..L...,4.\...........!.....F...........D.......`......................................a.....@.........................pU..W....M.......p...............d..@...........................................(...@...............t............................text....E.......F.................. ..`.data...\....`.......J..............@....rsrc........p.......P..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\rppdui.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159552
Entropy (8bit):	6.178643199247813
Encrypted:	false
SSDEEP:	3072:VYM7lLXShoSAJzKb9P+K61JJBsJgTcqTIbMNZ3mo+aGh1G:77tK+K61vBsJKcq0bMNZPXP
MD5:	F0A9D47D76E68883F04E60599EADAE6D
SHA1:	8F7BB6B9E9CB70529FA4C442ABF507A2F546E6E3
SHA-256:	2FAB0969C6E131834496428779A0809B97981F3E8D6FBF8A59632CB2DF783687
SHA-512:	18BBD1A3899C6B2F361BFA575D50D7DA29EAEF0E1C7CB50B318CECFE3150F268C1CDF30FEB5246B9F9B5D7FE36BD4A268E06595D9D3F3D86D933F14F5C43AD43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\.q.\.q.\.q..h..].q....._.q.....P.q.....X.q.....T.q.U...].q.\.p..q.U...K.q..V..V.q..V..D.q..V..].q.Q...].q.\...].q..V..].q.Rich\.q.........PE..L....3.\...........!.....L...N.......0.......`......................................k.....@.........................P...l...............(............P..@.......< ...................................z..@............`...............................text....J.......L.................. ..`.rdata...B...`...D...P..............@..@.data....\..........................@....rsrc...(...........................@..@.reloc..< ......."..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\setupdrv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	87360
Entropy (8bit):	6.424955012685773
Encrypted:	false
SSDEEP:	1536:df1NQOOvFdve0e0ZIMhn9nA2LYK7ZOgkg6znnLnx9Inz1:/Adve07RnlhRN6znDQx
MD5:	66C5F108A058B515BBDDE628384990C9
SHA1:	0FBADFC5106056DFD269DF5EA532F69556CAE68F
SHA-256:	8D596D33CC3962B33B46D361BBC44A8088F18C09949734F3DEC54828372426AE
SHA-512:	6060EF07244385516989DF3AAD1C01E9F93B7B45A247D8D70FC5BE7A62BA96BFD22F80F0C78D178443D38796A2C7148CD3ADF4EB1A5FC430DFF5BB393492901E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G..&...&...&....^..&...wF..&...wy..&...wD..&...wx..&...^...&...&..0&..$.\|..&...tB..&...&...&..$.G..&..Rich.&..........PE..L...$4.\.....................n....................@..........................p.......C....@.................................d........@..x............6..@....P..........8...........................P...@............................................text............................... ..`.rdata...F.......H..................@..@.data...p....0......................@....rsrc........@......................@..@.reloc.......P....... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\stdnames_vpd.gpd

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14366
Entropy (8bit):	4.1817849062232195
Encrypted:	false
SSDEEP:	192:NjThm8JC986ITRCzEzEpYNwtd29u7ZTl8hF:yFzOnS7z0
MD5:	7162D8977515A446D2C1E139DA59DED5
SHA1:	952F696C463B8410B1FA93A3B2B6DAE416A81867
SHA-256:	2835A439C6AE22074BC3372491CB71E6C2B72D0C87AE3EEE6065C6CAADF1E5C8
SHA-512:	508F7CA3D4BC298534AB058F182755851051684F8D53306011F03875804C95E427428BD425DD13633EEC79748BB64E78AAD43E75B70CC5A3F0F4E6696DBB6D8E
Malicious:	false
Preview:	%%% Copyright (c) 1997-1999 Microsoft Corporation..%%% value macros for standard feature names and standard option names..%%% used in older Unidrv's.....CodePage: 1252 % Windows 3.1 US (ANSI) code page....Feature: RESDLL..{.. Name: "resource dll files".. ConcealFromUI?: TRUE.... Option: UniresDLL.. {.. Name: "unires_vpd.dll".. }..}....*Macros: StdFeatureNames..{.. ORIENTATION_DISPLAY: RESDLL.UniresDLL.11100.. PAPER_SIZE_DISPLAY: RESDLL.UniresDLL.11101.. PAPER_SOURCE_DISPLAY: RESDLL.UniresDLL.11102.. RESOLUTION_DISPLAY: RESDLL.UniresDLL.11103.. MEDIA_TYPE_DISPLAY: RESDLL.UniresDLL.11104.. TEXT_QUALITY_DISPLAY: RESDLL.UniresDLL.11105.. COLOR_PRINTING_MODE_DISPLAY: RESDLL.UniresDLL.11106.. PRINTER_MEMORY_DISPLAY: RESDLL.UniresDLL.11107.. TWO_SIDED_PRINTING_DISPLAY: RESDLL.UniresDLL.11108.. PAGE_PROTECTION_

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	383296
Entropy (8bit):	6.650287803080611
Encrypted:	false
SSDEEP:	6144:yplBo/TK5C+psQzJzCSX6hjg+4GRr3CoA7f3j5G+hinZ5P31uGX7Zum8oyk7lATI:O0/djgEUhWnJ2UlxqOttoICvPn/318Sm
MD5:	C3F39388BD4E6763F9734BC617388A17
SHA1:	AF5B4753F99C3F115294662876D7191DC8652786
SHA-256:	4D1F6A595889165B6A14B68D848C639748C9750C165BB4515CA3C3C67B4BA462
SHA-512:	BD8D00461E65F156686B0FC799926897845900F072F7AC10B66387E041CC7D3810ADBFB0137E9EA7B24995A11D324707D9E0FCD699D36E62ED089F46CC5ABA58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3g..3g..3g..:.;.4g..3g...g..:.=.8g..:.<.2g..:.-..g..:.*.sg.....2g..:.:.2g..:.?.2g..Rich3g..........................PE..L...$.[J...........!................-..............m................................Z!....@....................................x.......................@...............8............................t..@.......\|.......`............................text...k........................... ..`.data...............................@....rsrc...............................@..@.reloc..............................@..Bo.[J8...K.[JC.....[JP.....[J].....[Jg.....[Jq...........msvcrt.dll.WINSPOOL.DRV.KERNEL32.dll.NTDLL.DLL.ole32.dll.GDI32.dll..............................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrv_rppd.hlp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows 3.1 help, Tue Apr 17 13:11:56 2001, 21225 bytes
Category:	dropped
Size (bytes):	21225
Entropy (8bit):	3.9923245636306675
Encrypted:	false
SSDEEP:	192:g8qo9MqLEGX9WkaNWvbAsmrEGckkwy95/HLQdu:g8rMqLwkW8AsqEHkkwy7N
MD5:	6798F64959C913673BD66CD4E47F4A65
SHA1:	C50FAA64C8267AC7106401E69DA5C15FC3F2034C
SHA-256:	0C02B226BE4E7397F8C98799E58B0A512515E462CCDAAC04EDC10E3E1091C011
SHA-512:	8D208306B6D0F892A2F16F8070A89D8EDB968589896CB70CF46F43BF4BEFB7C4CA6A278C35FE8A2685CC784505EFB77C32B0AABF80D13BCC0D10A39AE8AFB55A
Malicious:	false
Preview:	?_...........R..r...i.....(),.aabo.utadvanc.edAllows.andareas.assigned.availabl.ebebookl.etc-.hang.e..racter@Clickc. o.de..sColo.rc.0..scon.taindefa.ultdepth.directlyi.0or..sh..PD.isplaysd.ocument.P.sdraftse.n, ex..nal.featuref.ilesfl.....PrFor..m..-.to-trayf.romgraph$ic.@sh@.to.neH.@dhig.herIfima.gesininE..atio..sta.ll.@..itLe.t..Listsl.o..*.nualm.em..meta..2mS.tM!...enhoto..Oy.w.o.per\.ngop.timizh ...@.nsor..p.......spa3.Pri.ntp.0..ed.0..0er.@-spe.cific.@s1 .m.q..ityQ.0.relaB.RET.k.ghseese.l..edsets.oftSomes0ourc}.P ed.S.@sb.'.poo...gsuchsu.pporttak.est..tha...eT..'.oTo...TrueType...l.usevie@wWhenw. e.1.rw..hwil.lyouyour.;bynewof.fs/...&....;)....z4..............................N.......\|CF0.lR..\|CF1..R..\|CF2..R..\|CF4..R..\|CF5..R..\|CONTEXT..)..\|CTXOMAP.. ..\|FONT.. ..\|Petra..2..\|PhrImage.....\|PhrIndex.....\|SYSTEM.2...\|TOPIC.....\|TTLBTREE..!..\|TopicId.=J.......................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unidrvui_rppd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	755520
Entropy (8bit):	6.198681499104638
Encrypted:	false
SSDEEP:	12288:IlIoM3g2e9Bg7Lg3yfKDPc97QpAxuKdwSGnZGxn:IvM36KkyCLW7QCwSGon
MD5:	0822EE0FF996BEB2B31EBBDD6449231B
SHA1:	7DF7F4978F3C4728CAEF9F95C6EB6C0D8CF8FDAC
SHA-256:	D727150FA7853748655E9CAA9F19F633E33BD191284703D6609984A64CB39CAB
SHA-512:	A47D25901FAD0507167E241350EC12C8D545F3F932E1B44E5F167A82263BCB97DA06B09454E8DE815EFC445088F2B1011028C3EAE5BF3F55FACAA3D9EC082815
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."..wf..$f..$f..$o.%$n..$f..$...$o.#$u..$o.3$8..$o."$g..$o.4$...$AZ.$g..$o.$$g..$o.!$g..$Richf..$................PE..L......L...........!.....2...2......e........@....(p.....................................@.............................{....3.......p...............h..@....`...0...@..8...............................@............................................text...E1.......2.................. ..`.data........P.......6..............@....rsrc........p.......T..............@..@.reloc...0...`...2...6..............@..B..LX......Lc...o..Ln...&..Lx.....L....n..L....%..L....K..L.......L....r..L............msvcrt.dll.RPCRT4.dll.ole32.dll.USER32.dll.KERNEL32.dll.NTDLL.DLL.VERSION.dll.WINSPOOL.DRV.GDI32.dll.OLEAUT32.dll.......................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\unires_vpd.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	770368
Entropy (8bit):	5.629918098777896
Encrypted:	false
SSDEEP:	12288:tkoGBEoNh3bBPc/s4430ye84TF1dbua5TVhRre3kf8IKHgikinLC:LGBEGbL4Np84TQazCSiRC
MD5:	385152D096A96D1966C1042EDE38114F
SHA1:	A42D0587A2BF156C3F757778397A2E7AC8122E3C
SHA-256:	5A22FE5AF587540A9840E4F2A515564A2478DDA47AC1C81B687AC2F59C4C2FD0
SHA-512:	483E8819C6C5C1BCF725A4D6513364A5EE054E1D9100A8F42FFD2DBBFD52910CCA8E6DAF4435103C75AA2EBCA5A608BCC76EE6C531EA67C723267D9445D40256
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..E...E...E...Ll..D...Ll..D...RichE...................PE..L......L...........!..............................@.......................................@............................................................@............................................................................................rsrc...............................@..@........................................................0...8.......P.......................@...........................................r.......s...x...t...8...u.......v.......w...0...x.......y...........(...............................X.......(...............................h...............P....................................................................................................... .......8.......P.......h............................................................................................... .......0...

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\x86\vccorlib120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	247984
Entropy (8bit):	6.601853231729306
Encrypted:	false
SSDEEP:	6144:+SsS5fv6EATwqlGwyfDyodYI3ZubfW5nb2PQuW0x:+I5fv6EATwqlGwyfDyodYI3Zv1C
MD5:	69837E50C50561A083A72A5F8EA1F6A2
SHA1:	1A4B4C6C3CB6A5164CC1018AC72D0300455B3D8F
SHA-256:	9C9D4E421C55F7EF4E455E75B58A6639428CCD75C76E5717F448AFE4C21C52BC
SHA-512:	FD20C6B4EEC972C775681AD7322769D5074108D730727051EF77D779A277D77B12419E1FEE1E2EC0CF376A235573A85AD37975245DBF078DE467953AFD02164A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0p..Q..Q..Q..)..Q......Q......Q......Q......Q..P...Q..Q...Q......Q......Q......Q......Q..Rich.Q..........PE..L....OR.........."!.................4...............................................:....@.............................e=...A.......`...................>...p...R..0................................/..@............@...............................text............................... ..`.data...xp.......n..................@....idata.......@......."..............@..@minATL.......P.......0..............@..@.rsrc........`.......2..............@..@.reloc...R...p...T...6..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\eventmsg.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	59144
Entropy (8bit):	6.584653317811251
Encrypted:	false
SSDEEP:	768:iDb11m1u0/h46F5BHk++oJAj7kqMJSxk2T1DAMxkE9xu:iVl6hzk++oJY7ku7Fx5xu
MD5:	6610A420C60C420FDE9394F651DE6B92
SHA1:	10AFEF408D37A5B35FF9F72E22AC576077051C4C
SHA-256:	A80225CF40C2824327D50601AE067383DD53D45FDF0E2C064408E7F3EEF6D891
SHA-512:	F37AA430D61E966CEDFAE955C1315F17FF648BB18405B3B066325A8564AD7F9E916960B2F08D8748D6848530655C97F97C421250269210438A63CEA56E1F3D26
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....J.f...........!.........(....................@..........................`............@.......................... ..q.......n....P.................../...@..@...............................................................$....................text.............................. ..`.itext.............................. ..`.data...H...........................@....bss.....5...............................idata..n...........................@....didata.$...........................@....edata..q.... ......................@..@.rdata..E....0......................@..@.reloc..@....@......................@..B.rsrc........P......................@..@.............`......................@..@........................................................

C:\Program Files (x86)\Remote Manipulator System - Host\libasset32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9223040
Entropy (8bit):	6.35557334290542
Encrypted:	false
SSDEEP:	196608:hL7NqnDg0293wsNAXayRDfxihAYOjPTJ3kx+q8ZJPyv1wKl3bc2EeJUO9WLcb0A:blOJDm13rc2EeJUO9WLcb7
MD5:	1DF0C01B671AC516A8972159F60B0A6E
SHA1:	8DFD81B98B73BF1435C5906E7774FD1A7F693080
SHA-256:	7556D3A559D6967CE35BC8646D0A285E5ED5C3936D8D9709572C2BCEEB2AAB36
SHA-512:	5888C4DA7A4A48E5361B2512CE41CE9A5285BE18A4CA4F61FB9D73432B7FA5F27EA178F4641BEB69CFF24C59A994CA0F691D6F517DC9D084086020E7B143C842
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.f..i.t......!...*.~G...e..0............G...(m..........................j...........@... ......................Pc......`c.0"....c.............x..../....c............................`.S.....................\|ec..............................text....}G......~G.................`..`.data...,o....G..p....G.............@....rdata........H..0....G.............@..@/4...........0U......$U.............@..@.bss......... c..........................edata.......Pc.......c.............@..@.idata..0"...`c..$....c.............@....CRT....0.....c......8c.............@....tls..........c......:c.............@....rsrc.........c......<c.............@..@.reloc.......c......@c.............@..B/14..........`f.......e.............@..B/29..........pf.......e.............@..B/41......b...0h..d....g.............@..B/55...........h.......g.............@..B/67..........`i.......h.

C:\Program Files (x86)\Remote Manipulator System - Host\libcodec32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7137640
Entropy (8bit):	6.4815212793407
Encrypted:	false
SSDEEP:	98304:ORE7yGktThDyt6666666666666666666666666666666x666666666666666fwwk:oGktThD0TGh/fTCRwlRvZG3XYBVXl
MD5:	E9D7061F35A74AFA8699D9BC6F5474B6
SHA1:	10720488700E8FFE252A3F8FB8E4D20B3C4CF176
SHA-256:	AFEF8E83303E7D7EDE74E5FEA19C22BFE3C66E3EF3B2A6A24FFE7484B1CCD99D
SHA-512:	457A47D7C44B8461E5FBFF3C60B99EABE8A11894A115D84A411498F5AF3B69E50E06803EB6265F48DCE70FAB60E0D4EC34B954704B8792C53B6E5DA01DAB1717
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....F.f..T.i......!....(E..Q..:...........@E...0g..........................U.....?<m...@... ......................`P......pP.......P.............`.l../....P..#...........................FH......................rP.L............................text...`.E.......E.................`..`.rodata.@....0E......$E............. ..`.data...,(...@E..*....E.............@....rdata.......pE......XE.............@..@/4......L.....I.......H.............@..@.bss....X9... P..........................edata.......`P.......O.............@..@.idata.......pP.......O.............@....CRT....0.....P.......P.............@....tls..........P.......P.............@....rsrc.........P.......P.............@..@.reloc...#....P..$....P.............@..B/14...........Q......:Q.............@..B/29...........Q......BQ.............@..B/41......Y....S..Z....R.............@..B/55...........S......(S.

C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11149576
Entropy (8bit):	6.74436572838992
Encrypted:	false
SSDEEP:	98304:HxTsm8lfvWDu+j3eDBpsx1t1HnnCXLcrIEYXJ2WWHOHOBO3/c:HlpSf8TJxdHnnCb6IXXDWHlw3/c
MD5:	2F0D3D1ABD463AC64AA4E743B50AA055
SHA1:	8E782DD229D0A7B19CA99219A974D740D85A9A96
SHA-256:	499607E5C62078C00107BD08610441143D9E447916DC20596A068BA01149314E
SHA-512:	B8AF8897C420ED3EA329C1CCE8E8359C2CF58BED4B41929E965E576D66B0F75428D67D1633D6C2C960C4242C5EEDE8C7E6E4C4E909327ED95BB77800B1216D92
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....H.f.................f....#......w............@.......................................@......@.............................RX...`................./.......u....................................................t....0...w...................text............................... ..`.itext...X... ...Z.................. ..`.data...H............j..............@....bss.....................................idata..RX......Z..................@....didata..w...0...x...R..............@....edata.............................@..@.tls....h................................rdata..].........................@..@.reloc...u.......v.................@..B.rsrc.......`.......D..............@..@....................................@..@................

C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21972744
Entropy (8bit):	6.6265434909735195
Encrypted:	false
SSDEEP:	196608:s0vHlMP8Powlcy5updJK3JwwRZOJK09yxazoTklsWndb4EyNSgQuKTreDv6m3RKl:tvH88Powyy5Ua8K09yxefdb4NBRa
MD5:	4251BB135CC9A31DD42F0BE1FBC30A86
SHA1:	E8136675E22D5702DA6C9095384AD0B0035689F7
SHA-256:	E3742D88B1B74E80C1F144387904F3DD7544E7AE4C291D91943A1B4B91DB77AE
SHA-512:	5B09ADFD8829A4F59488C43B8C32CE608F0F050F7B2E7D469940AF616FC9503524CED14063B0FDD0EC4E70262473E6A056D60935370F443381768CDFCD755E2C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...\|H.f.....................\|U...................@...........................[......'P...@......@...................`.......`..$b...P!..9:...........O../......l....................................................p..........:....................text............................... ..`.itext............................. ..`.data...............................@....bss.........P...........................idata..$b...`...d...4..............@....didata.:...........................@....edata.......`.......$..............@..@.tls....h....p...........................rdata..]............&..............@..@.reloc..l............(..............@..B.rsrc....9:..P!..::.................@..@.............PG.......:.............@..@................

C:\Program Files (x86)\Remote Manipulator System - Host\vp8decoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388696
Entropy (8bit):	6.639766301981685
Encrypted:	false
SSDEEP:	6144:YIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwc8:YI8tiDOzyH9H8Tu6h04fZMZoMPuvfj0h
MD5:	E247666CDEA63DA5A95AEBC135908207
SHA1:	4642F6C3973C41B7D1C9A73111A26C2D7AC9C392
SHA-256:	B419ED0374E3789B4F83D4AF601F796D958E366562A0AAEA5D2F81E82ABDCF33
SHA-512:	06DA11E694D5229783CFB058DCD04D855A1D0758BEEAA97BCD886702A1502D0BF542E7890AA8F2E401BE36CCF70376B5C091A5D328BB1ABE738BC0798AB98A54
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................g......"............#.O...T8.....T8..................T8.....'....................Rich............................PE..L...v..T...........!..... ...........2.......0......................................A...............................@q.......q..........................X........(...1..8............................U..@............0...............................text............ .................. ..`.rdata...J...0...L...$..............@..@.data...H>...........p..............@....rodata.............................@..@.rsrc...............................@..@.reloc...(.......*..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\vp8encoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1640536
Entropy (8bit):	6.686577023894573
Encrypted:	false
SSDEEP:	49152:OSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwww3:OSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSZ
MD5:	D5C2A6AC30E76B7C9B55ADF1FE5C1E4A
SHA1:	3D841EB48D1A32B511611D4B9E6EED71E2C373EE
SHA-256:	11C7004851E6E6624158990DC8ABE3AA517BCAB708364D469589AD0CA3DBA428
SHA-512:	3C1C7FB535E779AC6C0D5AEF2D4E9239F1C27136468738A0BD8587F91B99365A38808BE31380BE98FD74063D266654A6AC2C2E88861A3FE314A95F1296699E1D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:J<A[$oA[$oA[$o...o@[$o...o.[$o...op[$o...o.[$o...oC[$o...oL[$oA[%o.[$oA[$op[$o...o@[$oL..o.[$oL..o@[$oL..o@[$oL..o@[$oRichA[$o................PE..L...}..T...........!.........>.......*..............................................5.......................................(............7..............X..............................................@............................................text............................... ..`.rdata..............................@..@.data...$r......."..................@....rodata.............................@..@.rsrc....7.......8...0..............@..@.reloc..............h..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\webmmux.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265816
Entropy (8bit):	6.521007214956242
Encrypted:	false
SSDEEP:	3072:MW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTl:MWSfr7sXSmPDbKPJ6/AsNk+1x
MD5:	49C51ACE274D7DB13CAA533880869A4A
SHA1:	B539ED2F1A15E2D4E5C933611D736E0C317B8313
SHA-256:	1D6407D7C7FFD2642EA7F97C86100514E8E44F58FF522475CB42BCC43A1B172B
SHA-512:	13440009E2F63078DCE466BF2FE54C60FEB6CEDEED6E9E6FC592189C50B0780543C936786B7051311089F39E9E3CCB67F705C54781C4CAE6D3A8007998BEFBF6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@~..!..!..!...p...!...p..!...p..+!..M...!..M...!..!...!..M...!..s..!..s..!..s..!..s..!..Rich.!..................PE..L...{..T...........!.........N.......k.......................................0..............................................4...x.......................X......../..................................Ha..@...............l............................text............................... ..`.rdata..v...........................@..@.data....B......."..................@....rsrc...............................@..@.reloc.../.......0..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisdecoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	373336
Entropy (8bit):	6.7704943019914845
Encrypted:	false
SSDEEP:	6144:faoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88RtOd:noPH0GgEp0gVd1ValsQXsHOd
MD5:	EDA07083AF5B6608CB5B7C305D787842
SHA1:	D1703C23522D285A3CCDAF7BA2EB837D40608867
SHA-256:	C4683EB09D65D692CA347C0C21F72B086BD2FAF733B13234F3A6B28444457D7D
SHA-512:	BE5879621D544C4E2C4B0A5DB3D93720623E89E841B2982C7F6C99BA58D30167E0DD591A12048ED045F19EC45877AA2EF631B301B903517EFFA17579C4B7C401
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Mm..,...,...,...}...,...}...,...}...,.......,.......,...,..,.......,...~...,...~...,...~...,...~...,..Rich.,..........................PE..L...t..T...........!................b.....................................................@..........................M......@N..d.......0...............X.......d&..................................p/..@...............T............................text...=........................... ..`.rdata...E.......F..................@..@.data...\|<...`.......H..............@..._RDATA...............d..............@..@.rsrc...0............j..............@..@.reloc..d&.......(...n..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Remote Manipulator System - Host\webmvorbisencoder.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	880216
Entropy (8bit):	5.239371133407635
Encrypted:	false
SSDEEP:	12288:vTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRN9S:YYF+Eyx2lzujtEIYRc1cQmsGa7ON9S
MD5:	642DC7E57F0C962B9DB4C8FB346BC5A7
SHA1:	ACEE24383B846F7D12521228D69135E5704546F6
SHA-256:	63B4B5DB4A96A8ABEC82B64034F482B433CD4168C960307AC5CC66D2FBF67EDE
SHA-512:	FB163A0CE4E3AD0B0A337F5617A7BF59070DF05CC433B6463384E8687AF3EDC197E447609A0D86FE25BA3EE2717FD470F2620A8FC3A2998A7C3B3A40530D0BAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A....u...u...u..C$G.3u..C$y.Iu..C$x..u...V..u...S..u...u..ju...H..u...'}.&u...'D..u...'C..u...'F..u..Rich.u..........................PE..L...s..T...........!.........R..............0......................................:W....@.........................`...........d....P..p............R..X....`...D......................................@............0..T............................text...}........................... ..`.rdata.......0......."..............@..@.data...\|<..........................@..._RDATA.......@......................@..@.rsrc...p....P......................@..@.reloc...D...`...F..................@..B........................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.35901589905449205
Encrypted:	false
SSDEEP:	6:6xboaaD0JOCEfMuaaD0JOCEfMKQmDkxboaaD0JOCEfMuaaD0JOCEfMKQmD:ZaaD0JcaaD0JwQQnaaD0JcaaD0JwQQ
MD5:	7D48941DB05D2D1C9A0C52739933543F
SHA1:	4FF1446A7D5DA6BBEA145000B00A9F4FFED90930
SHA-256:	C436AB7F36E238365FDDF5BDFEB9EBFEFACE94AD0FEB79C571182DA968815D87
SHA-512:	41C7DA95797437840014733F7021883E034503A9D8F07F7C9A0B1131A869A29A6E00D4E9FA99EEDAFBDD2F0DFDAFFB0A7671D8F666DA0E2023CA887E4BA0FB62
Malicious:	false
Preview:	*.>...........f.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................f.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7107431621466558
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqw:2JIB/wUKUKQncEmYRTwh0M
MD5:	35187E4A085530B83F7BAF848262B54A
SHA1:	74A9214BF089B30A894482788D8C661E98EF71C9
SHA-256:	0677912EE1C05BF14C4ACF4AC9B4CE280650BEEEA1AAA55B83996C333F6B394D
SHA-512:	EE4F3478871B1E86545368CC4ACA232450CA4822A6040DDBA7997B816F0F8452801621F37D0F90EF19A360CB30EBE26FA938FB6A4CB36090EE9D67EE6F3B0C63
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa3735c0b, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6651282372700069
Encrypted:	false
SSDEEP:	1536:VSB2ESB2SSjlK/2502y0IEWBqbMo5g5+Ykr3g16z2UPkLk+kK+UJ8xUJSSiWjFjF:VazaU+uroc2U5Si6
MD5:	202274806479363C1FDFF7CCD9823BD1
SHA1:	5E00109CB7002A37479293D739E937CAFD47FBFA
SHA-256:	041C9BB088DBA150EA9CE0511FBA38E57DC71D4C9E903FF72DA079F263D91726
SHA-512:	D91C74CB5D9D95A68C440D71E63CC2156859961D5594053C8A9BA254F104BF73F05F3E5904BC694B37E7D6296E9A45BB15B4EFE384A85E92E7E8642D692AD3C1
Malicious:	false
Preview:	.s\.... .......#.......X\...;...{......................0.e.....(6...\|..03...\|..h.b.....(6...\|..0.e.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{...................................l*U(6...\|..................X.CB(6...\|...........................#......0.e.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08083224723898716
Encrypted:	false
SSDEEP:	3:B/tOetYeit4vZ8NX6lXJZ2+tl72lXollkqqG9lXlZOS:B1rzg4BcX6lZZ1L2lIVr
MD5:	89F3658A91682E6764D77E957CCAC328
SHA1:	622A6542025F1115AFC3866AC377E435C9144856
SHA-256:	93AEF73B9E67466A5084AF276A79D1C974811AE146D298F5962C2DC8B0899877
SHA-512:	62454B98623512C6AD40D6C04EC67297F9DB64B8B4B9623D7190DCA0DBDCA103BDFAF1E8535119E1E4600DA6E7FE60D5D13C2F6CC04B7D3782693ED5C2F9B450
Malicious:	false
Preview:	.Y~.....................................;...{..03...\|..(6...\|..........(6...\|y.(6...\|..W.h.(6...\|s.................X.CB(6...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Remote Manipulator System\Logs\rms_log_2024-10.html

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	HTML document, ASCII text, with CR line terminators
Category:	dropped
Size (bytes):	2190
Entropy (8bit):	5.405930420732809
Encrypted:	false
SSDEEP:	48:SpiroU8xNqcoYERDML6RLi7rNRLigbqNK+27ikdgueptocplJM9:lr0xccoJxML6RLidRLi1o17fg9JM9
MD5:	64E71BD6E3D120E096849B8FBE928DF6
SHA1:	CB5F1D986D12F4822B1C701A075E9F3AC2854126
SHA-256:	0BD6D6290531486B4488387A47E2920181315E1C7363DC810705A4FF02945F7C
SHA-512:	321F6DF160E3F7F8D2F6AE1E066117096E7B9BAE8B62EC14E4C66B54D1C7998B6FC7FBC93F9500D61A1CD70C1A5BC5B9E3B3772AEE9A8652D20FF351E7E10A76
Malicious:	false
Preview:	<head>.<meta http-equiv="content-type" content="text/html; charset=utf-8" />.<meta name="copyright" content="TektonIT" />.<meta name="description" content="Remote Manipulator System - Server software, event log. Tektonit.com" />.<title>RMS – host log</title>.<style type="text/css">.body {.font-family: Courier New, monospace;.font-size: 100%;.background-color: #FFFFFF;.} .h1 {.font-size: 130%;.margin: 0px 0px 0px 0px;.} .textarea {.display: none;.margin-top: 5px;.width: 100%;.} ..main_table td {.border: 1px dashed #DADADA;.} ..e_l_0 {.background-color: #4c4cff;.border: 1px solid red;.} ..e_l_1 {.background-color: #fff04c;.border: none;.} ..e_l_2 {.background-color: #ffa94c;.border: none;.} ..e_l_3 {.background-color: #fc2727;.border: none;.} .#log_header td {.font-weight: bold;.} .#subheader {.font-size: 70%;.color: #DADADA;.margin-bottom: 10px;.} .</style>.<script language="javascript">.function show_textarea(elem) {.var parent_node = elem.parentNode;.var nodes = parent_node.chil

C:\ProgramData\Remote Manipulator System\eventmsg.dll

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	59144
Entropy (8bit):	6.584653317811251
Encrypted:	false
SSDEEP:	768:iDb11m1u0/h46F5BHk++oJAj7kqMJSxk2T1DAMxkE9xu:iVl6hzk++oJY7ku7Fx5xu
MD5:	6610A420C60C420FDE9394F651DE6B92
SHA1:	10AFEF408D37A5B35FF9F72E22AC576077051C4C
SHA-256:	A80225CF40C2824327D50601AE067383DD53D45FDF0E2C064408E7F3EEF6D891
SHA-512:	F37AA430D61E966CEDFAE955C1315F17FF648BB18405B3B066325A8564AD7F9E916960B2F08D8748D6848530655C97F97C421250269210438A63CEA56E1F3D26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....J.f...........!.........(....................@..........................`............@.......................... ..q.......n....P.................../...@..@...............................................................$....................text.............................. ..`.itext.............................. ..`.data...H...........................@....bss.....5...............................idata..n...........................@....didata.$...........................@....edata..q.... ......................@..@.rdata..E....0......................@..@.reloc..@....@......................@..B.rsrc........P......................@..@.............`......................@..@........................................................

C:\ProgramData\Remote Manipulator System\install.log

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.01636938503212
Encrypted:	false
SSDEEP:	6:HV9aLmKRL/PV9aLdd/aoCZV9aLhHujHO7eVaZV9aLwmnXjKVCZV9aLOLGeXkRLN2:raftaDSo2a9BekaRTZa6r0C
MD5:	F9872086A02298536EF00BCFC8C70BFA
SHA1:	7759537CB6B9EA6E5D2BC16C091EDDEB68AA1541
SHA-256:	27FCFDD52079AFD7F138B57691E002E2B5CFF2271A5145C4C5D0E3077EFB0E4D
SHA-512:	4A6CAC9B6946F8ABC858EB04973F5CEEEF099FB5A100FE8477B7E0ABFFAC9B8634552A2350E6D636F99452DA68A42F9AEDDF03DF7CFC495A837FB0E4BA405F6D
Malicious:	false
Preview:	29-10-2024_11:52:06#T:SilentInstall: installation 70510..29-10-2024_11:52:06#T:SilentInstall: NTSetPrivilege:SE_DEBUG_NAME:false. OK..29-10-2024_11:52:06#T:SilentInstall: OpenService: service not found_1. OK..29-10-2024_11:52:06#T:SilentInstall: CreateService. OK..29-10-2024_11:52:06#T:SilentInstall: finished (installation) 70510..

C:\ProgramData\Remote Manipulator System\msi\70510_{827D98D4-CA0D-43D0-8133-225659FBBC61}\winrar.msi

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: RMS - Host 7.5, Comments: This installer contains the logic and data to install RMS - Host 7.5, Keywords: Installer,MSI,Database, Subject: RMS - Host 7.5, Author: TektonIT, Ter-Osipov A.V., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Fri Sep 20 18:23:47 2024, Create Time/Date: Fri Sep 20 18:23:47 2024, Last Printed: Fri Sep 20 18:23:47 2024, Revision Number: {C457692F-C69F-4EF4-B4C9-3DF451F76F30}, Code page: 1251, Template: Intel;1049
Category:	dropped
Size (bytes):	27048960
Entropy (8bit):	7.926083719323171
Encrypted:	false
SSDEEP:	393216:0n/UUnsM1J1mFLE15NXZrtu96+cO55sXDqcovKYw9ZSkPfmYJEe78zvNhE:KekLewZFkcO5iDiv5gfmYz
MD5:	B4416A1D58BAF007E59F572B5ED0A5A4
SHA1:	48F9B1E7E8FA3CD821911AF283A28E0DA7BBF91F
SHA-256:	A45A4D586568C3762C7490ACA8EBBD61B226BCF261BE6C6C814796C47234B851
SHA-512:	20FD414CEECFF597BD903AC38F5FC93FB3107895D4F20B7403BD5F27FF2FFF7FF8413C86EC460D34256420F8C1E8E4D3FE7FCF4651D19ED57655434B0E11C78B
Malicious:	false
Preview:	......................>...................................8........6..................}........................................................................................................................................................................................................................................................ ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...A...M...:...;...=...........?...@...T...B...C...D...E...F...G...H...I...J...O...L...N...o.......P...Q...R...U.......&...V...Z...X...Y...#...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	999
Entropy (8bit):	4.966299883488245
Encrypted:	false
SSDEEP:	24:Jd4T7gw4TchTGBLtKEHcHGuDyeHRuDye6MGFiP6euDyRtz:34T53VGLv8HGuDyeHRuDye6MGFiP6euy
MD5:	24567B9212F806F6E3E27CDEB07728C0
SHA1:	371AE77042FFF52327BF4B929495D5603404107D
SHA-256:	82F352AD3C9B3E58ECD3207EDC38D5F01B14D968DA908406BD60FD93230B69F6
SHA-512:	5D5E65FCD9061DADC760C9B3124547F2BABEB49FD56A2FD2FE2AD2211A1CB15436DB24308A0B5A87DA24EC6AB2A9B0C5242D828BE85BD1B2683F9468CE310904
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<software_identification_tag xmlns="http://standards.iso.org/iso/19770/-2/2009/schema.xsd">...<entitlement_required_indicator>true</entitlement_required_indicator>...<product_title>Windows 10 Pro</product_title>...<product_version>....<name>10.0.19041.1865</name>....<numeric>.....<major>10</major>.....<minor>0</minor>.....<build>19041</build>.....<review>1865</review>....</numeric>...</product_version>...<software_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_creator>...<software_licensor>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_licensor>...<software_id>....<unique_id>Windows-10-Pro</unique_id>....<tag_creator_regid>regid.1991-06.com.microsoft</tag_creator_regid>...</software_id>...<tag_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</tag_creator>..</software_identification_tag>..

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.300899995179551
Encrypted:	false
SSDEEP:	6:934q2PcNwi2nKuAl9OmbnIFUt8MdJZmw+MIXDkwOcNwi2nKuAl9OmbjLJ:x4vLZHAahFUt8sJ/+ND54ZHAaSJ
MD5:	2D346CE784EE85C25CB60E7405088A4B
SHA1:	682F2C0D0D064AA6CEB9F81CF8E0A958D21B3515
SHA-256:	0B79271130A74EEF8D70DE0E8FAD7846F47231AD2A3A892501D0D9BDB7654132
SHA-512:	1A996C361C9EAE65A256DC40D2CF2A88F95F9874E390C682365E99F548BD25CA14F578F70D0D634EF922E4624FE87CBFA59C3B1B5B3C551103BAFB2B97779AE4
Malicious:	false
Preview:	2024/10/29-11:51:47.685 1d64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/29-11:51:47.687 1d64 Recovering log #3.2024/10/29-11:51:47.688 1d64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.300899995179551
Encrypted:	false
SSDEEP:	6:934q2PcNwi2nKuAl9OmbnIFUt8MdJZmw+MIXDkwOcNwi2nKuAl9OmbjLJ:x4vLZHAahFUt8sJ/+ND54ZHAaSJ
MD5:	2D346CE784EE85C25CB60E7405088A4B
SHA1:	682F2C0D0D064AA6CEB9F81CF8E0A958D21B3515
SHA-256:	0B79271130A74EEF8D70DE0E8FAD7846F47231AD2A3A892501D0D9BDB7654132
SHA-512:	1A996C361C9EAE65A256DC40D2CF2A88F95F9874E390C682365E99F548BD25CA14F578F70D0D634EF922E4624FE87CBFA59C3B1B5B3C551103BAFB2B97779AE4
Malicious:	false
Preview:	2024/10/29-11:51:47.685 1d64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/29-11:51:47.687 1d64 Recovering log #3.2024/10/29-11:51:47.688 1d64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.224973720904553
Encrypted:	false
SSDEEP:	6:9cj34q2PcNwi2nKuAl9Ombzo2jMGIFUt8MSdNJZmw+MuLDkwOcNwi2nKuAl9OmbX:2L4vLZHAa8uFUt8/XJ/+lLD54ZHAa8RJ
MD5:	34CD6D982F94C475CABCE7A314796C88
SHA1:	0C774D439FE0CDDA394346758F9836E47950751E
SHA-256:	64FF953E94882F2EF0C7CA0CC02367FFEBA3DFB5F82605766CE68CC3808456AE
SHA-512:	13A68A15EA6BE76D374EE7A85EA90D706CECE18E9D5E72486FA1C79E6BE46735503AE5D3816BFD6314089AAEFED1C5FEF5ABBBFD0703F5BCAF2C2233E7DC06CE
Malicious:	false
Preview:	2024/10/29-11:51:47.960 1e64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/29-11:51:47.964 1e64 Recovering log #3.2024/10/29-11:51:47.966 1e64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.224973720904553
Encrypted:	false
SSDEEP:	6:9cj34q2PcNwi2nKuAl9Ombzo2jMGIFUt8MSdNJZmw+MuLDkwOcNwi2nKuAl9OmbX:2L4vLZHAa8uFUt8/XJ/+lLD54ZHAa8RJ
MD5:	34CD6D982F94C475CABCE7A314796C88
SHA1:	0C774D439FE0CDDA394346758F9836E47950751E
SHA-256:	64FF953E94882F2EF0C7CA0CC02367FFEBA3DFB5F82605766CE68CC3808456AE
SHA-512:	13A68A15EA6BE76D374EE7A85EA90D706CECE18E9D5E72486FA1C79E6BE46735503AE5D3816BFD6314089AAEFED1C5FEF5ABBBFD0703F5BCAF2C2233E7DC06CE
Malicious:	false
Preview:	2024/10/29-11:51:47.960 1e64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/29-11:51:47.964 1e64 Recovering log #3.2024/10/29-11:51:47.966 1e64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\278627ed-fc24-4e0b-bb23-271ee4eddacd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\57d15819-7592-4652-9025-a1ea97ba9cb4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.296865367545073
Encrypted:	false
SSDEEP:	6:YAQNsNXuObqJx8wXwlmUUAnIMp5YLL22SQ:YyZuObO+UAnI2ZQ
MD5:	5C0AD1163C8B5F248F489608EA186A4C
SHA1:	9A8B385C0E455A8DB7E7BFDC5A728B5AA2B0BF69
SHA-256:	0CD65CA30DF86DCC5DB2C355573B4169F54D04B76AB0DA4961A86C05FA2BBF45
SHA-512:	80FB8B036C79AD78465EC6B7F56FD430732B1088BA173906E094D94510E64E6044D469911ED3FDC6B316984CB7DD3E543DB3996E669F0C292773622241BE4001
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1745769117.161779,"host":"fm9KDTkCEEOhjQ0Uz3wemEDKt2V49zM91BbUE6ob8vg=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1730217117.161786}],"version":2}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF42a2d6.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96930632548093
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4TX:Y2sRdsRdMHSOL3QYhbSpDa7n7
MD5:	FBDCC2772AA26D64959F72A60AEED4DF
SHA1:	65DC55AD8E6AF60BDBDD0E6F3BCA306D1B4706A3
SHA-256:	6C648B6773C99F25E60A691E688BE640F52738A14D94F8FADC01AE9E9EF81C05
SHA-512:	036D6EC84050006D1B725801BC5A70C4DAB1CFBFA5DC114D33BF66DA4BA362C4AD22E5DF5742BB5319A01434B5451162030B50828D20A72BB418824F5555D9E1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\TransportSecurity (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.296865367545073
Encrypted:	false
SSDEEP:	6:YAQNsNXuObqJx8wXwlmUUAnIMp5YLL22SQ:YyZuObO+UAnI2ZQ
MD5:	5C0AD1163C8B5F248F489608EA186A4C
SHA1:	9A8B385C0E455A8DB7E7BFDC5A728B5AA2B0BF69
SHA-256:	0CD65CA30DF86DCC5DB2C355573B4169F54D04B76AB0DA4961A86C05FA2BBF45
SHA-512:	80FB8B036C79AD78465EC6B7F56FD430732B1088BA173906E094D94510E64E6044D469911ED3FDC6B316984CB7DD3E543DB3996E669F0C292773622241BE4001
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1745769117.161779,"host":"fm9KDTkCEEOhjQ0Uz3wemEDKt2V49zM91BbUE6ob8vg=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1730217117.161786}],"version":2}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f7949625-9da5-4523-ab9b-73e297971f3f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.964484232732606
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqFkEsBdOg2HyuAAcaq3QYiubSpDyP7E4TX:Y2sRdsVpdMHyuAr3QYhbSpDa7n7
MD5:	300E036CDD7C7D5A718486ED7152B28A
SHA1:	FAD56D01E683001F5009FFB3B95C007944CA65BB
SHA-256:	B29D6C1C01B629438637DD8A4382B697C9D670FF0078EF229A1514F7E4D13A33
SHA-512:	629777359EFD1398F58FD368056ED2306C76BDD09A06EBB4E38A11BC2105BCD821ADBEE692AC6B29233DB69AFAB0AFE98158E54F35DBAA10EABFC5EB9CC635C0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374777119293003","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":429271},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.231896908655786
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPTZzzfV:CwNw1GHqPySfkcigoO3h28ytPTZzz9
MD5:	3AB898DEE023A3A092AA739DEAF15580
SHA1:	A383EA6BE572445632431697F6AD053E7EBF1903
SHA-256:	75864FF90C42F45A3F0C455691FF28397ABDCB68112C3ACAE07382903DE14AC2
SHA-512:	294D4C896645830CD542216E3B8DADE11D2240611846CE1B7050583DB5E6CD587259EF4FED6B575699AE0B0722FD11A82A3F309825B0C84BAB095BEFF68AE5C8
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.236593403904326
Encrypted:	false
SSDEEP:	6:9WN4q2PcNwi2nKuAl9OmbzNMxIFUt8MiAH3JZmw+My/DkwOcNwi2nKuAl9OmbzNq:cN4vLZHAa8jFUt8OXJ/+R/D54ZHAa84J
MD5:	A25DAE37316A94DC0B9A77ACB792F222
SHA1:	B7D328D0AC2F1084F3255D99793E301339898F9B
SHA-256:	ADF6C58337A103A51B3BF4E4A233DE07C1D7AF39107E91AA56D0C54F209BC1D5
SHA-512:	43A0C72740BC3686E3726C9F1A678AFE18314F2D08564B5A3D935E8114030392F6822477AB63B0F32EFF418B23DD990A252C39C8EAB22C897B3671FD96AD9F3E
Malicious:	false
Preview:	2024/10/29-11:51:48.558 1e64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/29-11:51:48.560 1e64 Recovering log #3.2024/10/29-11:51:48.569 1e64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.236593403904326
Encrypted:	false
SSDEEP:	6:9WN4q2PcNwi2nKuAl9OmbzNMxIFUt8MiAH3JZmw+My/DkwOcNwi2nKuAl9OmbzNq:cN4vLZHAa8jFUt8OXJ/+R/D54ZHAa84J
MD5:	A25DAE37316A94DC0B9A77ACB792F222
SHA1:	B7D328D0AC2F1084F3255D99793E301339898F9B
SHA-256:	ADF6C58337A103A51B3BF4E4A233DE07C1D7AF39107E91AA56D0C54F209BC1D5
SHA-512:	43A0C72740BC3686E3726C9F1A678AFE18314F2D08564B5A3D935E8114030392F6822477AB63B0F32EFF418B23DD990A252C39C8EAB22C897B3671FD96AD9F3E
Malicious:	false
Preview:	2024/10/29-11:51:48.558 1e64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/29-11:51:48.560 1e64 Recovering log #3.2024/10/29-11:51:48.569 1e64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438966651290209
Encrypted:	false
SSDEEP:	384:yeaci5GyiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1iurVgazUpUTTGt
MD5:	4BC8C3074C30852DEEB7A5540EBE11FC
SHA1:	70C785179957F7AED072AED275AC078DAE516BCC
SHA-256:	3BD6F99BF639F13C158F5EE3F347381560F823FE2835A9239591CFBA67A215FE
SHA-512:	53A99087ECF20F035DC3A240DB4AFA2154BF929ED20333F4360945DDEE90CB972A02FEC271C6DE682C70412B1C262E0AE31D083CD26AB5A0627A7C8294618FD6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.77753626794009
Encrypted:	false
SSDEEP:	48:7M3p/E2ioyVqHioy3DoWoy1CABoy1vkKOioy1noy1AYoy1Wioy1hioybioyFIoy1:7QpjuI0iAcXKQzJb9IVXEBodRBkD
MD5:	729755A543584C57CD66E20E19D18D35
SHA1:	39EE9BFCEEC0B1D209B7E41DBB11D9D158D5D2A7
SHA-256:	A53C7A1736A7D45B70C94028E758FE681926F7ACCD9F5B771F34AD7136B02860
SHA-512:	FEFA9EBCF3CA9B9D64C83B36B416270B485437ECA5DD23AF1BEEC14A3F1CD78637E4B07FA1DF2D66DBFD550A910227F9F0D77F8FA1BBBA1CF51733FF0BA7CF4F
Malicious:	false
Preview:	.... .c......9.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7895108629891827
Encrypted:	false
SSDEEP:	3:kkFklC6FlMlXfllXlE/HT8k9+z1NNX8RolJuRdxLlGB9lQRYwpDdt:kKbulMlIT80+z7NMa8RdWBwRd
MD5:	A92E0F025A1B1F24777E09DE85EC7735
SHA1:	405B93E9A07D735A31DB75157E0F7995CFC8F8AC
SHA-256:	90994E35CF808C8CDEFC6EF64BF77CFA1D1BDC206A97AABB0CED21FBE9A127B9
SHA-512:	DD61963DD5578140CB9E881DF77F7C3393A5A45F76F5623D964447FF531FF1731FC96CABB87F972C642339C8B3075DB4CAE4A193FC6F2C0405162DAF20058C91
Malicious:	false
Preview:	p...... ........._.{.*..(....................................................... ..........W....X@..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.150184159866505
Encrypted:	false
SSDEEP:	6:kKbn99UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:TnkDnLNkPlE99SNxAhUe/3
MD5:	F348ED174F9B692FC975BBEDE67888CC
SHA1:	B6CE2336973D7286C609D81A7C3CADA388434B9F
SHA-256:	31E9714ADBA52C1EF708A27A778C99AC0A8AAAEFAE3E5B062E12A6AE72C7A649
SHA-512:	DE3272998345AA927AD259C0B0D2DABFE1D4CF3C89E252CC96805D5C4AEBB8D4AE14BFBCDCA8F40FDB46DF07AC2891AA1B77384B9AAF3E8B46E059402FF950FC
Malicious:	false
Preview:	p...... ........5....*..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.080886708542914
Encrypted:	false
SSDEEP:	48:Y38YvXvwvfb7ACHaECU6akn2ZqijwiIE0O:ufif4oh612ZdXrz
MD5:	BF56EA3311E537D07F5F6FEA9CAE4460
SHA1:	D7F799E8E657D02A0C5199FD4ABCAEEA149BFDCA
SHA-256:	E324C92627E85634AE9DE4B854794E315D857EB70010B32EE11F84AED5DF8E2B
SHA-512:	5DB4540D641EC8C8DC5B1806041B7D01BCC3FD58DD7AF940B82C9A121B4C7EE2E37E98EE0DAF768F6036F97B320D0432D405A4518187B2C0FF01F17721B9C874
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1730217110000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"600435bc6c3bfd6739f3c39b93bb45a3","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696492435000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5c23293c742ed52b97ce6913651e2bac","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696492429000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"1281d7dbf4238170aa87c435aca63c66","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696492423000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"824a4ec59c469b030f3b98175cf76e67","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1255,"ts":1696491691000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"9e3dce9d3ce52b8c98d60243d5cf7aa0","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696491691000},{"id":"DC_Reader_Edit_LHP_Banner"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4533452028845728
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsielQ4:lNVmsw3SHtbDbPe0K3+fDZdk
MD5:	BA679B68225FB0EBCE25E55D66A7AB22
SHA1:	22C8F8F1F8F9D66CC07AF6BFCB1399984F5E86C2
SHA-256:	21A57613FDAC00AABD0ECB2E50B91DD3C1F97A51B3D41C86B8EE3B34C95B3499
SHA-512:	8631B64011DA6DA9717460E34DEBBDBF82A5FBF6641965543EE80752CB5043BF9F2E446CE0417AB1AE0BFD11C9F6A660A1283C9D470779067053E5C58CCFE928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9559313208404003
Encrypted:	false
SSDEEP:	48:7M1rvrBd6dHtbGIbPe0K3+fDy2dsiPxqFl2GL7msw:7E3SHtbDbPe0K3+fDZddKVmsw
MD5:	C106B1E0E0A68E5ABD24CFDB01714F96
SHA1:	A39ADDF6CB2D45A75B5DE66C0DD1BD8AA9852760
SHA-256:	39A8DDA22BD6929D744D94AC5F85A8A578308D7A7346751AF14A63BF037FAF2F
SHA-512:	FA55D5EFD81B945D5A246BEFEC42BD271A536D8194B62EFC50687B66C8AC25C59B93754228861D7091D4C0BC7B9BD62224924D4EC93CEA933914E4148449F237
Malicious:	false
Preview:	.... .c......E9.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-29 11-51-49-757.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.324884864199771
Encrypted:	false
SSDEEP:	384:kLf6vv+c4aCC39j0mUZUs3ssFOVmoF9g6Z7PtFVvyzjJ3Gkj2RZ/YPYJMKWr6DzV:Nhx
MD5:	510E75017793510CEEA133B7E86B4A09
SHA1:	B833CD722F81A93A6CAAF5C6E61100176614A93C
SHA-256:	C05D65983CAEADBC942AFFF418B90C34B12FC48451103612A577043E9CE81860
SHA-512:	4732A8E4DC9B90BA07AC5F9E84442C6F9D318DFA9624DAFDD01B673DC0AD34F673C52B5300EA8AF63D8EBC79711C42F3686889BD92B538FE6F9DDC041BF14C38
Malicious:	false
Preview:	SessionID=b73298e7-30ad-4286-93a7-ab9b932e8b0e.1730217109790 Timestamp=2024-10-29T11:51:49:790-0400 ThreadID=7464 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b73298e7-30ad-4286-93a7-ab9b932e8b0e.1730217109790 Timestamp=2024-10-29T11:51:49:791-0400 ThreadID=7464 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b73298e7-30ad-4286-93a7-ab9b932e8b0e.1730217109790 Timestamp=2024-10-29T11:51:49:791-0400 ThreadID=7464 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b73298e7-30ad-4286-93a7-ab9b932e8b0e.1730217109790 Timestamp=2024-10-29T11:51:49:791-0400 ThreadID=7464 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b73298e7-30ad-4286-93a7-ab9b932e8b0e.1730217109790 Timestamp=2024-10-29T11:51:49:791-0400 ThreadID=7464 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.414185011912146
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gR+5:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRk
MD5:	536F6CCAE3A322AE6AA1D57E05866DB1
SHA1:	6BE0643B518C7073968F098D86F19F92FB3071CE
SHA-256:	80D497DE535C164ABC1F6693E4132C2048ABBA79BAD0ED3B39AEC3E0BE54A486
SHA-512:	1F192EBDE79B601568A87F27B367D4B2CACBF5F61B6C44415ADDAEBCA4DE34701CEBEDF93529DDAB46CD2A39D38A5F8C0C358DC62838F4A2F8686EADC6633943
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\49bf621b-c5e0-4a54-8bd5-5c2d5aeba465.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4e9412d0-5eb2-4ee7-b136-1df5f3aa75c7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b6bcbe39-8da8-4ef5-8b86-bf9488d7b993.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\be033063-4763-4196-9c5a-1e2174b195ec.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\file.pdf

Download File

Process:	C:\Users\user\Desktop\J4zGPhVRV3.exe
File Type:	PDF document, version 1.7, 1 pages
Category:	dropped
Size (bytes):	108190
Entropy (8bit):	7.905258999017268
Encrypted:	false
SSDEEP:	1536:sr9GFXska83hLFSpS819rColq1zDLBcp7nt+F6hjKMHiRnJUkqpJFesRRsyRa9uF:qwFXPa83ef+olkrBAtZtCNqpq4syR2uF
MD5:	DCFCC74B4BBB9269D597588002B04605
SHA1:	2E48F41DB1098C1F392255091C3462FB663984D2
SHA-256:	98A9020D81E818B5391A99CC8419006B83B2A8610A63F74A7AD97610C861F63C
SHA-512:	CDDC9CDFAC718A8B5E20B67E682F36E02FE7524F23991FFADBE5F969E3284DE68F86E9A6C657FCE3F6166FB156BD7E339661E6133FB6CC3DFE57ADCCAD0E5FE9
Malicious:	false
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 19 0 R/MarkInfo<</Marked true>>/Metadata 75 0 R/ViewerPreferences 76 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 1/Kids[ 3 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 9 0 R/F3 14 0 R>>/ExtGState<</GS7 7 0 R/GS8 8 0 R>>/XObject<</Image16 16 0 R/Image17 17 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 987>>..stream..x..X.O.0.~....{+.....lO(R.P.4$6...x.t<P......v.6)i.I.DS;.....\|v.._.....%9>........\...x..y._L......i._....S.g..K...hH~w;.2.g..F.}j......,......@,..w;.l...9e\.-..d..LN/5..q..<.L6:.v.{..L.t;'..n...`H.....b(.(......\|...QoZ.q..&........{8T(...=...Q0.".....$B...Xq,6..j^..:..8P..PU. .9.H&..=......v...T.....j...[......./......g#.....f......K...de.b...v.#h.....B.B..!.A.%E..Hd.^.F....-}j.

C:\Users\user\AppData\Local\Temp\winrar.msi

Download File

Process:	C:\Users\user\Desktop\J4zGPhVRV3.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: RMS - Host 7.5, Comments: This installer contains the logic and data to install RMS - Host 7.5, Keywords: Installer,MSI,Database, Subject: RMS - Host 7.5, Author: TektonIT, Ter-Osipov A.V., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Fri Sep 20 18:23:47 2024, Create Time/Date: Fri Sep 20 18:23:47 2024, Last Printed: Fri Sep 20 18:23:47 2024, Revision Number: {C457692F-C69F-4EF4-B4C9-3DF451F76F30}, Code page: 1251, Template: Intel;1049
Category:	dropped
Size (bytes):	27048960
Entropy (8bit):	7.926083719323171
Encrypted:	false
SSDEEP:	393216:0n/UUnsM1J1mFLE15NXZrtu96+cO55sXDqcovKYw9ZSkPfmYJEe78zvNhE:KekLewZFkcO5iDiv5gfmYz
MD5:	B4416A1D58BAF007E59F572B5ED0A5A4
SHA1:	48F9B1E7E8FA3CD821911AF283A28E0DA7BBF91F
SHA-256:	A45A4D586568C3762C7490ACA8EBBD61B226BCF261BE6C6C814796C47234B851
SHA-512:	20FD414CEECFF597BD903AC38F5FC93FB3107895D4F20B7403BD5F27FF2FFF7FF8413C86EC460D34256420F8C1E8E4D3FE7FCF4651D19ED57655434B0E11C78B
Malicious:	false
Preview:	......................>...................................8........6..................}........................................................................................................................................................................................................................................................ ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...A...M...:...;...=...........?...@...T...B...C...D...E...F...G...H...I...J...O...L...N...o.......P...Q...R...U.......&...V...Z...X...Y...#...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\41737e.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: RMS - Host 7.5, Comments: This installer contains the logic and data to install RMS - Host 7.5, Keywords: Installer,MSI,Database, Subject: RMS - Host 7.5, Author: TektonIT, Ter-Osipov A.V., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Fri Sep 20 18:23:47 2024, Create Time/Date: Fri Sep 20 18:23:47 2024, Last Printed: Fri Sep 20 18:23:47 2024, Revision Number: {C457692F-C69F-4EF4-B4C9-3DF451F76F30}, Code page: 1251, Template: Intel;1049
Category:	dropped
Size (bytes):	27048960
Entropy (8bit):	7.926083719323171
Encrypted:	false
SSDEEP:	393216:0n/UUnsM1J1mFLE15NXZrtu96+cO55sXDqcovKYw9ZSkPfmYJEe78zvNhE:KekLewZFkcO5iDiv5gfmYz
MD5:	B4416A1D58BAF007E59F572B5ED0A5A4
SHA1:	48F9B1E7E8FA3CD821911AF283A28E0DA7BBF91F
SHA-256:	A45A4D586568C3762C7490ACA8EBBD61B226BCF261BE6C6C814796C47234B851
SHA-512:	20FD414CEECFF597BD903AC38F5FC93FB3107895D4F20B7403BD5F27FF2FFF7FF8413C86EC460D34256420F8C1E8E4D3FE7FCF4651D19ED57655434B0E11C78B
Malicious:	false
Preview:	......................>...................................8........6..................}........................................................................................................................................................................................................................................................ ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...A...M...:...;...=...........?...@...T...B...C...D...E...F...G...H...I...J...O...L...N...o.......P...Q...R...U.......&...V...Z...X...Y...#...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\417381.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: RMS - Host 7.5, Comments: This installer contains the logic and data to install RMS - Host 7.5, Keywords: Installer,MSI,Database, Subject: RMS - Host 7.5, Author: TektonIT, Ter-Osipov A.V., Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2021 - Premier Edition with Virtualization Pack 27, Last Saved Time/Date: Fri Sep 20 18:23:47 2024, Create Time/Date: Fri Sep 20 18:23:47 2024, Last Printed: Fri Sep 20 18:23:47 2024, Revision Number: {C457692F-C69F-4EF4-B4C9-3DF451F76F30}, Code page: 1251, Template: Intel;1049
Category:	dropped
Size (bytes):	27048960
Entropy (8bit):	7.926083719323171
Encrypted:	false
SSDEEP:	393216:0n/UUnsM1J1mFLE15NXZrtu96+cO55sXDqcovKYw9ZSkPfmYJEe78zvNhE:KekLewZFkcO5iDiv5gfmYz
MD5:	B4416A1D58BAF007E59F572B5ED0A5A4
SHA1:	48F9B1E7E8FA3CD821911AF283A28E0DA7BBF91F
SHA-256:	A45A4D586568C3762C7490ACA8EBBD61B226BCF261BE6C6C814796C47234B851
SHA-512:	20FD414CEECFF597BD903AC38F5FC93FB3107895D4F20B7403BD5F27FF2FFF7FF8413C86EC460D34256420F8C1E8E4D3FE7FCF4651D19ED57655434B0E11C78B
Malicious:	false
Preview:	......................>...................................8........6..................}........................................................................................................................................................................................................................................................ ... ...!...!..."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...).........+...+...,...,...-...-.........../.../...0...0...1...1...2...2...3...3...4...4...5...5..........<................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...A...M...:...;...=...........?...@...T...B...C...D...E...F...G...H...I...J...O...L...N...o.......P...Q...R...U.......&...V...Z...X...Y...#...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI7E5B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	169896
Entropy (8bit):	6.068969720857241
Encrypted:	false
SSDEEP:	3072:jqSoP/44Yvge5XKhpKJJdu+ew+BZPHbN2e9n2p+:j5g/ve5XKhMVJSIun6+
MD5:	B5ADF92090930E725510E2AAFE97434F
SHA1:	EB9AFF632E16FCB0459554979D3562DCF5652E21
SHA-256:	1F6F0D9F136BC170CFBC48A1015113947087AC27AED1E3E91673FFC91B9F390B
SHA-512:	1076165011E20C2686FB6F84A47C31DA939FA445D9334BE44BDAA515C9269499BD70F83EB5FCFA6F34CF7A707A828FF1B192EC21245EE61817F06A66E74FF509
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._`,"..Bq..Bq..Bq..q..Bq<.q..Bq..q..Bq..q/.Bq..qh.Bq.y.q..Bq.y.q..Bq..Cq..Bq..q..Bq..q..Bq..q..Bq...q..Bq..q..BqRich..Bq........PE..L.....,a...........!.....p...$......................................................U..................................m............`..p............x.......p..........................................@............................................text....o.......p.................. ..`.rdata..M............t..............@..@.data....1... ......................@....rsrc...p....`.......$..............@..@.reloc...L...p...N...*..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8830.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1445004
Entropy (8bit):	4.928688695241539
Encrypted:	false
SSDEEP:	24576:NMMMMMMSLLLLLLL2MMMMMMSLLLLLLLucMMMMMMSLLLLLLLyW:NMMMMMMSLLLLLLL2MMMMMMSLLLLLLLu/
MD5:	59869CA2C982AB98E24ED932FCDEB392
SHA1:	03D8E0A485672A7B6D07DAA1C0BEAF27D09AE8C6
SHA-256:	6887964A628664DFAA03C6F5EAC43A3B3C15154B2EBF71CD560AC01900319D86
SHA-512:	E36F755C172CD464FFBFFC5AC94A126FF9CF4F769C5B19D969DA4B84B9B6022929EDBE6D11A2BF8C351EAE34842D370DADCC6508EDBDAFB8E64AE1020B6DA333
Malicious:	false
Preview:	...@IXOS.@.....@z^]Y.@.....@.....@.....@.....@.....@......&.{827D98D4-CA0D-43D0-8133-225659FBBC61} .Remote Manipulator System - Host..winrar.msi.@.....@.....@.....@......ARPPRODUCTICON.exe..&.{C457692F-C69F-4EF4-B4C9-3DF451F76F30}.....@.....@.....@.....@.......@.....@.....@.......@.... .Remote Manipulator System - Host......Rollback....B.:.0.B. .4.5.9.A.B.2.8.O.:...[1]..RollbackCleanup..#.4.0.;.5.=.8.5. .2.@.5.<.5.=.=.K.E. .D.0.9.;.>.2...$.0.9.;.:. .[.1.]....@.......@........ProcessComponents"...1.=.>.2.;.5.=.8.5. .@.5.3.8.A.B.@.0.F.8.8. .:.>.<.?.>.=.5.=.B.>.2....@.....@.....@.]....&.{74F2505E-B20A-4AED-968F-AE5B278DB38A}8.C:\Program Files (x86)\Remote Manipulator System - Host\.@.......@.....@.....@......&.{26EAB54E-4659-47E8-86F9-4CB74F7E03BE}...@.......@.....@.....@......&.{596F4636-5D51-49F5-B3B4-F3C366E9DC23}...@.......@.....@.....@...........@....&.{00000000-0000-0000-0000-000000000000}.@.....@.....@......&.{182310A2-CD9E-4171-ACD1-3AEDD260A15F}D.C:\Program Files (x86)\Remote Man

C:\Windows\Installer\SourceHash{827D98D4-CA0D-43D0-8133-225659FBBC61}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.162700461853412
Encrypted:	false
SSDEEP:	12:JSbX72Fj0JAGiLIlHVRpth/7777777777777777777777777vDHFa+pN03pSl0i5:JuJQI5pxiF
MD5:	1995DB1A93EF8E0DC76768EA43A1D410
SHA1:	1F5269085CE6F46459F8A9CEE2DDD693B548622F
SHA-256:	536FC817A05BD1A3B7789905A6C0C4C5520F87A4674D8B7F3803880FF6E1BC8C
SHA-512:	3598668A58520F93827C58F0FCB3B978E7A6667A688E33129FBC0C8E4DE4D1848DCA63B9793AD43B159B5E7EC6A77CEA3ABF7D5E64BD2BA8D6AAA4A9CA36DDAB
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.9702481706040955
Encrypted:	false
SSDEEP:	96:YhU1DFTTkEhWOVbpUGkOzs9t4H7qKsGkOzs9FOulKW:11ZXkapIw7qK2K
MD5:	578EDF21D8020715EE271CD36DAD54C1
SHA1:	73615EBB3495A822512846263BFD6D7AC8654E4E
SHA-256:	3321E5705868006AB786D009087533CC13552BEA0E81DD5F32591E6D468C0E9E
SHA-512:	5CC39952D8B7AB56D8468027E93E96CD2086523CB235E27E42D95ED5A8B108383BF63F238E990B61EFAE3E7E988880A5FD93EEEE983B39F324C93BE0AA93327C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\ARPPRODUCTICON.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	79000
Entropy (8bit):	5.817114158024628
Encrypted:	false
SSDEEP:	768:eMAyYdTmPJbgqcnDckJn2T1qAMxkE32T1PAMxkENF:e1U81ckJ2+xqJxX
MD5:	CF607A6E2EFC98CC93CBA458D67409A7
SHA1:	00A3A822BD2CEF028AC3D754384AC51572434FF6
SHA-256:	CDA44F8CF3D3CD2C53BA0817C48BED83E2C272109A9E4E576EDDF44C1CDE3DCE
SHA-512:	804C7C55ACDEF9563C20578CFF05EE343BEE534E1E1CF58A0DE79CD32E59A3CB32204D504F2CF2C2F3BBAE912DF487B60C4BFE71DC0C97A9385AE0FEECA80D45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.................................d4......................................4T..(.......t0...............d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...t0.......@..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70808
Entropy (8bit):	5.607528324359863
Encrypted:	false
SSDEEP:	768:WdMAyYdTmPJbgqcnDc/soJx2T1rAMxkEO2T1MAMxkEt:Q1U81cLJ01x/QxR
MD5:	88DA800311CCD13A668D0A5EAA097C58
SHA1:	B8027DF74E3E163708216653175C0AB9645C415C
SHA-256:	B873767C58AA6CD8567AEB280D972BE7DD3E4CDA467D243F03A0E4EA4656EFE8
SHA-512:	94F53676AA881A158512CD3B6300CCC98852D922E2C805A2F3D213D4509F9476237B8E05190FE312ED3E85E18CF9C9DC6D6A9ABB59BD672CC3720ADE68D0D5CC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...`...............P....@.................................:9......................................4T..(.......\................d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc...\........ ..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423064
Entropy (8bit):	4.689677321402016
Encrypted:	false
SSDEEP:	1536:h1U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLLs:zjcT6uuuutMMMMMMSLLLLLLLeYuCe1
MD5:	DC2DDE26180A704020EA5F25FA3D4109
SHA1:	AF1DE2D1FEE35B05DCB1E7C6244374BC384B1A1E
SHA-256:	57981B06DC17914E7D4D20F499E2EEF7D32199EEA0D2A0B6E111610BD4D82E44
SHA-512:	2BD7A3BC8F8DDD3803DFE7F8961A0443019EA1AAC2EBEF8B37219ABF8D3A9DE8C567CD356EC6595C6B4E4BB5C3ABFC33504EDBBEB40FAC323C4C624F269E8E88
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.................................iE......................................4T..(........u...............d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_start_C00864331B9D4391A8A26292A601EBE2.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423064
Entropy (8bit):	4.689846678978893
Encrypted:	false
SSDEEP:	1536:21U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLLm:ijcT6uuuutMMMMMMSLLLLLLLeYuakse
MD5:	DADE78A1FC5114E0D61D8C19C2ABE1D7
SHA1:	247B722DC1E40B4FAE49C053B123FF676C462480
SHA-256:	BB375A8CB025ED0ACF5E2EC3ED454EAC3B43BE0D4882D1DEC10547EB6BC6BFE8
SHA-512:	0BE986369B9E0578F78357E7B6CBA625C96BD22B653254C95694ECF6A9130A6899171E97426477845C2A18D37814F1F39AB9870BA6B0D35F874AE1E2329DB0A7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@.........................................................................4T..(........u...............d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{827D98D4-CA0D-43D0-8133-225659FBBC61}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423064
Entropy (8bit):	4.6899970675273615
Encrypted:	false
SSDEEP:	1536:+1U81cqS/ZJgAmxJtAqXy/yxREpU1WyY68iuuuu6AppppppppEMMMMMMMSLLLLL8:ajcT6uuuutMMMMMMSLLLLLLLeYuqWB
MD5:	9A473B5B37C32DD7A4F6FEB49F77482C
SHA1:	4FDC2A31959C3D224D1D764578F82443100FB0F2
SHA-256:	DFCD1ADAC26965034DABC01340BD0DEA96D28B92551B94A1078C00B632A38019
SHA-512:	F0F2EEF60958FC3617052ADF5CE881E1896A7D24C5F5CFC9049854E7AA1BBB699879BAEC807734F9EDF6C25EE26AE4317D2D8C9317AC3023BD0EF707BBB6BA39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...C...C...CD..C...C...C...C=..C...C...C...C...C...CRich...C........................PE..L.....-a.................@...................P....@..................................Z......................................4T..(........u...............d...........................................................P...............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@....rsrc....u..........................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362976185422579
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauI:zTtbmkExhMJCIpEF
MD5:	BB2CE8940B8A87DA2A94AD04C374AFAD
SHA1:	16CD6E3F7F515C9767D9FAABC0D5A53D5BC5DA9C
SHA-256:	34256DF7631D6C7A12F402FC01EB61E61833A5E2D6162CC6D1C823C3A9595F81
SHA-512:	84C0BBCF7F891CA4FCFD7EC30A7CBA219D80BC585647C00E0F7F5BB954818A2FEE04E18EDA11C1250E17B445CFC7D5A73D89C3BF6046437A6FBF0EDC4EB4F6DC
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	2464
Entropy (8bit):	3.2455651021712324
Encrypted:	false
SSDEEP:	24:QOaqdmuF3r3+Y+kWReHgHttUKlDENh+pyMySn6tUKlDENh+pyMySwwIPVxcwIPVs:FaqdF73r+AAHdKoqKFxcxkFdh
MD5:	FF76FEB3BD89C56C8D7CC5CBA20780B4
SHA1:	6CE08598FB9F6A708A58A1E70E3A8064B02E293A
SHA-256:	347AB4AC628725086CE205A1C6BF6F7DC9F66328A868BE301B5BACF51A8085A1
SHA-512:	5FC8143987AB841AD73FB53B0C6F269946FFC871BC7FE913EF2664D16A5AFE83C2A7906B9571BCAC31C516C83C658BEC3DBDC99B7EE88BE35A98431B9D31DD54
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.u.e. .. O.c.t. .. 2.9. .. 2.0.2.4. .1.3.:.0.2.:.0.3.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A62E94087F64223B9812F11186592BA

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	6327
Entropy (8bit):	6.449679524443466
Encrypted:	false
SSDEEP:	192:z88fedNBkYmUiaCE5XFO06rYCqRXUBQv/dd4EmrA:wvdJiaCE5XMrhQv/dvmc
MD5:	7986A077EA538F991E6BCA4186A6FC5F
SHA1:	D103255066DE3E4FD4BD64E460760803C62EE171
SHA-256:	991D3734F3D27E7DFB63E26F0105D6E1DA42C0E68E4639F3A1E9B086692ADCE2
SHA-512:	2A2A68877DA12173908537D058E37B9CE5875B8E5B57C3CBF652D2235189D7A1AF51B909866B88DA2462BB8E579F706151761BB865455F1BFA1164388B6F896D
Malicious:	false
Preview:	0...0......0....H........0Y1.0...U....BE1.0...U....GlobalSign nv-sa1/0-..U...&GlobalSign GCC R45 CodeSigning CA 2020..241029144436Z..241105144435Z0...0...$....oZ&....240813120056Z0...z..t{..\|...210126064802Z0...b.....$......210222211006Z0...KOY7A.HI.._e..210222211004Z0...r..'wi..]..n..210222211002Z0....&......e...210222212203Z0...s..........S..210222212205Z0...<.r8>.,......240904080004Z0....!.Z.j.....o..240906101526Z0...&e.....U.....240916183602Z0...2p'.]A..AL..210225044747Z0+...>.".K.y..<...210226150613Z0.0...U.......0...6..C..M.1...210308171016Z0...5.L<ea..X\|.e..210326070003Z0......%...R~..v..210528124802Z0...wP...:^....M..210709151203Z0...i#c~c...x0W...210406072402Z0...H.....?..a...210428153602Z0+..s...O...a.I..210503115753Z0.0...U.......0...Y.Y....^.^...210524083602Z0+....iW..(v..9...210604033751Z0.0...U.......0...~.T..!...h.}..210604164111Z0......q..k.0.u...210615133333Z0...\C...."{......210621174758Z0..._Kx.B.........210622165609Z0.....U...$......210712152133Z0

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4770 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	4770
Entropy (8bit):	7.946747821604857
Encrypted:	false
SSDEEP:	96:9/nBu64pydcvOHRUfu0xK1bQYMRSRNoYmxYvk56sHMZhh4m:9/nBuP2cGxUfu6K1bpWJ6vfh4m
MD5:	1BFE591A4FE3D91B03CDF26EAACD8F89
SHA1:	719C37C320F518AC168C86723724891950911CEA
SHA-256:	9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
SHA-512:	02F88DA4B610678C31664609BCFA9D61DB8D0B0617649981AF948F670F41A6207B4EC19FECCE7385A24E0C609CBBF3F2B79A8ACAF09A03C2C432CC4DCE75E9DB
Malicious:	false
Preview:	MSCF............,...................O.................2Wqh .disallowedcert.stl....^K...CK.wTS...:.w.K'.C0T.....Bh.{....C.)......Y@...(..).R."E..D^6........u....\|f~3...o.3. ..SPK.k.o#...."{-.U..P........:..aPr.@.d......Dy.h.....)..:...!./\A.....A<I_<$...q.h..........'.....7....H...@`T..K.S.%...Y4..R.....`.....-....D...(..b..-c."...G.=.dx..S+..2.a.E....d.L...77J...c.[..@..iT&..^78..g....NW6.Ek..FY.F........cNt.O...R..........D...... k........J.y...z.d...;.9_t...].@....yw..}.x....d.t..`f\K..;\|.h.X...4/.;.xT......q>.0...<...3...X..L$.&.,b.....\V....\......G..O..@..H3.....t..J..).x.?.{[..G>.7...<...^Q..z..Gw9P..d....i].n%K}.z..2.Py...A..s...z..@...4..........4.....Y.d..._Z.5.s..fl.C..#.K{9^.E...k..z.Ma..G.(.....5g. ...}.t.#4....$;.,....S@fs....k......u .^2.#_...I........;.......w..P...UCY...$;.S._\|.x..dK...[i..q..^.l..A.?.....'N.. .L.l......m.*.+f#]............A.;.....Z..rIt....RW....Kr1e=8.=.z:Oi.z.d..r..C_......o...]j.N;.s....3@3.dgrv.

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.620888567247171
Encrypted:	false
SSDEEP:	48:DDwiqXhFVYJZy76dszxdu6PMPhZYMvV0wo:5VyWAxIksZYMZo
MD5:	0036C7F3034883C50AB8770F4B77045C
SHA1:	171AF8EAB9C0912B556F085E2FEC04345154AA8D
SHA-256:	3D799CB384DE12760B12F3B507FC082801A18015C10A6CB4A2FC833B1224B63B
SHA-512:	2B3FCBD249E6C684B703D6BD81E368FA12B1EF51982D184A441800A7ABA9661279E4BFD1BE6E971F8B66A140A792CD4407FF1B618FE7ACF2CC341041C3427F9A
Malicious:	false
Preview:	0..........0.....+.....0......0...0......]...RM..j....4V[..9..20241029143132Z0s0q0I0...+..............B..M.%..Dg..5 .....F...x9...C.VP..;..w.......T..r...G....20241029143132Z....20241102143131Z0....H...............=%.DA.....Z..#:Z.!.hb...)..$..Tg.....0...k7.bo .U.{.=..........o(!o.>.cQO.PB....phn.Q.....Hd...GC...k..I/.R...Hn.9Z..-.f....G..g.?...p(nu.i..b..c=.......R....i..,..lW.GGI.L.f2P..I..x{..e.Cv....4-Z.KG..12..R=p..}...FK...x4.......N....<...J..I....0...0...0.............l..w..Q......0....H........0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450...240417032406Z..241115000000Z0g1.0...U....BE1.0...U....GlobalSign nv-sa1=0;..U...4GlobalSign Code Signing Root R45 - OCSP 1.2 202408070.."0...*.H.............0.........\..L2...........t.....A~iK.N./.;.x...d.}...#.L!.7[PE#...Lce..s.9......v....4...5.R.YN.e.:.T.l.P...../..8g?zq.....>......g&#..:.l?.x.......nC#......?...p.{6..).u.S.........c..A...#.;L..o...7.~.x+q..D\|5.i

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	1680
Entropy (8bit):	7.633697772176036
Encrypted:	false
SSDEEP:	48:+sU22Ck1tkG8b7nIxCw5DgSUnpU446J8WpNTE:FcCk1tkvb7n4Cw5MSiw6mOTE
MD5:	774C41BFFEAC2F39CAF9D4D9E5B1C269
SHA1:	6995001BDB15C04ED44B7C49C4DD1D006FFC9F0C
SHA-256:	AE55743B397EA98C721BBE2323C085C257ECA1E81C90D7126727B5B688FF3418
SHA-512:	AB045893C033CADED4F08EC56215534E26C792BA9632A650604C2FB9E3DD174B019C92D7C59AD9E8352FAC6C21D60F3BBC06ADC53B1D1032A3B5878C05A3113C
Malicious:	false
Preview:	0..........0.....+.....0.....r0..n0............`...H,.&...=...20241029143304Z0o0m0E0...+...........r...nK..._..[.Q.....$..kw...Y.!gdv.x..vF...M...k3....20241029143304Z....20241102143303Z0....H................s>..T.p.K..<...m.f.c.k$h".K.....OD.=.}^E...f)0;.......k....a....H.c...<.\|C..GX...HbD..`....HPb.........]Bv.D..?.fv.....g-..lE.V......d.W.Y.}.F.S.Up.........H[t.b.a1.t.Yw.t.~.?Q..>..]+.z_t...2.E.9..f....$..'r$.O?...~.A.@...2.:.`..b4f.Q-........0...0...0..........f3...z.....0....H........0Y1.0...U....BE1.0...U....GlobalSign nv-sa1/0-..U...&GlobalSign GCC R45 CodeSigning CA 20200...240920234113Z..241221234112Z0Z1.0...U....BE1.0...U....GlobalSign nv-sa100...U...'gsgccr45codesignca2020CA OCSP Responder0.."0....H.............0.........+..6b.I...$...f.C.K?}.s...r;.y.m,]q.....@.N.2..x.F5Y........%.).....>.yH......\.9.<..ns..,..jQ.....~..V.N..Y.........8.a..Rg..A3....[.p<......by..Y.y...9....7%.%.i$..I..T~........2i....R..rW..~.!..e...;....\.9;<L.._..I.Fe.

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.4788830223435685
Encrypted:	false
SSDEEP:	24:qB4wjIZwoqELj163NJZO0UQF7YS6Q1hGTKa/UzuhruWQZNokJ5/3:vXuoFEZO0J9YS6AK3/U+ufJR3
MD5:	F02A93B8FC29E79176EC504BE405CA76
SHA1:	D4D6635BF298C774FFCA7FCC78745D1D8F239A4E
SHA-256:	FDDB178A63E771B728483B38F1942AB6E55A9A22499EFBB3790477044AA06E46
SHA-512:	A949C07BE3C32B73B16B42BB49EB2A88E0F54F9B909E1B0F801CE00C7D67D0BFB588E579F28E518AF6B037E9828019CA01E41E606584BBC5F7D9BFDE796413B7
Malicious:	false
Preview:	0..........0.....+.....0.....}0..y0.......#J./....%UB....S..i..20241029142022Z0s0q0I0...+..........h.$..y.u.3.V..G.....K...E$.MP.c.........x..BEp.A.o...T....20241029142022Z....20241102142021Z0....H.................K.^....E....J.......z.............0.B@M...A.h....f>@I.Z.il.4.T;...5a.../..M.,g.K....)?.{7{..k.]T..>..."..w.6..B..c..j..."...lp.......JT[P....)4Gg....K.'V... ......X.......D'p29..V<.I./.}H.V.\|..&T...S2.RGD..a....'....Oc..tz})r. ...v...G..wM.m...0...0...0.............l.=}.....?^..h0....H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1.0...U....GlobalSign0...240417032334Z..241115000000Z0Y1.0...U....BE1.0...U....GlobalSign nv-sa1/0-..U...&GlobalSign Root R3 - OCSP 1.2 202408070.."0....H.............0..........(....n..7>...;.Y...'.C...5..C;/d...q........W.}..I\.[..7Yb...m....2..il.7=...r..}.....d?e...}x=!.q.fR.{.....Sd.wf=...`;{.;.B...G..:..xI.Y......Z..BU....'...i..a..#..i........M\|.-.}.?:a".'...w...-......./F0.Aw.......q..o......t.....{

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BD92F95DED26541D3AF7F44DC7914843

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	721
Entropy (8bit):	7.509448772658927
Encrypted:	false
SSDEEP:	12:iyKyEmS4gh0PmHKN1htQkNvWOJ4egFUtv9uw4IbPaOgUfLFa1xXHmfhHPmUKYF1n:isPS4ghBCjvWPegFUNrLa+Lk1VF38n
MD5:	F62EB6FC89FCB2E84A96665DCEB28095
SHA1:	9E0D2B2164EE619BD27290210E72804D7202077B
SHA-256:	DB1288D243E86E05F5C16D9BACA7FF66F2F174C237E01C17419F3D8FB067F537
SHA-512:	412792594C68BF2C109DB2E05C50CA1035E2FF66B9B406EEB7643272F8C3B5B40A186EC498D47933680CAAEB347EAB656C7E70D753D22BA57241D0E93DD5B699
Malicious:	false
Preview:	0...0.....0....H........0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R45..241007000000Z..250115000000Z./0-0...U.......0...U.#..0......F...x9...C.VP..;0....H..............p.!.....bE...K..~.&u.3.>.,............L.........l..v....2..Um.c..0..#...\.Q.b4.R.Q^..`$[.?B....=....G......M.....Nl.a.b...M.A......k.....3./s?.\|c....&bx$.^....6.=...H..p...8oe..]]<$......t...q..t5Kaw.YV.A.7f...s).4U..<..._9.P..:..9.[.S.:F..C.s..^_.'.A.........1.=...i.+j.,....m........Y.g.......`.d..]a.....f.D.!5.6$.h....7.`......;..a..d.....u..........Hk..J.m..B.jM.P......~....$}..\^P.n..F.Y...n...P...WG....L.Y...D.S......k...w.f?...LK.......+...#F....4..*pGcG.)/%.D~.1..o...s.M.B.e?P

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A62E94087F64223B9812F11186592BA

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	222
Entropy (8bit):	2.7772562789012345
Encrypted:	false
SSDEEP:	3:kkFklIS6+kfllXlE/HgzlllllgRlR8rHelJlWlLltUKlrlxUXW4mgelSlj:kKRS7qllgDpWhliKxlxUDmgrj
MD5:	B2CA6D8CFFD1B38D9E17626E2FF4B58C
SHA1:	1182CA2BD798D96C800196D9847A9AFC7669A3ED
SHA-256:	053F50D17ED1A44AE4DB79E075537C108F9A2E9FE4EBCBFD7FA4F01B6D202354
SHA-512:	37974CE8D80A2229FF88C087E89FC02A98B12B98BEB1778558867223F1CB6A3F8635B949757C59B29B8F0D4B2FBEA65F67FF18FD1429275738A772A3810E6884
Malicious:	false
Preview:	p...... ....j......R%..(....................................................... ........".........................h.t.t.p.:././.c.r.l...g.l.o.b.a.l.s.i.g.n...c.o.m./.g.s.g.c.c.r.4.5.c.o.d.e.s.i.g.n.c.a.2.0.2.0...c.r.l...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.174857563182266
Encrypted:	false
SSDEEP:	3:kkFkllAZfllXlE/0htlX16pFRltB+SliQlP8F+RlTRe86A+iRlERMta9b3+AL0Wy:kKQN+SkQlPlEGYRMY9z+s3Ql2DUevat
MD5:	CD60C6D6737C745C64691D3CD2DBCEBD
SHA1:	56BF6BEB9A967A6FF703A3F5BA64EB614285E28A
SHA-256:	2889E9A5F703CD0853DCF8EC3A196202EC250E545E379E783BEE7DA19B27CFE6
SHA-512:	2E936A3DBCAB7A1902CCAD17A6EFDDA86681BAEEF8C564B1F15AAAC565E65C74579BAF986F8D2AFB73FF707C92A0F8DB6909C13E97E68102A145F4A52382055B
Malicious:	false
Preview:	p...... ........O..-%*..(....................................................... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	532
Entropy (8bit):	3.9923996611540007
Encrypted:	false
SSDEEP:	12:TGoNyY/DWzJqe3KQj22iv8sFF1gUeMalCrlQNlVgfMceOT0YQ:ThyY/DgJRjYvP+U7uCKlCMcF0YQ
MD5:	66745CA6FE3F2DFFD461A4C74082C96F
SHA1:	68BDFE6D3F5C90E8D6D04951B3056E2B26970E49
SHA-256:	72BC284C365213DECA5515C66E172F192278B716295B6001FF520DC373802788
SHA-512:	CC98AC17F1ACADE53BC0AC84EB1C437E9F119C4DA772D4B91D3B81CDDF9314D91FD5926B4E9C2D0A23148B23109AF66AD34B4B4C6BD0AF6B8FD8A6BEFBF4F3FC
Malicious:	false
Preview:	p...... ....J....D.R%..(................:.?.......3-......................3-.. ........:.?.*......V...............h.t.t.p.:././.o.c.s.p...g.l.o.b.a.l.s.i.g.n...c.o.m./.c.o.d.e.s.i.g.n.i.n.g.r.o.o.t.r.4.5./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.Q.V.F.Z.P.5.v.q.h.C.r.t.R.N.5.S.W.f.4.0.R.n.6.N.M.1.I.A.Q.U.H.w.C.%.2.F.R.o.A.K.%.2.F.H.g.5.t.6.W.0.Q.9.l.W.U.L.v.O.l.j.s.C.E.H.e.9.D.g.O.h.t.w.j.4.V.K.s.G.c.h.D.Z.B.E.c.%.3.D...".1.7.1.a.f.8.e.a.b.9.c.0.9.1.2.b.5.5.6.f.0.8.5.e.2.f.e.c.0.4.3.4.5.1.5.4.a.a.8.d."...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_E818918BC57803438E0E0146A88425A7

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	544
Entropy (8bit):	3.9395462513168633
Encrypted:	false
SSDEEP:	12:YEH48l/HfDWzf79bLgLzK8sFAY6ealztksMSJeXpDG4:DY8tHfDgz9YLmvqY6m7pC4
MD5:	8A7C53D392FF84DDD81C7E780E32B52F
SHA1:	E14069D8CB588425150EC5788716B29BA2687DF1
SHA-256:	5C2493692BDCC855EE11354D546905A8A09CB07C177423FC9BF30F8290C9CD23
SHA-512:	5EA05D688C6CB5039C4E12E7F2F74B8CA4E924D2F9EB0B9C84A457B0E066222C0CB3A37566777E6966520266D195FECD770756277552284060284E54016C6EA0
Malicious:	false
Preview:	p...... ....V.....R%..(................P.v.......4-......................4-.. ........P.v.*......V...............h.t.t.p.:././.o.c.s.p...g.l.o.b.a.l.s.i.g.n...c.o.m./.g.s.g.c.c.r.4.5.c.o.d.e.s.i.g.n.c.a.2.0.2.0./.M.E.0.w.S.z.B.J.M.E.c.w.R.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.L.u.A.3.y.g.n.K.W.%.2.F.7.x.u.S.x.%.2.F.0.9.F.%.2.B.h.H.V.u.E.U.Q.Q.U.2.r.O.N.w.C.S.Q.o.2.t.3.0.w.y.g.W.d.0.h.Z.2.R.2.C.3.g.C.D.H.Z.G.D.p.D.i.h.E.2.3.%.2.B.Y.N.r.M.w.%.3.D.%.3.D...".6.9.9.5.0.0.1.b.d.b.1.5.c.0.4.e.d.4.4.b.7.c.4.9.c.4.d.d.1.d.0.0.6.f.f.c.9.f.0.c."...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	3.9706591420994912
Encrypted:	false
SSDEEP:	12:gTRLZMjVDWzFU8iv8sFt4QAfROA/pULrKYGIvemxf:OLZyVDgFUhv/ofROS6Lrxeef
MD5:	464024F517CE9976EFC1B9C07548A33C
SHA1:	7595C519B9FC826AB2BF7F568C80172E03D156DC
SHA-256:	4C46C2CAFE7D475D55D17C63BEA51316A7E786AA8423442693A9050A8A831D62
SHA-512:	DEF00CC3D7DC420118A56A8C55425BED882080C194D965A22A9AA691EE28B60B91552FE439CB0EAC673CBEADE27C06F38D976C502AE80AC08CD6F2F04E3BDB89
Malicious:	false
Preview:	p...... ....2.....d@%..(................Wf......tY2-....................tY2-.. ........Wf..*......V...............h.t.t.p.:././.o.c.s.p...g.l.o.b.a.l.s.i.g.n...c.o.m./.r.o.o.t.r.3./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.1.n.G.h.%.2.F.J.B.j.W.K.n.k.P.d.Z.I.z.B.1.b.q.h.e.l.H.B.w.Q.U.j.%.2.F.B.L.f.6.g.u.R.S.S.u.T.V.D.6.Y.5.q.L.3.u.L.d.G.7.w.C.E.H.g.D.G.E.J.F.c.I.p.B.z.2.8.B.u.O.6.0.q.V.Q.%.3.D...".d.4.d.6.6.3.5.b.f.2.9.8.c.7.7.4.f.f.c.a.7.f.c.c.7.8.7.4.5.d.1.d.8.f.2.3.9.a.4.e."...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BD92F95DED26541D3AF7F44DC7914843

Download File

Process:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	214
Entropy (8bit):	2.704690219929331
Encrypted:	false
SSDEEP:	3:kkFklnlRwhvfllXlE/lBRwblR8rHelJlWlLltUKlAmqel1KlKLNlMu1j:kKOwhyLupWhliKemqe3KQjMIj
MD5:	5ADED064FE474039B778B88A22310A03
SHA1:	225A4C1677741BCB315D0E57712389C61AF0F3B0
SHA-256:	3D4328272C5BC736926B9553CEB5A96CAF121366ADAEE679D55776127B8345FF
SHA-512:	EEB27FC22D5C2AA91C3D8F985288153AF6932022E4E3A9C62565A66322A93003CFD641BC8924F297502D2DF427D9B1ABAFAF1903EC4EB3F80CD468C779383455
Malicious:	false
Preview:	p...... ....b...e..R%*..(....................................................... .........3.K.......................h.t.t.p.:././.c.r.l...g.l.o.b.a.l.s.i.g.n...c.o.m./.c.o.d.e.s.i.g.n.i.n.g.r.o.o.t.r.4.5...c.r.l...

C:\Windows\Temp\~DF1D68A25D9EB316F1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF49649112289761ED.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.5507394891373292
Encrypted:	false
SSDEEP:	96:Ic5tT3PjkEhWOVbpUGkOzs9t4H7qKsGkOzs9FOulKW:L5tz7kapIw7qK2K
MD5:	D824C34173451D7A8A5846B0F0783E0B
SHA1:	F172BC7A881997D158FA6D4296F29762E27867A8
SHA-256:	33473AF11B94AE5AFFDCC40731DAD5C9420828575FD15F238EF2225528B3E0FF
SHA-512:	627D17FE11721E13F108E87785FBAAF954CC998E09278C34E52F86AFE218AD017C2F9AD0C0476AD378E2AC8EE07A8EABC2948E4F76428532D6A1A3B060FEE389
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF549F7F686D014070.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.9702481706040955
Encrypted:	false
SSDEEP:	96:YhU1DFTTkEhWOVbpUGkOzs9t4H7qKsGkOzs9FOulKW:11ZXkapIw7qK2K
MD5:	578EDF21D8020715EE271CD36DAD54C1
SHA1:	73615EBB3495A822512846263BFD6D7AC8654E4E
SHA-256:	3321E5705868006AB786D009087533CC13552BEA0E81DD5F32591E6D468C0E9E
SHA-512:	5CC39952D8B7AB56D8468027E93E96CD2086523CB235E27E42D95ED5A8B108383BF63F238E990B61EFAE3E7E988880A5FD93EEEE983B39F324C93BE0AA93327C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5903583D1FF3E44E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5B3F3D97000D85E1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06922452476682561
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKObr10+TNNEdWRLQVky6lS:2F0i8n0itFzDHFa+pN0iS
MD5:	1C9682AC1798C75177814F9706CCA15B
SHA1:	F6DE4A4543670A03B2D4C7FC5990A3EDA0E707AB
SHA-256:	A69BC090416B42500D854ECE1914DA1D7403D448D219EE5CC17103423088A23A
SHA-512:	A2DF9F94116202EB5FC7B6677FD284EE2D0609A5A0F50B06F32CD9BCF5E60AACC07562EF20C1EA1034014D7BF88DC58287D5926460CB6A45FCF90FF50FBE314A
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF69983B8D9E93C771.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.9702481706040955
Encrypted:	false
SSDEEP:	96:YhU1DFTTkEhWOVbpUGkOzs9t4H7qKsGkOzs9FOulKW:11ZXkapIw7qK2K
MD5:	578EDF21D8020715EE271CD36DAD54C1
SHA1:	73615EBB3495A822512846263BFD6D7AC8654E4E
SHA-256:	3321E5705868006AB786D009087533CC13552BEA0E81DD5F32591E6D468C0E9E
SHA-512:	5CC39952D8B7AB56D8468027E93E96CD2086523CB235E27E42D95ED5A8B108383BF63F238E990B61EFAE3E7E988880A5FD93EEEE983B39F324C93BE0AA93327C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6B9E8091C3A2E56D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.5507394891373292
Encrypted:	false
SSDEEP:	96:Ic5tT3PjkEhWOVbpUGkOzs9t4H7qKsGkOzs9FOulKW:L5tz7kapIw7qK2K
MD5:	D824C34173451D7A8A5846B0F0783E0B
SHA1:	F172BC7A881997D158FA6D4296F29762E27867A8
SHA-256:	33473AF11B94AE5AFFDCC40731DAD5C9420828575FD15F238EF2225528B3E0FF
SHA-512:	627D17FE11721E13F108E87785FBAAF954CC998E09278C34E52F86AFE218AD017C2F9AD0C0476AD378E2AC8EE07A8EABC2948E4F76428532D6A1A3B060FEE389
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6EDFFD5D53F3641A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7213E1D3B9FF115C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.2936153881025568
Encrypted:	false
SSDEEP:	96:WlKWJ0aqKsGkOzs9UpUGkOzs9t4HCZOqkEh:AKKqKBpIwWk
MD5:	C5E360F55A757D1F5A959CE90EC37050
SHA1:	403701C6C6D5C5CACFCBC4238FF26C1FC7AEC65B
SHA-256:	B6416E564E25A0617185101A083AFB7ECDABF52CDD9D53F80BF056C548469EF1
SHA-512:	C65A403C7659F210FD1CEAFC0EF3C2575BB09AB833B4BCFFAFB0353A98770AEB5D4CF2DB200C1AE7D9739289D33BDCA6BC453BEFAAB6A6101A1829414525ADDC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBA83223C3E4FEFF2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.5507394891373292
Encrypted:	false
SSDEEP:	96:Ic5tT3PjkEhWOVbpUGkOzs9t4H7qKsGkOzs9FOulKW:L5tz7kapIw7qK2K
MD5:	D824C34173451D7A8A5846B0F0783E0B
SHA1:	F172BC7A881997D158FA6D4296F29762E27867A8
SHA-256:	33473AF11B94AE5AFFDCC40731DAD5C9420828575FD15F238EF2225528B3E0FF
SHA-512:	627D17FE11721E13F108E87785FBAAF954CC998E09278C34E52F86AFE218AD017C2F9AD0C0476AD378E2AC8EE07A8EABC2948E4F76428532D6A1A3B060FEE389
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE60ABF5300CEFCCC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE6BF8ED199B0F265.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.997852853008998
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	J4zGPhVRV3.exe
File size:	25'298'721 bytes
MD5:	3bca758ce1d5c3858ac8e10a2a38b514
SHA1:	0f9de1a1b10f85941f89dbf603cc587323e2c003
SHA256:	55cb5fa83a98b9d7cc70cad5fe59f44f8d48956b363df2fbf7ad649b9c4970e5
SHA512:	1ff9f246d91931832fda34437e6453edf2bbc5af45214f4d55a9ee615a73ed912fe6dfa6680158ce4af46fc4c4dc95a7b573a0d59c5a78f24a8617a3bc0f7c55
SSDEEP:	786432:D3Li0WVudC2IXJ4nSeS2jEfqJQTsrYT3sbmz:fivoierplTssbm
TLSH:	D3473316E3E601D0C77BA2359067CD0BF63238CA1A21868712F45B693F73B759E3AB15
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i...i.\.i...b.\.i...g.\.`.].C.\...Y.R.\...\.a.\.....a.\

File Icon


Icon Hash:	7d6d7d51754d0d24

Static PE Info

General

Entrypoint:	0x140032ee0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66409723 [Sun May 12 10:17:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	b1c5b1beabd90d9fdabd1df0779ea832

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FD38869A9C8h
dec eax
add esp, 28h
jmp 00007FD38869A35Fh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007FD3886997E3h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007FD38869A4F3h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007FD38869C507h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FD388688D73h
dec eax
lea edx, dword ptr [00025747h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FD38869B5C2h
int3
jmp 00007FD3886A17A4h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x597a0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x597d4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0x1afec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6a000	0x306c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8b000	0x970	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x536c0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x53780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4b3f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48000	0x508	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x588bc	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4676e	0x46800	f06bb06e02377ae8b223122e53be35c2	False	0.5372340425531915	data	6.47079645411382	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x48000	0x128c4	0x12a00	2de06d4a6920a6911e64ff20000ea72f	False	0.4499003775167785	data	5.273999097784603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5b000	0xe75c	0x1a00	0dbdb901a7d477980097e42e511a94fb	False	0.28275240384615385	data	3.2571023907881185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6a000	0x306c	0x3200	b0ce0f057741ad2a4ef4717079fa34e9	False	0.483359375	data	5.501810413666288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6e000	0x360	0x400	1fcc7b1d7a02443319f8fcc2be4ca936	False	0.2578125	data	3.0459938492946015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x6f000	0x15c	0x200	3f331ec50f09ba861beaf955b33712d5	False	0.408203125	data	3.3356393424384843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0x1afec	0x1b000	aba98e9b76b495732b08c5ff383222b3	False	0.4563802083333333	data	6.599280879597481	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8b000	0x970	0xa00	77a9ddfc47a5650d6eebbcc823e39532	False	0.52421875	data	5.336289720085303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x70524	0x7b82	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9970586374849769
RT_ICON	0x780a8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.21535253756062936
RT_DIALOG	0x888d0	0x2ba	data	0.5286532951289399
RT_DIALOG	0x88b8c	0x13a	data	0.6560509554140127
RT_DIALOG	0x88cc8	0xf2	data	0.71900826446281
RT_DIALOG	0x88dbc	0x14a	data	0.6
RT_DIALOG	0x88f08	0x314	data	0.47588832487309646
RT_DIALOG	0x8921c	0x24a	data	0.6279863481228669
RT_STRING	0x89468	0x1fc	data	0.421259842519685
RT_STRING	0x89664	0x246	data	0.41924398625429554
RT_STRING	0x898ac	0x1a6	data	0.514218009478673
RT_STRING	0x89a54	0xdc	data	0.65
RT_STRING	0x89b30	0x470	data	0.3873239436619718
RT_STRING	0x89fa0	0x164	data	0.5056179775280899
RT_STRING	0x8a104	0x110	data	0.5772058823529411
RT_STRING	0x8a214	0x158	data	0.4563953488372093
RT_STRING	0x8a36c	0xe8	data	0.5948275862068966
RT_STRING	0x8a454	0x1c6	data	0.5242290748898678
RT_STRING	0x8a61c	0x268	data	0.4837662337662338
RT_GROUP_ICON	0x8a884	0x14	data	1.15
RT_MANIFEST	0x8a898	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	0.39786666666666665

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindNextFileA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipFree, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipAlloc

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 16:52:00.136460066 CET	49742	443	192.168.2.7	96.6.160.189
Oct 29, 2024 16:52:00.136499882 CET	443	49742	96.6.160.189	192.168.2.7
Oct 29, 2024 16:52:00.136751890 CET	49742	443	192.168.2.7	96.6.160.189
Oct 29, 2024 16:52:00.136872053 CET	49742	443	192.168.2.7	96.6.160.189
Oct 29, 2024 16:52:00.136883974 CET	443	49742	96.6.160.189	192.168.2.7
Oct 29, 2024 16:52:00.864991903 CET	443	49742	96.6.160.189	192.168.2.7
Oct 29, 2024 16:52:00.878959894 CET	49742	443	192.168.2.7	96.6.160.189
Oct 29, 2024 16:52:00.878981113 CET	443	49742	96.6.160.189	192.168.2.7
Oct 29, 2024 16:52:00.880425930 CET	443	49742	96.6.160.189	192.168.2.7
Oct 29, 2024 16:52:00.880500078 CET	49742	443	192.168.2.7	96.6.160.189
Oct 29, 2024 16:52:00.947820902 CET	49742	443	192.168.2.7	96.6.160.189
Oct 29, 2024 16:52:00.948043108 CET	49742	443	192.168.2.7	96.6.160.189
Oct 29, 2024 16:52:00.948060036 CET	443	49742	96.6.160.189	192.168.2.7
Oct 29, 2024 16:52:00.990199089 CET	49742	443	192.168.2.7	96.6.160.189
Oct 29, 2024 16:52:00.990211010 CET	443	49742	96.6.160.189	192.168.2.7
Oct 29, 2024 16:52:01.037065029 CET	49742	443	192.168.2.7	96.6.160.189
Oct 29, 2024 16:52:01.072777987 CET	443	49742	96.6.160.189	192.168.2.7
Oct 29, 2024 16:52:01.072875023 CET	443	49742	96.6.160.189	192.168.2.7
Oct 29, 2024 16:52:01.072916985 CET	49742	443	192.168.2.7	96.6.160.189
Oct 29, 2024 16:52:01.073899031 CET	49742	443	192.168.2.7	96.6.160.189
Oct 29, 2024 16:52:01.073921919 CET	443	49742	96.6.160.189	192.168.2.7
Oct 29, 2024 16:52:14.639050961 CET	57244	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:14.644000053 CET	57245	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:14.644869089 CET	8080	57244	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:14.644953966 CET	57246	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:14.644999027 CET	57244	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:14.649626970 CET	57248	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:14.649728060 CET	8080	57245	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:14.650913954 CET	80	57246	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:14.650998116 CET	57246	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:14.651000977 CET	57245	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:14.653266907 CET	57247	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:14.653996944 CET	57249	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:14.654020071 CET	57244	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:14.654040098 CET	57244	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:14.655548096 CET	5651	57248	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:14.656317949 CET	57248	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:14.658929110 CET	5651	57247	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:14.659507990 CET	57247	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:14.659665108 CET	5651	57249	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:14.659687042 CET	8080	57244	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:14.659698009 CET	8080	57244	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:14.660648108 CET	57249	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:14.665102959 CET	57245	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:14.665128946 CET	57245	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:14.665236950 CET	57246	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:14.665250063 CET	57246	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:14.665469885 CET	57247	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:14.665482044 CET	57247	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:14.665618896 CET	57249	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:14.665618896 CET	57249	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:14.665623903 CET	57248	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:14.665623903 CET	57248	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:14.670474052 CET	8080	57245	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:14.670522928 CET	8080	57245	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:14.670536041 CET	80	57246	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:14.670562983 CET	80	57246	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:14.670770884 CET	5651	57247	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:14.670809031 CET	5651	57247	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:14.670950890 CET	5651	57249	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:14.670973063 CET	5651	57249	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:14.670989037 CET	5651	57248	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:14.671000957 CET	5651	57248	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:15.520262957 CET	5651	57248	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:15.520323992 CET	57248	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:15.520447969 CET	57248	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:15.525897026 CET	5651	57248	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:15.581471920 CET	57251	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:15.586858034 CET	5651	57251	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:15.586927891 CET	57251	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:15.587331057 CET	57251	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:15.587450027 CET	57251	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:15.592711926 CET	5651	57251	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:15.593257904 CET	5651	57251	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:16.434659958 CET	5651	57251	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:16.434818029 CET	57251	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:16.437947035 CET	57251	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:16.443370104 CET	5651	57251	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:16.501621962 CET	57252	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:16.507337093 CET	5651	57252	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:16.507590055 CET	57252	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:16.510412931 CET	57252	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:16.510432005 CET	57252	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:16.515816927 CET	5651	57252	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:16.515830040 CET	5651	57252	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:17.367275953 CET	5651	57252	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:17.369683981 CET	57252	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:17.440885067 CET	57252	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:17.446630955 CET	5651	57252	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:17.613629103 CET	57254	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:17.619529963 CET	5651	57254	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:17.619720936 CET	57254	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:17.639888048 CET	57254	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:17.639888048 CET	57254	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:17.645855904 CET	5651	57254	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:17.645962000 CET	5651	57254	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:18.470547915 CET	5651	57254	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:18.472274065 CET	57254	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:18.472327948 CET	57254	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:18.477720022 CET	5651	57254	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:18.537255049 CET	57260	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:18.543863058 CET	5651	57260	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:18.544039011 CET	57260	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:18.544594049 CET	57260	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:18.544670105 CET	57260	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:18.551014900 CET	5651	57260	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:18.551182032 CET	5651	57260	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:19.303352118 CET	57261	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:19.308825016 CET	5651	57261	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:19.308901072 CET	57261	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:19.316405058 CET	57261	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:19.316452026 CET	57261	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:19.321847916 CET	5651	57261	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:19.321978092 CET	5651	57261	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:19.402128935 CET	5651	57260	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:19.402415037 CET	57260	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:19.402746916 CET	57260	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:19.408173084 CET	5651	57260	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:19.526329994 CET	57262	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:19.531985998 CET	5651	57262	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:19.532424927 CET	57262	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:19.533135891 CET	57262	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:19.533194065 CET	57262	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:19.538518906 CET	5651	57262	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:19.538553953 CET	5651	57262	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:20.252782106 CET	5651	57261	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:20.252903938 CET	57261	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:20.252983093 CET	57261	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:20.258527040 CET	5651	57261	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:20.286967039 CET	57263	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:20.292438030 CET	5651	57263	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:20.292515993 CET	57263	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:20.293920040 CET	57263	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:20.293960094 CET	57263	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:20.299674988 CET	5651	57263	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:20.299684048 CET	5651	57263	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:20.377671957 CET	5651	57262	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:20.377742052 CET	57262	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:20.377803087 CET	57262	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:20.383455038 CET	5651	57262	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:20.397573948 CET	57264	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:20.408268929 CET	5651	57264	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:20.408554077 CET	57264	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:20.410439968 CET	57264	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:20.410439968 CET	57264	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:20.415719986 CET	5651	57264	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:20.415828943 CET	5651	57264	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:21.223319054 CET	5651	57263	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:21.223388910 CET	57263	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:21.223551989 CET	57263	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:21.229212046 CET	5651	57263	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:21.268279076 CET	57265	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:21.273821115 CET	5651	57265	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:21.273899078 CET	57265	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:21.274851084 CET	57265	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:21.274851084 CET	57265	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:21.279639959 CET	5651	57265	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:21.279716969 CET	57265	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:21.279835939 CET	57265	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:21.280210018 CET	5651	57265	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:21.280227900 CET	5651	57265	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:21.285187006 CET	5651	57265	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:21.285594940 CET	5651	57265	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:21.335371017 CET	5651	57264	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:21.335448027 CET	57264	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:21.335541010 CET	57264	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:21.340941906 CET	5651	57264	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:21.378933907 CET	57266	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:21.384468079 CET	5651	57266	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:21.384557009 CET	57266	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:21.385143995 CET	57266	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:21.385159969 CET	57266	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:21.390499115 CET	5651	57266	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:21.390512943 CET	5651	57266	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:22.228689909 CET	5651	57266	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:22.228760004 CET	57266	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:22.228821039 CET	57266	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:22.234118938 CET	5651	57266	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:22.255585909 CET	57267	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:22.261017084 CET	5651	57267	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:22.261178970 CET	57267	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:22.262180090 CET	57267	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:22.262209892 CET	57267	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:22.267504930 CET	5651	57267	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:22.267570019 CET	5651	57267	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.108068943 CET	5651	57267	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.108222008 CET	57267	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.108280897 CET	57267	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.113691092 CET	5651	57267	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.127600908 CET	57268	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.134390116 CET	8080	57245	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.134471893 CET	57245	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.134573936 CET	57245	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.135411978 CET	5651	57268	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.135489941 CET	57268	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.135773897 CET	8080	57244	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.135834932 CET	57244	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.136212111 CET	57244	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.137157917 CET	57268	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.137181997 CET	57268	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.141568899 CET	8080	57245	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.141771078 CET	8080	57244	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.141830921 CET	80	57246	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.142034054 CET	57246	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.142086983 CET	57246	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.142592907 CET	5651	57268	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.142673016 CET	5651	57268	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.144638062 CET	5651	57249	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.144701958 CET	57249	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.144738913 CET	57249	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.147512913 CET	80	57246	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.149931908 CET	5651	57268	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.150221109 CET	5651	57249	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.168325901 CET	5651	57247	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.168395996 CET	57247	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.168453932 CET	57247	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.173885107 CET	5651	57247	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.282223940 CET	57269	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.283262014 CET	57270	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.283338070 CET	57271	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.284611940 CET	57272	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.285948992 CET	57273	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.287595987 CET	57274	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.287616014 CET	5651	57269	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.288614988 CET	80	57270	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.288623095 CET	57269	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.288681030 CET	57270	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.288923025 CET	8080	57271	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.289002895 CET	57271	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.289731026 CET	57270	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.289757013 CET	57270	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.289810896 CET	57271	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.289825916 CET	57271	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.289972067 CET	57269	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.289998055 CET	57269	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.290066957 CET	5651	57272	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.290136099 CET	57272	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.290540934 CET	57272	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.290540934 CET	57272	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.292033911 CET	5651	57273	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.292104959 CET	57273	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.292809963 CET	57273	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.292834997 CET	57273	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.293376923 CET	8080	57274	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.293482065 CET	57274	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.293828964 CET	57274	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.293828964 CET	57274	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.294753075 CET	5651	57269	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.294796944 CET	80	57270	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.294799089 CET	57269	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.294848919 CET	57269	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.294867039 CET	57270	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.294945002 CET	8080	57271	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.295011044 CET	57271	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.295062065 CET	57270	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.295196056 CET	80	57270	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.295207977 CET	80	57270	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.295219898 CET	8080	57271	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.295226097 CET	8080	57271	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.295447111 CET	5651	57269	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.295459032 CET	5651	57269	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.295569897 CET	5651	57272	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.295618057 CET	57272	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.295912027 CET	5651	57272	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.295924902 CET	5651	57272	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.295979023 CET	57271	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.296056032 CET	57272	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.297667980 CET	5651	57273	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.297743082 CET	57273	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.298129082 CET	5651	57273	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.298141956 CET	5651	57273	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.298772097 CET	57273	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.298897028 CET	8080	57274	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.298960924 CET	57274	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.299153090 CET	8080	57274	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.299195051 CET	8080	57274	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.300326109 CET	5651	57269	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.300338984 CET	5651	57269	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.300349951 CET	80	57270	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.300360918 CET	8080	57271	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.300375938 CET	80	57270	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.300885916 CET	5651	57272	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.301208973 CET	8080	57271	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.301320076 CET	5651	57272	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.303085089 CET	5651	57273	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.304049969 CET	5651	57273	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.304296970 CET	8080	57274	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.377868891 CET	57275	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.378593922 CET	57276	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.380958080 CET	57278	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.381779909 CET	57279	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.383109093 CET	57280	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.383141041 CET	8080	57275	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.383198023 CET	57275	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.383342981 CET	57277	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.383707047 CET	57275	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.383735895 CET	57275	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.383924007 CET	8080	57276	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.383975029 CET	57276	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.385687113 CET	57276	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.385729074 CET	57276	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.386478901 CET	5651	57278	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.386527061 CET	57278	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.387178898 CET	5651	57279	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.387231112 CET	57279	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.387695074 CET	57279	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.387708902 CET	57279	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.388075113 CET	57278	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.388087988 CET	57278	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:23.388391018 CET	80	57280	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.388430119 CET	57280	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.388653994 CET	5651	57277	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.388709068 CET	57277	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.389022112 CET	8080	57275	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.389075994 CET	8080	57275	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.390639067 CET	57280	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.390686989 CET	57280	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.390747070 CET	57277	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.390773058 CET	57277	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.391195059 CET	8080	57276	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.391206026 CET	8080	57276	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.393142939 CET	5651	57279	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.393152952 CET	5651	57279	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.393275976 CET	5651	57279	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.393378019 CET	5651	57278	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.393611908 CET	5651	57278	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:23.394160032 CET	80	57280	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.394321918 CET	57280	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.394357920 CET	5651	57277	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.394464016 CET	57277	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.395982981 CET	80	57280	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.396039963 CET	80	57280	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.396069050 CET	5651	57277	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.396079063 CET	5651	57277	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.397192955 CET	57280	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.397690058 CET	57277	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.399666071 CET	80	57280	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.399781942 CET	5651	57277	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.402628899 CET	80	57280	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.403021097 CET	5651	57277	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.475716114 CET	57281	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.479931116 CET	57282	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.480669975 CET	57283	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.481143951 CET	5651	57281	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.481367111 CET	57281	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.482032061 CET	57281	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.482044935 CET	57281	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.485285044 CET	5651	57282	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.485382080 CET	57282	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.485974073 CET	80	57283	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.486105919 CET	57283	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.486589909 CET	57282	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.486634970 CET	57282	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:23.486838102 CET	57283	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.486897945 CET	57283	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:23.487524033 CET	5651	57281	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.487565041 CET	5651	57281	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.491913080 CET	5651	57282	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.491983891 CET	5651	57282	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:23.492122889 CET	80	57283	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:23.492172956 CET	80	57283	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:24.347685099 CET	5651	57282	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:24.348090887 CET	57282	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:24.348090887 CET	57282	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:24.353560925 CET	5651	57282	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:24.438328981 CET	57284	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:24.443758011 CET	5651	57284	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:24.443872929 CET	57284	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:24.444331884 CET	57284	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:24.444370031 CET	57284	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:24.449959993 CET	5651	57284	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:24.449990034 CET	5651	57284	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:25.273597956 CET	5651	57284	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:25.273689985 CET	57284	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:25.273960114 CET	57284	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:25.279467106 CET	5651	57284	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:25.324109077 CET	57285	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:25.329734087 CET	5651	57285	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:25.329830885 CET	57285	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:25.330030918 CET	57285	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:25.330030918 CET	57285	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:25.335541964 CET	5651	57285	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:25.336206913 CET	5651	57285	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:26.158657074 CET	5651	57285	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:26.158814907 CET	57285	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:26.158814907 CET	57285	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:26.164203882 CET	5651	57285	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:26.184783936 CET	57286	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:26.190418959 CET	5651	57286	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:26.190962076 CET	57286	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:26.190962076 CET	57286	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:26.190962076 CET	57286	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:26.196353912 CET	5651	57286	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:26.197663069 CET	5651	57286	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:27.074795961 CET	5651	57286	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:27.074911118 CET	57286	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:27.074949980 CET	57286	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:27.080451012 CET	5651	57286	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:27.168659925 CET	57287	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:27.174206018 CET	5651	57287	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:27.174299955 CET	57287	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:27.174488068 CET	57287	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:27.174488068 CET	57287	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:27.179816961 CET	5651	57287	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:27.181135893 CET	5651	57287	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:28.083988905 CET	5651	57287	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:28.084053040 CET	57287	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:28.084125996 CET	57287	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:28.089458942 CET	5651	57287	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:28.156300068 CET	57288	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:28.162163973 CET	5651	57288	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:28.162234068 CET	57288	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:28.162436008 CET	57288	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:28.162453890 CET	57288	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:28.168329954 CET	5651	57288	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:28.168395996 CET	5651	57288	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:29.082232952 CET	5651	57288	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:29.082293987 CET	57288	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:29.082346916 CET	57288	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:29.087635040 CET	5651	57288	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:29.140135050 CET	57289	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:29.145498037 CET	5651	57289	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:29.145598888 CET	57289	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:29.145809889 CET	57289	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:29.145843983 CET	57289	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:29.151134014 CET	5651	57289	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:29.151532888 CET	5651	57289	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:29.990401030 CET	5651	57289	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:29.990466118 CET	57289	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:29.990530968 CET	57289	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:29.995980978 CET	5651	57289	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:30.026473045 CET	57290	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:30.032113075 CET	5651	57290	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:30.032221079 CET	57290	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:30.032520056 CET	57290	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:30.032520056 CET	57290	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:30.037883043 CET	5651	57290	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:30.037910938 CET	5651	57290	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:30.858988047 CET	5651	57290	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:30.859056950 CET	57290	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:30.859118938 CET	57290	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:30.864460945 CET	5651	57290	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:30.889633894 CET	57291	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:30.895061970 CET	5651	57291	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:30.895140886 CET	57291	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:30.895378113 CET	57291	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:30.895391941 CET	57291	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:30.900729895 CET	5651	57291	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:30.901113033 CET	5651	57291	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:31.740633011 CET	5651	57291	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:31.740746021 CET	57291	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:31.740788937 CET	57291	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:31.746134043 CET	5651	57291	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:31.775604010 CET	57292	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:31.780870914 CET	5651	57292	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:31.780932903 CET	57292	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:31.781167984 CET	57292	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:31.781179905 CET	57292	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:31.786576986 CET	5651	57292	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:31.786587954 CET	5651	57292	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:31.873106003 CET	5651	57278	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:31.873246908 CET	57278	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:31.873270035 CET	57278	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:31.876780033 CET	8080	57276	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:31.876832962 CET	57276	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:31.876874924 CET	57276	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:31.878659964 CET	5651	57278	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:31.882386923 CET	8080	57276	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:31.889187098 CET	8080	57275	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:31.889280081 CET	57275	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.889395952 CET	57275	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.894778967 CET	8080	57275	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:31.964246035 CET	5651	57281	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:31.964334965 CET	57281	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.964477062 CET	57281	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.964586020 CET	80	57283	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:31.964648008 CET	57283	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.964684010 CET	57283	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.969733953 CET	5651	57281	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:31.969959974 CET	80	57283	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:31.983886003 CET	57293	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.984287024 CET	57294	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.985676050 CET	57295	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:31.986105919 CET	57296	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.993169069 CET	8080	57293	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:31.993231058 CET	57293	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.993341923 CET	5651	57294	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:31.993486881 CET	57294	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.993659973 CET	5651	57295	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:31.993730068 CET	57295	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:31.993730068 CET	80	57296	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:31.993805885 CET	57296	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.994344950 CET	57293	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.994469881 CET	57294	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.994471073 CET	57293	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.994524956 CET	57294	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.994543076 CET	57295	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:31.994604111 CET	57295	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:31.994604111 CET	57296	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.994617939 CET	57296	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:31.997056961 CET	57297	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:31.999581099 CET	8080	57293	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:31.999919891 CET	8080	57293	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:31.999931097 CET	5651	57294	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:31.999946117 CET	5651	57294	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:31.999965906 CET	5651	57295	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:31.999985933 CET	5651	57295	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.000031948 CET	80	57296	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:32.000061035 CET	80	57296	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:32.003073931 CET	8080	57297	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.003132105 CET	57297	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:32.003346920 CET	57297	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:32.003495932 CET	57297	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:32.006938934 CET	8080	57293	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:32.007143974 CET	5651	57294	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:32.007239103 CET	5651	57295	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.007534027 CET	80	57296	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:32.008631945 CET	8080	57297	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.008671045 CET	8080	57297	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.008723021 CET	57297	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:32.008748055 CET	8080	57297	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.011029959 CET	57297	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:32.014036894 CET	8080	57297	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.016324997 CET	8080	57297	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.107253075 CET	57298	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:32.107331038 CET	57299	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:32.107594013 CET	57300	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:32.107882023 CET	57301	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:32.107978106 CET	57302	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:32.112622023 CET	5651	57298	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:32.112709045 CET	57298	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:32.112858057 CET	80	57299	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:32.112915993 CET	8080	57300	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:32.112926960 CET	57298	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:32.112926960 CET	57298	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:32.113007069 CET	57299	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:32.113010883 CET	57300	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:32.113146067 CET	57299	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:32.113163948 CET	57299	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:32.113177061 CET	5651	57301	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.113203049 CET	57300	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:32.113214016 CET	57300	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:32.113239050 CET	57301	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:32.113310099 CET	8080	57302	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.113384008 CET	57301	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:32.113395929 CET	57301	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:32.113451958 CET	57302	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:32.113564014 CET	57302	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:32.113564014 CET	57302	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:32.118242025 CET	5651	57298	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:32.118319035 CET	5651	57298	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:32.118541002 CET	80	57299	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:32.118606091 CET	80	57299	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:32.118619919 CET	8080	57300	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:32.118632078 CET	8080	57300	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:32.118710041 CET	5651	57301	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.118771076 CET	5651	57301	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.118942976 CET	8080	57302	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.118980885 CET	8080	57302	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.119134903 CET	8080	57302	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.203347921 CET	57303	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:32.208822966 CET	8080	57303	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.208901882 CET	57303	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:32.209095001 CET	57303	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:32.209108114 CET	57303	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:32.214550972 CET	8080	57303	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.214925051 CET	8080	57303	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:32.626384020 CET	5651	57292	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:32.626450062 CET	57292	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:32.626528025 CET	57292	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:32.631968021 CET	5651	57292	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:32.636507034 CET	57304	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:32.641936064 CET	5651	57304	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:32.642005920 CET	57304	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:32.642187119 CET	57304	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:32.642199039 CET	57304	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:32.647533894 CET	5651	57304	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:32.647546053 CET	5651	57304	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:33.526698112 CET	5651	57304	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:33.526757956 CET	57304	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:33.526804924 CET	57304	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:33.532959938 CET	5651	57304	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:33.632657051 CET	57305	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:33.638156891 CET	5651	57305	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:33.638232946 CET	57305	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:33.638474941 CET	57305	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:33.638484955 CET	57305	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:33.643821001 CET	5651	57305	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:33.643832922 CET	5651	57305	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:34.468179941 CET	5651	57305	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:34.468334913 CET	57305	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:34.468375921 CET	57305	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:34.473973989 CET	5651	57305	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:34.510518074 CET	57306	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:34.515995026 CET	5651	57306	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:34.516057014 CET	57306	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:34.516287088 CET	57306	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:34.516300917 CET	57306	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:34.522273064 CET	5651	57306	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:34.522578955 CET	5651	57306	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:35.397131920 CET	5651	57306	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:35.397200108 CET	57306	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:35.397255898 CET	57306	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:35.402857065 CET	5651	57306	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:35.481899023 CET	57307	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:35.487375975 CET	5651	57307	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:35.487462044 CET	57307	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:35.487776995 CET	57307	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:35.487787962 CET	57307	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:35.493247986 CET	5651	57307	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:35.494008064 CET	5651	57307	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:36.334182024 CET	5651	57307	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:36.334263086 CET	57307	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:36.334306002 CET	57307	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:36.339715004 CET	5651	57307	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:36.364743948 CET	57308	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:36.370033979 CET	5651	57308	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:36.370140076 CET	57308	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:36.370332956 CET	57308	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:36.370332956 CET	57308	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:36.375675917 CET	5651	57308	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:36.376003981 CET	5651	57308	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:37.213813066 CET	5651	57308	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:37.213905096 CET	57308	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:37.214191914 CET	57308	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:37.219501972 CET	5651	57308	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:37.235435963 CET	57309	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:37.240752935 CET	5651	57309	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:37.240813971 CET	57309	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:37.241106987 CET	57309	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:37.241117954 CET	57309	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:37.246362925 CET	5651	57309	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:37.246629000 CET	5651	57309	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:38.102106094 CET	5651	57309	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:38.102264881 CET	57309	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:38.102638960 CET	57309	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:38.108445883 CET	5651	57309	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:38.229782104 CET	57310	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:38.235165119 CET	5651	57310	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:38.235335112 CET	57310	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:38.235451937 CET	57310	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:38.235476017 CET	57310	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:38.240823984 CET	5651	57310	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:38.241238117 CET	5651	57310	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:39.081962109 CET	5651	57310	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:39.082235098 CET	57310	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:39.082235098 CET	57310	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:39.087764978 CET	5651	57310	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:39.112658978 CET	57311	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:39.117969036 CET	5651	57311	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:39.121769905 CET	57311	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:39.128071070 CET	57311	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:39.128134966 CET	57311	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:39.133431911 CET	5651	57311	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:39.133462906 CET	5651	57311	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:39.959937096 CET	5651	57311	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:39.961469889 CET	57311	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:39.963089943 CET	57311	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:39.968389988 CET	5651	57311	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:40.089412928 CET	57312	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:40.094907999 CET	5651	57312	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:40.094973087 CET	57312	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:40.095211029 CET	57312	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:40.095211029 CET	57312	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:40.101485968 CET	5651	57312	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:40.101808071 CET	5651	57312	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:40.595398903 CET	5651	57301	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:40.595464945 CET	57301	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:40.595524073 CET	57301	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:40.595875025 CET	8080	57300	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:40.595932007 CET	57300	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.595985889 CET	57300	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.596236944 CET	5651	57298	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:40.596286058 CET	57298	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.596434116 CET	57298	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.599159002 CET	80	57299	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:40.599226952 CET	57299	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.599260092 CET	57299	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.601399899 CET	5651	57301	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:40.601630926 CET	8080	57300	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:40.601764917 CET	5651	57298	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:40.605057001 CET	80	57299	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:40.624125957 CET	57313	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.629425049 CET	80	57313	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:40.629512072 CET	57313	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.629681110 CET	57313	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.629695892 CET	57313	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.635632038 CET	80	57313	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:40.635643005 CET	80	57313	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:40.636660099 CET	57314	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:40.638219118 CET	57315	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.638313055 CET	57316	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.641969919 CET	5651	57314	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:40.642038107 CET	57314	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:40.642199993 CET	57314	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:40.642210960 CET	57314	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:40.643714905 CET	5651	57315	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:40.643726110 CET	8080	57316	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:40.643805981 CET	57316	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.643805981 CET	57315	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.643958092 CET	57315	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.643970966 CET	57315	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.644048929 CET	57316	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.644076109 CET	57316	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:40.647614002 CET	5651	57314	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:40.647948027 CET	5651	57314	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:40.650804996 CET	5651	57315	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:40.650815010 CET	5651	57315	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:40.650825977 CET	8080	57316	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:40.650835991 CET	8080	57316	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:40.692293882 CET	8080	57303	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:40.692358971 CET	57303	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:40.692398071 CET	57303	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:40.698327065 CET	8080	57303	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:40.733464003 CET	57318	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:40.738971949 CET	8080	57318	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:40.739032030 CET	57318	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:40.739233017 CET	57318	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:40.739305973 CET	57318	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:40.744580030 CET	8080	57318	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:40.744592905 CET	8080	57318	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:40.940618038 CET	5651	57312	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:40.940733910 CET	57312	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:40.940783978 CET	57312	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:40.946145058 CET	5651	57312	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:40.949706078 CET	57319	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:40.955039024 CET	5651	57319	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:40.955128908 CET	57319	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:40.955298901 CET	57319	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:40.955310106 CET	57319	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:40.960804939 CET	5651	57319	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:40.960841894 CET	5651	57319	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:41.805840015 CET	5651	57319	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:41.805939913 CET	57319	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:41.805978060 CET	57319	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:41.811469078 CET	5651	57319	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:41.826785088 CET	57321	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:41.832144022 CET	5651	57321	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:41.832210064 CET	57321	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:41.832396030 CET	57321	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:41.832406998 CET	57321	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:41.837642908 CET	5651	57321	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:41.837702990 CET	5651	57321	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:42.693799973 CET	5651	57321	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:42.694053888 CET	57321	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:42.694216967 CET	57321	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:42.699477911 CET	5651	57321	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:42.701029062 CET	57322	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:42.706443071 CET	5651	57322	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:42.706520081 CET	57322	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:42.706774950 CET	57322	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:42.706799984 CET	57322	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:42.712109089 CET	5651	57322	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:42.712163925 CET	5651	57322	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:42.809437037 CET	57324	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:42.815490961 CET	5651	57324	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:42.815576077 CET	57324	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:42.815752029 CET	57324	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:42.815766096 CET	57324	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:42.821774960 CET	5651	57324	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:42.821790934 CET	5651	57324	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:43.554927111 CET	5651	57322	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:43.556741953 CET	57322	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:43.556796074 CET	57322	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:43.562129974 CET	5651	57322	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:43.577599049 CET	57325	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:43.582887888 CET	5651	57325	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:43.583775997 CET	57325	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:43.583972931 CET	57325	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:43.583972931 CET	57325	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:43.589312077 CET	5651	57325	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:43.589368105 CET	5651	57325	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:43.696074009 CET	5651	57324	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:43.696134090 CET	57324	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:43.696193933 CET	57324	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:43.701487064 CET	5651	57324	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:43.795145035 CET	57326	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:43.800575972 CET	5651	57326	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:43.801820040 CET	57326	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:43.802036047 CET	57326	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:43.802069902 CET	57326	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:43.807388067 CET	5651	57326	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:43.807398081 CET	5651	57326	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:44.421905994 CET	5651	57325	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:44.421972990 CET	57325	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:44.422041893 CET	57325	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:44.427401066 CET	5651	57325	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:44.450310946 CET	57327	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:44.455629110 CET	5651	57327	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:44.455703974 CET	57327	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:44.455879927 CET	57327	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:44.455908060 CET	57327	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:44.461574078 CET	5651	57327	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:44.461585045 CET	5651	57327	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:44.640661001 CET	5651	57326	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:44.640736103 CET	57326	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:44.640793085 CET	57326	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:44.646163940 CET	5651	57326	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:44.702030897 CET	57328	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:44.707498074 CET	5651	57328	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:44.707958937 CET	57328	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:44.708177090 CET	57328	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:44.711066008 CET	57328	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:44.713771105 CET	5651	57328	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:44.716502905 CET	5651	57328	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:45.323678017 CET	5651	57327	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:45.323744059 CET	57327	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:45.323812962 CET	57327	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:45.329452991 CET	5651	57327	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:45.435049057 CET	57329	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:45.440634012 CET	5651	57329	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:45.440749884 CET	57329	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:45.440988064 CET	57329	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:45.441001892 CET	57329	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:45.446428061 CET	5651	57329	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:45.446470022 CET	5651	57329	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:45.538228035 CET	5651	57328	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:45.540869951 CET	57328	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:45.540869951 CET	57328	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:45.546351910 CET	5651	57328	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:45.657507896 CET	57330	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:45.663068056 CET	5651	57330	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:45.663187981 CET	57330	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:45.663398981 CET	57330	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:45.663398981 CET	57330	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:45.668966055 CET	5651	57330	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:45.668998003 CET	5651	57330	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:46.265053988 CET	5651	57329	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:46.265130997 CET	57329	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:46.265172005 CET	57329	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:46.270461082 CET	5651	57329	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:46.310594082 CET	57331	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:46.315864086 CET	5651	57331	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:46.315947056 CET	57331	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:46.316131115 CET	57331	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:46.316204071 CET	57331	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:46.321445942 CET	5651	57331	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:46.321455956 CET	5651	57331	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:46.501116037 CET	5651	57330	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:46.501228094 CET	57330	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:46.501228094 CET	57330	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:46.506692886 CET	5651	57330	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:46.540673971 CET	57332	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:46.545918941 CET	5651	57332	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:46.545995951 CET	57332	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:46.546199083 CET	57332	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:46.546224117 CET	57332	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:46.551595926 CET	5651	57332	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:46.551606894 CET	5651	57332	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:47.170922041 CET	5651	57331	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:47.170994043 CET	57331	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:47.171052933 CET	57331	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:47.176573038 CET	5651	57331	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:47.189342976 CET	57333	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:47.194695950 CET	5651	57333	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:47.194844007 CET	57333	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:47.195084095 CET	57333	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:47.195166111 CET	57333	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:47.200402975 CET	5651	57333	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:47.200470924 CET	5651	57333	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:47.387495995 CET	5651	57332	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:47.387851000 CET	57332	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:47.387908936 CET	57332	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:47.394730091 CET	5651	57332	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:47.412553072 CET	57334	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:47.417910099 CET	5651	57334	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:47.418065071 CET	57334	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:47.419130087 CET	57334	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:47.419142962 CET	57334	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:47.424447060 CET	5651	57334	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:47.424458027 CET	5651	57334	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:48.050832987 CET	5651	57333	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:48.050976038 CET	57333	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:48.050976038 CET	57333	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:48.056288958 CET	5651	57333	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:48.069360971 CET	57335	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:48.075103045 CET	5651	57335	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:48.075337887 CET	57335	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:48.075520992 CET	57335	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:48.075520992 CET	57335	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:48.080977917 CET	5651	57335	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:48.080991983 CET	5651	57335	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:48.282079935 CET	5651	57334	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:48.282202959 CET	57334	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:48.282242060 CET	57334	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:48.287539959 CET	5651	57334	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:48.391865015 CET	57336	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:48.397289038 CET	5651	57336	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:48.397759914 CET	57336	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:48.397993088 CET	57336	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:48.398008108 CET	57336	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:48.403320074 CET	5651	57336	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:48.403332949 CET	5651	57336	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:49.114187956 CET	80	57313	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:49.115854979 CET	57313	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.115919113 CET	57313	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.121292114 CET	80	57313	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:49.131138086 CET	5651	57315	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:49.131815910 CET	57315	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.131866932 CET	57315	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.131905079 CET	5651	57314	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:49.132371902 CET	8080	57316	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:49.132431030 CET	57314	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:49.132468939 CET	57316	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.132468939 CET	57314	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:49.132849932 CET	57316	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.137135983 CET	5651	57315	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:49.137907028 CET	5651	57314	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:49.138138056 CET	8080	57316	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:49.154293060 CET	5651	57335	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:49.155942917 CET	57335	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:49.155942917 CET	57335	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:49.161231041 CET	5651	57335	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:49.172504902 CET	57337	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.174429893 CET	57338	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.177808046 CET	5651	57337	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:49.179646015 CET	57337	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.179857969 CET	57337	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.180047989 CET	57337	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.180206060 CET	80	57338	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:49.180399895 CET	57338	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.180615902 CET	57338	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.180629015 CET	57338	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.185091972 CET	5651	57337	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:49.185352087 CET	5651	57337	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:49.185904026 CET	80	57338	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:49.186141968 CET	80	57338	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:49.197710037 CET	57339	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:49.203078985 CET	5651	57339	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:49.203151941 CET	57339	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:49.203357935 CET	57339	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:49.203366995 CET	57339	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:49.208648920 CET	5651	57339	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:49.208658934 CET	5651	57339	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:49.212379932 CET	57340	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.217796087 CET	8080	57340	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:49.217860937 CET	57340	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.218030930 CET	57340	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.218044043 CET	57340	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:49.219213009 CET	8080	57318	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:49.219273090 CET	57318	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:49.219302893 CET	57318	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:49.223469973 CET	8080	57340	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:49.223548889 CET	8080	57340	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:49.224654913 CET	8080	57318	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:49.252250910 CET	5651	57336	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:49.252357006 CET	57336	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:49.252408028 CET	57336	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:49.257734060 CET	5651	57336	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:49.264924049 CET	57341	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:49.268132925 CET	57342	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:49.270412922 CET	8080	57341	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:49.270497084 CET	57341	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:49.270807981 CET	57341	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:49.270831108 CET	57341	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:49.273839951 CET	5651	57342	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:49.275727987 CET	57342	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:49.278383017 CET	57342	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:49.278536081 CET	57342	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:49.280531883 CET	8080	57341	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:49.280617952 CET	8080	57341	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:49.283746004 CET	5651	57342	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:49.283791065 CET	5651	57342	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:49.292345047 CET	8080	57341	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:49.292568922 CET	5651	57342	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:49.374066114 CET	57343	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:49.376416922 CET	57344	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:49.379498005 CET	8080	57343	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:49.379578114 CET	57343	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:49.379770994 CET	57343	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:49.379786968 CET	57343	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:49.381772041 CET	5651	57344	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:49.381843090 CET	57344	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:49.381980896 CET	57344	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:49.382004976 CET	57344	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:49.385166883 CET	8080	57343	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:49.385268927 CET	8080	57343	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:49.387496948 CET	5651	57344	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:49.387705088 CET	5651	57344	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:50.263580084 CET	5651	57344	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:50.263725996 CET	57344	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:50.263762951 CET	57344	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:50.269180059 CET	5651	57344	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:50.356782913 CET	57345	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:50.362399101 CET	5651	57345	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:50.362557888 CET	57345	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:50.362746954 CET	57345	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:50.362747908 CET	57345	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:50.368057966 CET	5651	57345	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:50.368104935 CET	5651	57345	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:51.207645893 CET	5651	57345	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:51.207884073 CET	57345	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:51.207884073 CET	57345	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:51.213325977 CET	5651	57345	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:51.233613014 CET	57346	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:51.239140987 CET	5651	57346	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:51.239242077 CET	57346	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:51.239427090 CET	57346	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:51.239439964 CET	57346	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:51.244716883 CET	5651	57346	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:51.244736910 CET	5651	57346	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:52.086730003 CET	5651	57346	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:52.086793900 CET	57346	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:52.086839914 CET	57346	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:52.092236042 CET	5651	57346	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:52.119621992 CET	57347	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:52.124942064 CET	5651	57347	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:52.125020027 CET	57347	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:52.125216007 CET	57347	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:52.125227928 CET	57347	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:52.130990982 CET	5651	57347	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:52.131009102 CET	5651	57347	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:52.980465889 CET	5651	57347	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:52.980667114 CET	57347	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:52.980668068 CET	57347	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:52.986160994 CET	5651	57347	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:53.091523886 CET	57348	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:53.098227024 CET	5651	57348	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:53.098339081 CET	57348	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:53.098557949 CET	57348	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:53.098576069 CET	57348	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:53.105168104 CET	5651	57348	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:53.105180979 CET	5651	57348	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:53.943866014 CET	5651	57348	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:53.945792913 CET	57348	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:53.968951941 CET	57348	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:53.974457026 CET	5651	57348	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:54.059566975 CET	57349	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:54.065049887 CET	5651	57349	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:54.065167904 CET	57349	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:54.065512896 CET	57349	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:54.065512896 CET	57349	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:54.070950985 CET	5651	57349	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:54.071075916 CET	5651	57349	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:54.928098917 CET	5651	57349	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:54.928179979 CET	57349	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:54.928251028 CET	57349	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:54.933588982 CET	5651	57349	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:54.954708099 CET	57350	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:54.960221052 CET	5651	57350	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:54.960437059 CET	57350	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:54.960618019 CET	57350	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:54.964047909 CET	57350	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:54.966206074 CET	5651	57350	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:54.969337940 CET	5651	57350	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:55.860215902 CET	5651	57350	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:55.864456892 CET	57350	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:55.864500999 CET	57350	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:55.870003939 CET	5651	57350	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:55.934462070 CET	57351	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:55.939860106 CET	5651	57351	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:55.941751003 CET	57351	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:55.941987038 CET	57351	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:55.942001104 CET	57351	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:55.947308064 CET	5651	57351	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:55.947325945 CET	5651	57351	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:56.812103987 CET	5651	57351	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:56.812170029 CET	57351	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:56.812218904 CET	57351	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:56.817615032 CET	5651	57351	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:56.932393074 CET	57352	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:56.937835932 CET	5651	57352	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:56.937931061 CET	57352	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:56.938126087 CET	57352	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:56.938162088 CET	57352	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:56.943442106 CET	5651	57352	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:56.943746090 CET	5651	57352	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:57.696743011 CET	5651	57337	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:57.696997881 CET	5651	57339	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:57.697077036 CET	57337	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.697103024 CET	80	57338	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:57.697153091 CET	57337	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.697153091 CET	57339	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:57.697156906 CET	57338	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.700001955 CET	57339	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:57.700082064 CET	8080	57340	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:57.700167894 CET	57340	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.702436924 CET	57338	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.702481985 CET	5651	57337	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:57.705025911 CET	57340	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.705293894 CET	5651	57339	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:57.707873106 CET	80	57338	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:57.710333109 CET	8080	57340	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:57.796361923 CET	57353	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.796979904 CET	57354	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.801702023 CET	5651	57353	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:57.802337885 CET	80	57354	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:57.802437067 CET	57353	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.802619934 CET	57354	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.802619934 CET	57354	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.802661896 CET	57354	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.802679062 CET	57353	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.802679062 CET	57353	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.806482077 CET	57355	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:57.808063984 CET	80	57354	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:57.808075905 CET	80	57354	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:57.808106899 CET	5651	57353	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:57.808116913 CET	5651	57353	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:57.812572002 CET	5651	57355	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:57.816327095 CET	57355	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:57.816665888 CET	57355	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:57.816679955 CET	57355	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:57.821715117 CET	57356	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.821945906 CET	5651	57355	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:57.822026968 CET	5651	57355	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:57.824047089 CET	5651	57352	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:57.827208042 CET	8080	57356	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:57.827265978 CET	57352	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:57.827286959 CET	57356	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.827330112 CET	57352	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:57.827713966 CET	57356	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.827724934 CET	57356	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:52:57.832604885 CET	5651	57352	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:57.833008051 CET	8080	57356	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:57.833019018 CET	8080	57356	111.90.140.51	192.168.2.7
Oct 29, 2024 16:52:57.896697998 CET	8080	57343	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:57.899960041 CET	57343	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:57.903907061 CET	57343	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:57.905319929 CET	57357	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:57.909183979 CET	8080	57343	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:57.910624981 CET	5651	57357	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:57.910711050 CET	57357	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:57.910900116 CET	57357	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:57.910911083 CET	57357	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:57.916189909 CET	5651	57357	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:57.916296959 CET	5651	57357	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:58.015396118 CET	57358	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:58.020976067 CET	8080	57358	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:58.021038055 CET	57358	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:58.021249056 CET	57358	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:58.021275043 CET	57358	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:52:58.026745081 CET	8080	57358	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:58.026763916 CET	8080	57358	65.21.245.7	192.168.2.7
Oct 29, 2024 16:52:58.768970966 CET	5651	57357	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:58.769028902 CET	57357	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:58.769081116 CET	57357	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:58.774390936 CET	5651	57357	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:58.778906107 CET	57359	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:58.784249067 CET	5651	57359	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:58.784388065 CET	57359	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:58.784925938 CET	57359	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:58.784949064 CET	57359	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:58.790350914 CET	5651	57359	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:58.790369987 CET	5651	57359	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:59.624006033 CET	5651	57359	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:59.624075890 CET	57359	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:59.624124050 CET	57359	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:59.629470110 CET	5651	57359	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:59.652791977 CET	57360	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:59.658150911 CET	5651	57360	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:59.658224106 CET	57360	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:59.658402920 CET	57360	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:59.658402920 CET	57360	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:52:59.663783073 CET	5651	57360	111.90.140.34	192.168.2.7
Oct 29, 2024 16:52:59.663799047 CET	5651	57360	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:00.503973961 CET	5651	57360	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:00.504087925 CET	57360	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:00.504147053 CET	57360	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:00.509546995 CET	5651	57360	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:00.542435884 CET	57361	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:00.547976971 CET	5651	57361	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:00.548052073 CET	57361	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:00.548321962 CET	57361	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:00.548347950 CET	57361	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:00.553875923 CET	5651	57361	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:00.554194927 CET	5651	57361	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:01.394778013 CET	5651	57361	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:01.394850969 CET	57361	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:01.394915104 CET	57361	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:01.400451899 CET	5651	57361	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:01.403429985 CET	57362	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:01.408850908 CET	5651	57362	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:01.408925056 CET	57362	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:01.409116983 CET	57362	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:01.409140110 CET	57362	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:01.414452076 CET	5651	57362	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:01.414488077 CET	5651	57362	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:02.325757980 CET	5651	57362	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:02.328090906 CET	57362	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:02.328140974 CET	57362	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:02.333569050 CET	5651	57362	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:02.390183926 CET	57363	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:02.395562887 CET	5651	57363	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:02.396014929 CET	57363	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:02.396490097 CET	57363	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:02.396513939 CET	57363	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:02.401817083 CET	5651	57363	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:02.401828051 CET	5651	57363	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:03.295763016 CET	5651	57363	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:03.295890093 CET	57363	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:03.295989990 CET	57363	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:03.301479101 CET	5651	57363	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:03.377352953 CET	57364	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:03.382879972 CET	5651	57364	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:03.382951021 CET	57364	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:03.383219957 CET	57364	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:03.383352041 CET	57364	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:03.388606071 CET	5651	57364	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:03.388714075 CET	5651	57364	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:04.251506090 CET	5651	57364	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:04.251650095 CET	57364	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:04.251698017 CET	57364	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:04.257138968 CET	5651	57364	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:04.357352018 CET	57365	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:04.362909079 CET	5651	57365	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:04.363039970 CET	57365	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:04.363230944 CET	57365	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:04.363244057 CET	57365	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:04.368762970 CET	5651	57365	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:04.368896008 CET	5651	57365	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.221318007 CET	5651	57365	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.221437931 CET	57365	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.221468925 CET	57365	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.226754904 CET	5651	57365	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.235431910 CET	57366	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.241166115 CET	5651	57366	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.241306067 CET	57366	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.241476059 CET	57366	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.241488934 CET	57366	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.246844053 CET	5651	57366	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.246860027 CET	5651	57366	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.246870995 CET	5651	57366	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.344305992 CET	57367	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.349889994 CET	5651	57367	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.349961042 CET	57367	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.350295067 CET	57367	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.350295067 CET	57367	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.355824947 CET	5651	57367	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.355849028 CET	5651	57367	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.356164932 CET	5651	57367	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.528723955 CET	57368	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.534167051 CET	5651	57368	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.534313917 CET	57368	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.534523964 CET	57368	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.534565926 CET	57368	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.539946079 CET	5651	57368	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.540014982 CET	5651	57368	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.540024996 CET	5651	57368	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.561564922 CET	57369	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.567014933 CET	5651	57369	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.568337917 CET	57369	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.568471909 CET	57369	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.568484068 CET	57369	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.574376106 CET	5651	57369	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.574397087 CET	5651	57369	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.574407101 CET	5651	57369	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.574470043 CET	57369	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.574541092 CET	57369	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.579791069 CET	5651	57369	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.579817057 CET	5651	57369	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.674292088 CET	57370	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.679799080 CET	5651	57370	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.683926105 CET	57370	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.684223890 CET	57370	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.687892914 CET	57370	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:05.689937115 CET	5651	57370	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:05.693489075 CET	5651	57370	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.288027048 CET	5651	57353	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:06.288198948 CET	57353	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.288258076 CET	57353	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.293634892 CET	5651	57353	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:06.327797890 CET	57371	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.332760096 CET	5651	57355	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:06.332868099 CET	57355	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.332926035 CET	57355	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.333475113 CET	5651	57371	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:06.334002972 CET	8080	57356	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:06.334106922 CET	57371	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.334109068 CET	57356	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.334501028 CET	57356	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.334736109 CET	80	57354	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:06.335217953 CET	57371	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.335261106 CET	57354	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.335297108 CET	57354	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.336956978 CET	57371	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.338349104 CET	5651	57355	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:06.340390921 CET	8080	57356	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:06.340486050 CET	5651	57371	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:06.340591908 CET	80	57354	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:06.342283964 CET	5651	57371	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:06.437448978 CET	57372	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.437470913 CET	57373	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.442821026 CET	80	57372	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:06.442866087 CET	5651	57373	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:06.442953110 CET	57372	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.442974091 CET	57373	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.443159103 CET	57372	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.443315983 CET	57372	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.443339109 CET	57373	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.443433046 CET	57373	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.448419094 CET	80	57372	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:06.448618889 CET	80	57372	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:06.448632002 CET	5651	57373	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:06.448892117 CET	5651	57373	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:06.463326931 CET	57374	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.468765974 CET	8080	57374	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:06.469783068 CET	57374	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.470016956 CET	57374	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.473730087 CET	57374	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:06.475516081 CET	8080	57374	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:06.479265928 CET	8080	57374	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:06.510191917 CET	8080	57358	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:06.513798952 CET	57358	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.513840914 CET	57358	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.515264034 CET	5651	57370	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.517770052 CET	57370	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.517821074 CET	57370	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.519347906 CET	8080	57358	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:06.523226023 CET	5651	57370	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.548125982 CET	57375	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.548201084 CET	57376	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.553991079 CET	8080	57375	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:06.554014921 CET	5651	57376	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.554126978 CET	57375	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.554450035 CET	57375	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.554451942 CET	57376	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.554486990 CET	57376	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.554502010 CET	57376	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.554507971 CET	57375	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.559819937 CET	8080	57375	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:06.559895039 CET	8080	57375	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:06.559906960 CET	5651	57376	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.559912920 CET	57375	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.559917927 CET	5651	57376	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.559989929 CET	57375	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.559993982 CET	8080	57375	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:06.560513020 CET	5651	57376	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.565195084 CET	8080	57375	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:06.565289974 CET	8080	57375	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:06.654473066 CET	57377	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.660281897 CET	5651	57377	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.660423040 CET	57377	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.660671949 CET	57377	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.660698891 CET	57377	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.666132927 CET	5651	57377	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.666142941 CET	5651	57377	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.669128895 CET	57378	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.675689936 CET	8080	57378	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:06.675820112 CET	57378	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.676024914 CET	57378	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.676057100 CET	57378	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:06.676188946 CET	5651	57377	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.682442904 CET	8080	57378	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:06.682452917 CET	8080	57378	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:06.778179884 CET	57379	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.783883095 CET	5651	57379	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.783967018 CET	57379	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.784161091 CET	57379	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.784161091 CET	57379	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.789572954 CET	5651	57379	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.789592981 CET	5651	57379	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.807642937 CET	5651	57379	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.901957035 CET	57380	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.907417059 CET	5651	57380	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.907561064 CET	57380	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.907887936 CET	57380	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.907910109 CET	57380	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.913079977 CET	5651	57380	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.913161993 CET	57380	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.913222075 CET	57380	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.913307905 CET	5651	57380	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.913319111 CET	5651	57380	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.918771029 CET	5651	57380	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.918781042 CET	5651	57380	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.982002020 CET	57381	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.987577915 CET	5651	57381	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.987694025 CET	57381	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.987894058 CET	57381	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.987907887 CET	57381	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:06.993221045 CET	5651	57381	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:06.993253946 CET	5651	57381	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:07.855882883 CET	5651	57381	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:07.857846022 CET	57381	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:07.857928991 CET	57381	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:07.864345074 CET	5651	57381	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:07.965799093 CET	57382	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:07.971884966 CET	5651	57382	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:07.973783016 CET	57382	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:07.974050045 CET	57382	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:07.974071026 CET	57382	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:07.979441881 CET	5651	57382	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:07.979542971 CET	5651	57382	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:07.980047941 CET	5651	57382	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:08.101804972 CET	57383	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.107239008 CET	5651	57383	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:08.107351065 CET	57383	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.107584000 CET	57383	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.107605934 CET	57383	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.113106012 CET	5651	57383	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:08.113193035 CET	5651	57383	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:08.113420010 CET	5651	57383	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:08.192101002 CET	57384	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.198244095 CET	5651	57384	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:08.198379040 CET	57384	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.198553085 CET	57384	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.198553085 CET	57384	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.204418898 CET	5651	57384	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:08.204431057 CET	5651	57384	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:08.214905024 CET	5651	57384	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:08.347598076 CET	57385	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.353188038 CET	5651	57385	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:08.353260040 CET	57385	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.353616953 CET	57385	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.353645086 CET	57385	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.359368086 CET	5651	57385	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:08.359380960 CET	5651	57385	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:08.359385014 CET	5651	57385	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:08.359535933 CET	57385	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.359772921 CET	57385	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.364964962 CET	5651	57385	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:08.365041018 CET	5651	57385	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:08.625767946 CET	57386	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.822829962 CET	5651	57386	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:08.823002100 CET	57386	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.823379040 CET	57386	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.823410034 CET	57386	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:08.829137087 CET	5651	57386	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:08.829180002 CET	5651	57386	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:09.678374052 CET	5651	57386	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:09.678457022 CET	57386	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:09.678494930 CET	57386	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:09.683994055 CET	5651	57386	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:09.719168901 CET	57387	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:09.724970102 CET	5651	57387	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:09.725035906 CET	57387	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:09.725224972 CET	57387	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:09.725239992 CET	57387	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:09.730581045 CET	5651	57387	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:09.730592012 CET	5651	57387	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:10.577383041 CET	5651	57387	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:10.577641964 CET	57387	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:10.577706099 CET	57387	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:10.583250999 CET	5651	57387	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:10.593436956 CET	57388	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:10.598954916 CET	5651	57388	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:10.600286007 CET	57388	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:10.600555897 CET	57388	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:10.600573063 CET	57388	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:10.607168913 CET	5651	57388	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:10.607182026 CET	5651	57388	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:11.446970940 CET	5651	57388	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:11.447046995 CET	57388	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:11.447088003 CET	57388	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:11.452594995 CET	5651	57388	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:11.467405081 CET	57389	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:11.472960949 CET	5651	57389	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:11.475910902 CET	57389	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:11.476147890 CET	57389	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:11.476147890 CET	57389	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:11.481520891 CET	5651	57389	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:11.481544971 CET	5651	57389	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:12.326725006 CET	5651	57389	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:12.326853037 CET	57389	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:12.327126026 CET	57389	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:12.332406044 CET	5651	57389	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:12.343869925 CET	57390	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:12.349200010 CET	5651	57390	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:12.349343061 CET	57390	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:12.349670887 CET	57390	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:12.349711895 CET	57390	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:12.354993105 CET	5651	57390	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:12.355134964 CET	5651	57390	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:13.212497950 CET	5651	57390	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:13.212579012 CET	57390	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:13.212639093 CET	57390	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:13.218291044 CET	5651	57390	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:13.327771902 CET	57391	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:13.333379030 CET	5651	57391	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:13.333467960 CET	57391	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:13.333640099 CET	57391	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:13.333730936 CET	57391	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:13.339072943 CET	5651	57391	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:13.339123964 CET	5651	57391	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:14.205257893 CET	5651	57391	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:14.205355883 CET	57391	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:14.205425978 CET	57391	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:14.210804939 CET	5651	57391	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:14.337518930 CET	57392	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:14.343132019 CET	5651	57392	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:14.345797062 CET	57392	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:14.346024036 CET	57392	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:14.346035957 CET	57392	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:14.351434946 CET	5651	57392	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:14.351445913 CET	5651	57392	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:14.819417953 CET	5651	57371	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:14.819490910 CET	57371	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:14.819569111 CET	57371	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:14.824942112 CET	5651	57371	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:14.860126019 CET	57393	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:14.865608931 CET	5651	57393	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:14.865693092 CET	57393	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:14.865892887 CET	57393	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:14.865906000 CET	57393	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:14.871335983 CET	5651	57393	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:14.871356964 CET	5651	57393	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:14.928543091 CET	5651	57373	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:14.928711891 CET	57373	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:14.928766012 CET	57373	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:14.931917906 CET	80	57372	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:14.932002068 CET	57372	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:14.932038069 CET	57372	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:14.934165955 CET	5651	57373	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:14.937524080 CET	80	57372	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:14.964020014 CET	8080	57374	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:14.964292049 CET	57374	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:14.965085983 CET	57374	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:14.970463991 CET	8080	57374	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:14.973048925 CET	57394	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:14.973115921 CET	57395	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:14.978596926 CET	5651	57394	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:14.978611946 CET	80	57395	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:14.978678942 CET	57394	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:14.978683949 CET	57395	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:14.979008913 CET	57395	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:14.979008913 CET	57395	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:14.979032993 CET	57394	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:14.979042053 CET	57394	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:14.984436035 CET	80	57395	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:14.984472036 CET	80	57395	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:14.984486103 CET	5651	57394	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:14.984497070 CET	5651	57394	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:15.085277081 CET	57396	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:15.091336012 CET	8080	57396	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:15.091437101 CET	57396	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:15.091655970 CET	57396	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:15.091667891 CET	57396	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:15.097079039 CET	8080	57396	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:15.097093105 CET	8080	57396	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:15.165338993 CET	8080	57378	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:15.165476084 CET	57378	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:15.165517092 CET	57378	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:15.170815945 CET	8080	57378	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:15.185398102 CET	57397	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:15.190778017 CET	8080	57397	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:15.190882921 CET	57397	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:15.191138029 CET	57397	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:15.191154003 CET	57397	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:15.196479082 CET	8080	57397	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:15.196492910 CET	8080	57397	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:15.204757929 CET	5651	57392	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:15.204870939 CET	57392	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:15.204914093 CET	57392	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:15.210263968 CET	5651	57392	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:15.293812990 CET	57398	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:15.299340963 CET	5651	57398	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:15.299499035 CET	57398	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:15.299740076 CET	57398	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:15.299757004 CET	57398	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:15.305145025 CET	5651	57398	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:15.305324078 CET	5651	57398	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:16.144875050 CET	5651	57398	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:16.144964933 CET	57398	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:16.145051003 CET	57398	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:16.150584936 CET	5651	57398	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:16.183603048 CET	57399	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:16.189173937 CET	5651	57399	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:16.189270973 CET	57399	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:16.189507008 CET	57399	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:16.189542055 CET	57399	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:16.194837093 CET	5651	57399	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:16.194951057 CET	5651	57399	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:17.065362930 CET	5651	57399	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:17.065457106 CET	57399	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:17.065591097 CET	57399	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:17.072603941 CET	5651	57399	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:17.165723085 CET	57400	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:17.436208010 CET	5651	57400	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:17.436336994 CET	57400	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:17.436670065 CET	57400	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:17.436681032 CET	57400	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:17.442908049 CET	5651	57400	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:17.442929029 CET	5651	57400	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:18.276199102 CET	5651	57400	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:18.279810905 CET	57400	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:18.326898098 CET	57400	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:18.332225084 CET	5651	57400	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:18.454658985 CET	57401	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:18.460155964 CET	5651	57401	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:18.461788893 CET	57401	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:18.488737106 CET	57401	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:18.488786936 CET	57401	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:18.494180918 CET	5651	57401	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:18.495726109 CET	5651	57401	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:19.344649076 CET	5651	57401	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:19.344729900 CET	57401	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:19.344809055 CET	57401	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:19.350574970 CET	5651	57401	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:19.451334000 CET	57403	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:19.456686020 CET	5651	57403	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:19.456790924 CET	57403	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:19.457046032 CET	57403	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:19.457063913 CET	57403	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:19.462385893 CET	5651	57403	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:19.462404013 CET	5651	57403	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:20.330082893 CET	5651	57403	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:20.330187082 CET	57403	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:20.330245018 CET	57403	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:20.335738897 CET	5651	57403	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:20.437585115 CET	57405	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:20.443109989 CET	5651	57405	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:20.443195105 CET	57405	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:20.443432093 CET	57405	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:20.443458080 CET	57405	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:20.448705912 CET	5651	57405	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:20.448774099 CET	5651	57405	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:21.270673037 CET	5651	57405	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:21.270766020 CET	57405	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:21.270817995 CET	57405	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:21.276109934 CET	5651	57405	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:21.312588930 CET	57406	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:21.317975044 CET	5651	57406	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:21.318041086 CET	57406	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:21.318295956 CET	57406	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:21.318311930 CET	57406	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:21.323873043 CET	5651	57406	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:21.323894024 CET	5651	57406	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:23.233167887 CET	5651	57406	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:23.233277082 CET	57406	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:23.233490944 CET	57406	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:23.238802910 CET	5651	57406	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:23.287513018 CET	57407	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:23.292952061 CET	5651	57407	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:23.293030024 CET	57407	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:23.294399023 CET	57407	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:23.294451952 CET	57407	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:23.299746990 CET	5651	57407	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:23.299846888 CET	5651	57407	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:23.348793983 CET	5651	57393	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:23.348929882 CET	57393	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.362354040 CET	57393	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.368386984 CET	5651	57393	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:23.419102907 CET	57408	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.424438000 CET	5651	57408	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:23.424542904 CET	57408	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.425573111 CET	57408	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.425594091 CET	57408	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.431819916 CET	5651	57408	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:23.431833029 CET	5651	57408	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:23.468939066 CET	80	57395	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:23.469042063 CET	57395	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.469101906 CET	57395	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.474431992 CET	80	57395	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:23.488389969 CET	5651	57394	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:23.488519907 CET	57394	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:23.489736080 CET	57394	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:23.495044947 CET	5651	57394	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:23.502331972 CET	57409	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.506496906 CET	57410	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:23.507672071 CET	80	57409	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:23.507738113 CET	57409	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.511885881 CET	5651	57410	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:23.511940002 CET	57410	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:23.512618065 CET	57409	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.512629986 CET	57409	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.516088963 CET	57410	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:23.516119003 CET	57410	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:23.517936945 CET	80	57409	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:23.517947912 CET	80	57409	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:23.521483898 CET	5651	57410	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:23.521493912 CET	5651	57410	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:23.597295046 CET	8080	57396	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:23.597352028 CET	57396	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.597803116 CET	57396	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.603230953 CET	8080	57396	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:23.611675024 CET	57411	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.617078066 CET	8080	57411	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:23.618200064 CET	57411	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.618200064 CET	57411	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.621737003 CET	57411	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:23.623727083 CET	8080	57411	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:23.627171993 CET	8080	57411	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:23.697518110 CET	8080	57397	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:23.697732925 CET	57397	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:23.697921991 CET	57397	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:23.703231096 CET	8080	57397	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:23.724456072 CET	57412	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:23.729926109 CET	8080	57412	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:23.730129004 CET	57412	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:23.732053995 CET	57412	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:23.732053995 CET	57412	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:23.737392902 CET	8080	57412	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:23.737443924 CET	8080	57412	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:24.153564930 CET	5651	57407	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:24.153722048 CET	57407	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:24.153873920 CET	57407	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:24.159188986 CET	5651	57407	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:24.268688917 CET	57413	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:24.274218082 CET	5651	57413	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:24.274421930 CET	57413	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:24.279465914 CET	57413	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:24.279649973 CET	57413	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:24.284907103 CET	5651	57413	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:24.284926891 CET	5651	57413	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:25.144902945 CET	5651	57413	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:25.145044088 CET	57413	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:25.145044088 CET	57413	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:25.150425911 CET	5651	57413	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:25.276485920 CET	57414	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:25.283148050 CET	5651	57414	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:25.283233881 CET	57414	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:25.283478975 CET	57414	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:25.283490896 CET	57414	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:25.289932013 CET	5651	57414	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:25.290088892 CET	5651	57414	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:26.114074945 CET	5651	57414	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:26.114548922 CET	57414	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:26.114651918 CET	57414	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:26.120007038 CET	5651	57414	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:26.123214006 CET	57415	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:26.128711939 CET	5651	57415	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:26.129266977 CET	57415	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:26.129698992 CET	57415	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:26.129698992 CET	57415	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:26.135109901 CET	5651	57415	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:26.135133028 CET	5651	57415	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:27.002217054 CET	5651	57415	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:27.004195929 CET	57415	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:27.008375883 CET	57415	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:27.013782978 CET	5651	57415	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:27.110994101 CET	57416	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:27.116482973 CET	5651	57416	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:27.116588116 CET	57416	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:27.117250919 CET	57416	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:27.117250919 CET	57416	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:27.122641087 CET	5651	57416	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:27.122699022 CET	5651	57416	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:27.942909002 CET	5651	57416	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:27.943000078 CET	57416	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:27.943140984 CET	57416	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:27.949892998 CET	5651	57416	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:27.983562946 CET	57417	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:27.989206076 CET	5651	57417	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:27.989639997 CET	57417	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:27.990793943 CET	57417	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:27.990793943 CET	57417	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:27.996239901 CET	5651	57417	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:27.996403933 CET	5651	57417	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:28.826316118 CET	5651	57417	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:28.828912020 CET	57417	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:28.828912020 CET	57417	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:28.834414959 CET	5651	57417	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:28.878187895 CET	57418	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:28.883843899 CET	5651	57418	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:28.883920908 CET	57418	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:28.885627985 CET	57418	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:28.885627985 CET	57418	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:28.891273975 CET	5651	57418	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:28.891527891 CET	5651	57418	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:29.728203058 CET	5651	57418	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:29.728266954 CET	57418	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:30.017622948 CET	57418	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:30.023288012 CET	5651	57418	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:30.086494923 CET	57419	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:30.092045069 CET	5651	57419	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:30.092603922 CET	57419	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:30.095089912 CET	57419	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:30.095089912 CET	57419	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:30.100594044 CET	5651	57419	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:30.100624084 CET	5651	57419	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:30.954871893 CET	5651	57419	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:30.954931974 CET	57419	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:30.955600023 CET	57419	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:30.961635113 CET	5651	57419	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:31.053745031 CET	57420	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:31.059083939 CET	5651	57420	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:31.059364080 CET	57420	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:31.061213970 CET	57420	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:31.061271906 CET	57420	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:31.066564083 CET	5651	57420	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:31.066612005 CET	5651	57420	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:31.971183062 CET	5651	57408	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:31.971339941 CET	5651	57420	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:31.971431017 CET	57408	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:31.973777056 CET	57420	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:31.984384060 CET	80	57409	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:31.985816956 CET	57409	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:31.986068964 CET	57408	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:31.989104033 CET	57420	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:31.991372108 CET	5651	57408	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:31.991497040 CET	57409	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:31.994580984 CET	5651	57420	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:31.995074987 CET	5651	57410	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:31.995156050 CET	57410	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:31.995238066 CET	57410	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:31.996812105 CET	80	57409	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:32.000678062 CET	5651	57410	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:32.037673950 CET	57421	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:32.037743092 CET	57422	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:32.037825108 CET	57423	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:32.038032055 CET	57424	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:32.043132067 CET	5651	57421	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:32.043155909 CET	80	57422	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:32.043165922 CET	5651	57423	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:32.043206930 CET	57421	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:32.043236971 CET	57423	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:32.043236971 CET	57422	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:32.043335915 CET	5651	57424	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:32.044183016 CET	57424	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:32.044815063 CET	57421	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:32.044846058 CET	57421	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:32.044857979 CET	57422	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:32.044883013 CET	57422	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:32.044889927 CET	57424	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:32.044909000 CET	57423	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:32.044919014 CET	57424	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:32.044931889 CET	57423	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:32.050273895 CET	5651	57421	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:32.050283909 CET	5651	57421	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:32.050293922 CET	80	57422	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:32.050312996 CET	80	57422	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:32.050322056 CET	5651	57424	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:32.050332069 CET	5651	57423	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:32.050340891 CET	5651	57424	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:32.050348997 CET	5651	57423	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:32.128566027 CET	8080	57411	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:32.128642082 CET	57411	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:32.129528046 CET	57411	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:32.134807110 CET	8080	57411	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:32.141405106 CET	57425	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:32.146807909 CET	8080	57425	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:32.149199009 CET	57425	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:32.149574995 CET	57425	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:32.149574995 CET	57425	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:32.154849052 CET	8080	57425	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:32.154860020 CET	8080	57425	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:32.226269007 CET	8080	57412	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:32.226548910 CET	57412	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:32.226644039 CET	57412	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:32.231892109 CET	8080	57412	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:32.645344973 CET	57426	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:32.650793076 CET	8080	57426	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:32.650969028 CET	57426	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:32.675784111 CET	57426	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:32.675784111 CET	57426	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:32.681269884 CET	8080	57426	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:32.681288004 CET	8080	57426	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:32.942570925 CET	5651	57424	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:32.942689896 CET	57424	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:32.942770958 CET	57424	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:32.948065996 CET	5651	57424	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:33.025206089 CET	57427	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:33.030507088 CET	5651	57427	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:33.030581951 CET	57427	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:33.031508923 CET	57427	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:33.031517982 CET	57427	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:33.036740065 CET	5651	57427	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:33.036830902 CET	5651	57427	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:33.873753071 CET	5651	57427	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:33.873856068 CET	57427	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:33.873898029 CET	57427	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:33.879323959 CET	5651	57427	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:33.903649092 CET	57428	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:33.909904003 CET	5651	57428	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:33.913821936 CET	57428	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:33.914069891 CET	57428	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:33.914081097 CET	57428	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:33.919477940 CET	5651	57428	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:33.919511080 CET	5651	57428	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:34.001147032 CET	57429	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:34.008061886 CET	5651	57429	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:34.009815931 CET	57429	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:34.010068893 CET	57429	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:34.010082960 CET	57429	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:34.015439987 CET	5651	57429	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:34.015539885 CET	5651	57429	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:34.023730993 CET	5651	57429	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:34.110932112 CET	57430	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:34.116286039 CET	5651	57430	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:34.116363049 CET	57430	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:34.116952896 CET	57430	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:34.116986036 CET	57430	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:34.122246981 CET	5651	57430	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:34.122263908 CET	5651	57430	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:34.757601976 CET	5651	57428	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:34.757850885 CET	57428	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:34.757903099 CET	57428	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:34.763271093 CET	5651	57428	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:34.778318882 CET	57431	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:34.783970118 CET	5651	57431	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:34.784338951 CET	57431	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:34.784852028 CET	57431	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:34.784852028 CET	57431	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:34.790189028 CET	5651	57431	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:34.790199995 CET	5651	57431	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:34.960772991 CET	5651	57430	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:34.960829973 CET	57430	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:34.961045027 CET	57430	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:34.966310024 CET	5651	57430	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:35.106702089 CET	57432	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:35.112201929 CET	5651	57432	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:35.112293005 CET	57432	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:35.113192081 CET	57432	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:35.113221884 CET	57432	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:35.118444920 CET	5651	57432	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:35.118829012 CET	5651	57432	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:35.626554012 CET	5651	57431	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:35.626622915 CET	57431	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:35.626720905 CET	57431	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:35.631999969 CET	5651	57431	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:35.637887001 CET	57433	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:35.643326044 CET	5651	57433	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:35.645806074 CET	57433	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:35.646250963 CET	57433	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:35.646265030 CET	57433	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:35.651578903 CET	5651	57433	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:35.651627064 CET	5651	57433	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:35.983568907 CET	5651	57432	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:35.985872984 CET	57432	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:35.989763975 CET	57432	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:35.995337009 CET	5651	57432	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:36.077491045 CET	57434	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:36.083596945 CET	5651	57434	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:36.085844040 CET	57434	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:36.086116076 CET	57434	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:36.086129904 CET	57434	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:36.091541052 CET	5651	57434	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:36.091556072 CET	5651	57434	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:36.499619007 CET	5651	57433	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:36.499715090 CET	57433	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:36.499744892 CET	57433	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:36.505168915 CET	5651	57433	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:36.512943983 CET	57435	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:36.518266916 CET	5651	57435	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:36.521826029 CET	57435	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:36.522027016 CET	57435	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:36.522041082 CET	57435	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:36.881417036 CET	5651	57435	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:36.881429911 CET	5651	57435	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:36.929291964 CET	5651	57434	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:36.929423094 CET	57434	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:36.929477930 CET	57434	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:36.934886932 CET	5651	57434	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:36.955734968 CET	57436	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:36.961011887 CET	5651	57436	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:36.961085081 CET	57436	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:36.967631102 CET	57436	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:36.967649937 CET	57436	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:36.972954035 CET	5651	57436	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:36.972965956 CET	5651	57436	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:37.728856087 CET	5651	57435	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:37.728945971 CET	57435	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:37.729620934 CET	57435	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:37.734920025 CET	5651	57435	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:37.813689947 CET	5651	57436	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:37.817158937 CET	57436	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:37.817218065 CET	57436	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:37.822781086 CET	5651	57436	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:37.837196112 CET	57437	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:37.842874050 CET	5651	57437	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:37.842957020 CET	57437	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:37.844361067 CET	57437	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:37.844382048 CET	57437	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:37.849987984 CET	5651	57437	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:37.850003004 CET	5651	57437	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:38.679369926 CET	5651	57437	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:38.680432081 CET	57437	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:38.680480003 CET	57437	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:38.685844898 CET	5651	57437	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:38.702564001 CET	57438	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:38.708158016 CET	5651	57438	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:38.709816933 CET	57438	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:38.710176945 CET	57438	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:38.710217953 CET	57438	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:38.715863943 CET	5651	57438	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:38.715893030 CET	5651	57438	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:38.812005997 CET	57439	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:38.817560911 CET	5651	57439	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:38.817648888 CET	57439	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:38.817903042 CET	57439	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:38.817914009 CET	57439	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:38.823348045 CET	5651	57439	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:38.823385000 CET	5651	57439	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:39.602072954 CET	5651	57438	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:39.603836060 CET	57438	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:39.603890896 CET	57438	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:39.609353065 CET	5651	57438	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:39.660352945 CET	5651	57439	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:39.660414934 CET	57439	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:39.660973072 CET	57439	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:39.666435003 CET	5651	57439	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:39.689624071 CET	57440	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:39.695207119 CET	5651	57440	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:39.695278883 CET	57440	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:39.696516991 CET	57440	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:39.696516991 CET	57440	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:39.702136993 CET	5651	57440	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:39.702176094 CET	5651	57440	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:40.526524067 CET	5651	57423	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:40.529870987 CET	57423	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:40.529870987 CET	57423	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:40.535397053 CET	5651	57423	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:40.535907030 CET	5651	57421	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:40.536001921 CET	80	57422	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:40.536020041 CET	57421	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.536082029 CET	57422	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.536151886 CET	57421	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.536345005 CET	57422	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.541734934 CET	5651	57421	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:40.541749001 CET	80	57422	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:40.558311939 CET	5651	57440	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:40.558412075 CET	57440	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:40.558412075 CET	57440	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:40.563935995 CET	5651	57440	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:40.585613966 CET	57442	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:40.591073990 CET	5651	57442	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:40.591190100 CET	57442	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:40.601332903 CET	57442	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:40.601367950 CET	57442	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:40.606822014 CET	5651	57442	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:40.606834888 CET	5651	57442	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:40.611547947 CET	57441	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.612843037 CET	57443	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.612937927 CET	57444	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:40.616986990 CET	5651	57441	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:40.617284060 CET	57441	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.618284941 CET	80	57443	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:40.618309975 CET	5651	57444	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:40.618347883 CET	57443	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.618411064 CET	57444	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:40.620161057 CET	57441	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.620161057 CET	57441	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.620251894 CET	57443	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.620253086 CET	57443	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.620280981 CET	57444	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:40.620280981 CET	57444	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:40.625570059 CET	5651	57441	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:40.625581026 CET	5651	57441	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:40.625591993 CET	80	57443	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:40.625605106 CET	80	57443	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:40.625642061 CET	5651	57444	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:40.625653982 CET	5651	57444	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:40.642554045 CET	8080	57425	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:40.645862103 CET	57425	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.645862103 CET	57425	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.651231050 CET	8080	57425	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:40.676820993 CET	57445	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.682255030 CET	8080	57445	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:40.682317972 CET	57445	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.686230898 CET	57445	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.686263084 CET	57445	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:40.691616058 CET	8080	57445	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:40.691626072 CET	8080	57445	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:41.140844107 CET	8080	57426	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:41.145081043 CET	57426	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:41.167001009 CET	57426	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:41.176022053 CET	8080	57426	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:41.421201944 CET	5651	57442	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:41.421282053 CET	57442	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:41.421401978 CET	57442	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:41.426605940 CET	5651	57442	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:41.449992895 CET	57446	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:41.455296040 CET	8080	57446	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:41.455431938 CET	57446	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:41.455588102 CET	57446	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:41.455588102 CET	57446	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:41.460164070 CET	57447	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:41.460865021 CET	8080	57446	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:41.460875034 CET	8080	57446	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:41.460894108 CET	57448	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:41.465481997 CET	5651	57447	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:41.465586901 CET	57447	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:41.466120005 CET	8080	57448	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:41.466120958 CET	57447	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:41.466136932 CET	57447	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:41.466171980 CET	57448	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:41.467612028 CET	57448	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:41.467632055 CET	57448	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:41.471447945 CET	5651	57447	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:41.471457958 CET	5651	57447	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:41.473040104 CET	8080	57448	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:41.473078012 CET	8080	57448	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:42.333430052 CET	5651	57447	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:42.333895922 CET	57447	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:42.347125053 CET	57447	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:42.352458000 CET	5651	57447	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:42.426729918 CET	57449	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:42.432301044 CET	5651	57449	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:42.432423115 CET	57449	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:42.437242031 CET	57449	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:42.437263012 CET	57449	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:42.442579985 CET	5651	57449	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:42.442612886 CET	5651	57449	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:43.266890049 CET	5651	57449	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:43.267919064 CET	57449	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:43.267980099 CET	57449	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:43.273427963 CET	5651	57449	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:43.294738054 CET	57451	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:43.300196886 CET	5651	57451	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:43.300884962 CET	57451	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:43.301287889 CET	57451	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:43.303809881 CET	57451	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:43.306628942 CET	5651	57451	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:43.309211969 CET	5651	57451	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:44.136512995 CET	5651	57451	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:44.136569023 CET	57451	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:44.136744022 CET	57451	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:44.142069101 CET	5651	57451	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:44.187480927 CET	57453	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:44.192739010 CET	5651	57453	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:44.192802906 CET	57453	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:44.194878101 CET	57453	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:44.194981098 CET	57453	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:44.200211048 CET	5651	57453	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:44.200221062 CET	5651	57453	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:44.231690884 CET	5651	57453	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:44.290916920 CET	57454	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:44.296242952 CET	5651	57454	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:44.297830105 CET	57454	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:44.298012972 CET	57454	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:44.301774025 CET	57454	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:44.303271055 CET	5651	57454	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:44.307106972 CET	5651	57454	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:45.123629093 CET	5651	57454	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:45.123694897 CET	57454	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:45.123816967 CET	57454	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:45.129098892 CET	5651	57454	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:45.153686047 CET	57455	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:45.159161091 CET	5651	57455	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:45.161833048 CET	57455	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:45.162004948 CET	57455	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:45.162060976 CET	57455	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:45.167377949 CET	5651	57455	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:45.167402029 CET	5651	57455	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:46.003643990 CET	5651	57455	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:46.005851030 CET	57455	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:46.005958080 CET	57455	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:46.011410952 CET	5651	57455	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:46.029558897 CET	57456	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:46.035144091 CET	5651	57456	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:46.037858963 CET	57456	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:46.038038969 CET	57456	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:46.039820910 CET	57456	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:46.043437004 CET	5651	57456	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:46.045444012 CET	5651	57456	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:46.888120890 CET	5651	57456	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:46.888165951 CET	57456	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:46.888216019 CET	57456	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:46.893570900 CET	5651	57456	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:46.918977976 CET	57457	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:46.924345016 CET	5651	57457	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:46.924426079 CET	57457	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:46.924642086 CET	57457	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:46.924654961 CET	57457	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:46.930012941 CET	5651	57457	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:46.930042982 CET	5651	57457	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:47.789788961 CET	5651	57457	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:47.789992094 CET	57457	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:47.790296078 CET	57457	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:47.795631886 CET	5651	57457	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:47.890691042 CET	57458	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:47.896292925 CET	5651	57458	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:47.901829958 CET	57458	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:47.902049065 CET	57458	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:47.902050018 CET	57458	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:47.907416105 CET	5651	57458	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:47.907428980 CET	5651	57458	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:48.753750086 CET	5651	57458	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:48.756438971 CET	57458	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:48.764297962 CET	57458	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:48.769608974 CET	5651	57458	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:49.096209049 CET	80	57443	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:49.096674919 CET	57443	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:49.099663019 CET	5651	57444	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:49.099729061 CET	57444	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:49.108114004 CET	5651	57441	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:49.111821890 CET	57441	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:49.173932076 CET	8080	57445	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:49.177830935 CET	57445	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:49.478641987 CET	57443	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:49.481687069 CET	57444	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:49.483478069 CET	57441	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:49.483983040 CET	80	57443	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:49.485107899 CET	57445	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:49.487014055 CET	5651	57444	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:49.488797903 CET	5651	57441	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:49.490695000 CET	8080	57445	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:49.959117889 CET	8080	57446	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:49.959172964 CET	57446	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:49.959328890 CET	57446	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:49.964272976 CET	8080	57448	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:49.964448929 CET	57448	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:49.964854002 CET	8080	57446	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:49.965137005 CET	57448	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:49.970453024 CET	8080	57448	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:49.975079060 CET	57459	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:49.976583004 CET	57460	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:49.976906061 CET	57461	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:49.980376959 CET	80	57459	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:49.980444908 CET	57459	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:49.981889009 CET	8080	57460	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:49.981940031 CET	57460	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:49.982311964 CET	5651	57461	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:49.982387066 CET	57461	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:49.988482952 CET	57459	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:49.988672018 CET	57459	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:49.988780022 CET	57460	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:49.988790989 CET	57460	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:49.988806009 CET	57461	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:49.988847017 CET	57461	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:49.988909006 CET	57462	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:49.993889093 CET	80	57459	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:49.994122028 CET	80	57459	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:49.994254112 CET	8080	57460	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:49.994267941 CET	8080	57460	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:49.994277000 CET	5651	57461	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:49.994314909 CET	5651	57461	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:49.994323969 CET	5651	57462	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:49.994374037 CET	57462	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:49.994739056 CET	57462	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:49.994751930 CET	57462	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:49.995455027 CET	57463	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:49.996097088 CET	57464	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:49.997759104 CET	57465	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:49.998853922 CET	57466	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:50.000355959 CET	5651	57462	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:50.000437021 CET	5651	57462	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:50.000809908 CET	8080	57463	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:50.000866890 CET	57463	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:50.001059055 CET	57463	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:50.001075983 CET	57463	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:50.001660109 CET	80	57464	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:50.003495932 CET	5651	57465	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:50.003566980 CET	57464	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:50.003985882 CET	57464	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:50.004012108 CET	57464	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:50.004036903 CET	57465	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:50.004036903 CET	57465	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:50.004553080 CET	5651	57466	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:50.004607916 CET	57466	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:50.004837990 CET	57466	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:50.004849911 CET	57466	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:50.006422997 CET	8080	57463	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:50.006606102 CET	8080	57463	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:50.009543896 CET	80	57464	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:50.009594917 CET	80	57464	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:50.009660006 CET	5651	57465	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:50.009764910 CET	57465	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:50.010329008 CET	5651	57466	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:50.010499001 CET	5651	57466	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:50.010890961 CET	57467	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:50.012780905 CET	57468	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:50.015067101 CET	5651	57465	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:50.015790939 CET	57469	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:50.016402960 CET	5651	57467	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:50.016499996 CET	57467	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:50.016855955 CET	57467	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:50.016865015 CET	57467	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:50.018076897 CET	5651	57468	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:50.021114111 CET	8080	57469	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:50.021363974 CET	57468	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:50.021363974 CET	57468	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:50.021363974 CET	57469	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:50.021419048 CET	57468	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:50.022325039 CET	5651	57467	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:50.022335052 CET	5651	57467	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:50.023757935 CET	57469	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:50.023757935 CET	57469	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:50.026891947 CET	5651	57468	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:50.027245998 CET	5651	57468	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:50.029120922 CET	8080	57469	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:50.029130936 CET	8080	57469	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:50.865869999 CET	5651	57468	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:50.865957022 CET	57468	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:50.866004944 CET	57468	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:50.870114088 CET	5651	57461	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:50.870196104 CET	57461	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:50.870413065 CET	57461	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:50.871361017 CET	5651	57468	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:50.875786066 CET	5651	57461	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:50.952917099 CET	57470	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:50.958651066 CET	5651	57470	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:50.961901903 CET	57470	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:50.962483883 CET	57470	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:50.965895891 CET	57470	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:50.967919111 CET	5651	57470	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:50.971407890 CET	5651	57470	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:51.807776928 CET	5651	57470	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:51.807859898 CET	57470	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:51.855642080 CET	57470	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:51.861372948 CET	5651	57470	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:52.153831959 CET	57471	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:52.159718037 CET	5651	57471	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:52.159794092 CET	57471	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:52.160835028 CET	57471	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:52.160849094 CET	57471	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:52.161173105 CET	57472	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:52.166430950 CET	5651	57471	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:52.166636944 CET	5651	57471	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:52.166671038 CET	5651	57472	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:52.166739941 CET	57472	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:52.167509079 CET	57472	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:52.167525053 CET	57472	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:52.173079967 CET	5651	57472	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:52.173825979 CET	5651	57472	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:52.988832951 CET	5651	57471	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:52.988910913 CET	57471	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:52.988975048 CET	57471	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:52.994328022 CET	5651	57471	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:53.006920099 CET	5651	57472	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:53.007847071 CET	57472	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:53.007877111 CET	57472	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:53.013618946 CET	5651	57472	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:53.048597097 CET	57473	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:53.055460930 CET	5651	57473	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:53.055538893 CET	57473	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:53.056600094 CET	57473	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:53.056600094 CET	57473	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:53.061985970 CET	5651	57473	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:53.062022924 CET	5651	57473	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:53.935349941 CET	5651	57473	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:53.936497927 CET	57473	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:53.936499119 CET	57473	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:53.941917896 CET	5651	57473	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:54.015702009 CET	57474	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:54.021101952 CET	5651	57474	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:54.021833897 CET	57474	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:54.022027016 CET	57474	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:54.022042990 CET	57474	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:54.027285099 CET	5651	57474	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:54.027825117 CET	5651	57474	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:54.862049103 CET	5651	57474	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:54.862166882 CET	57474	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:54.862221956 CET	57474	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:54.867896080 CET	5651	57474	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:54.889075994 CET	57475	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:54.894589901 CET	5651	57475	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:54.897833109 CET	57475	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:54.898051977 CET	57475	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:54.898051977 CET	57475	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:54.904047966 CET	5651	57475	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:54.904129982 CET	5651	57475	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:55.743680000 CET	5651	57475	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:55.745923996 CET	57475	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:55.745923996 CET	57475	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:55.751332998 CET	5651	57475	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:55.765033960 CET	57476	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:55.770622969 CET	5651	57476	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:55.772927046 CET	57476	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:55.773209095 CET	57476	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:55.773209095 CET	57476	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:55.778700113 CET	5651	57476	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:55.778711081 CET	5651	57476	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:56.616123915 CET	5651	57476	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:56.616178989 CET	57476	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:56.621673107 CET	57476	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:56.627701044 CET	5651	57476	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:56.814204931 CET	57477	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:56.819637060 CET	5651	57477	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:56.819719076 CET	57477	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:56.820564985 CET	57477	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:56.820579052 CET	57477	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:56.825963020 CET	5651	57477	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:56.825978041 CET	5651	57477	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:56.887129068 CET	57478	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:56.893296003 CET	5651	57478	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:56.893368006 CET	57478	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:56.895064116 CET	57478	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:56.895078897 CET	57478	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:56.900470018 CET	5651	57478	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:56.901010036 CET	5651	57478	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:57.693770885 CET	5651	57477	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:57.696325064 CET	57477	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:57.696492910 CET	57477	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:57.702189922 CET	5651	57477	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:57.734693050 CET	57479	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:57.740535021 CET	5651	57479	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:57.740619898 CET	57479	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:57.740796089 CET	57479	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:57.740842104 CET	57479	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:57.745335102 CET	5651	57478	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:57.745398998 CET	57478	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:57.745647907 CET	57478	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:57.746206045 CET	5651	57479	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:57.746803999 CET	5651	57479	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:57.750937939 CET	5651	57478	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:57.841809034 CET	57480	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:57.847389936 CET	5651	57480	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:57.847855091 CET	57480	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:57.848071098 CET	57480	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:57.848083973 CET	57480	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:57.853560925 CET	5651	57480	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:57.853807926 CET	5651	57480	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:58.453735113 CET	8080	57460	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.455868006 CET	57460	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.455918074 CET	57460	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.462856054 CET	8080	57460	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.469362974 CET	80	57459	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.472336054 CET	57459	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.472336054 CET	57459	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.474862099 CET	80	57464	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.476979971 CET	5651	57462	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.477077007 CET	57464	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.477118015 CET	57462	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.477118015 CET	57462	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.477336884 CET	57464	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.480698109 CET	80	57459	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.486346006 CET	5651	57462	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.486366987 CET	80	57464	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.488568068 CET	5651	57466	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.489875078 CET	57466	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.490005016 CET	57466	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.491885900 CET	8080	57463	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.492872000 CET	57463	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.493046045 CET	57463	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.495415926 CET	5651	57465	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.495946884 CET	57465	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.495946884 CET	57465	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.497179031 CET	5651	57466	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.501236916 CET	8080	57463	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.503530979 CET	5651	57465	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.503542900 CET	8080	57469	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.503566980 CET	57481	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.503638983 CET	57469	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.503679991 CET	57469	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.506689072 CET	57482	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.506767988 CET	57483	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.506880999 CET	57484	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.509116888 CET	8080	57481	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.510770082 CET	8080	57469	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.510867119 CET	57481	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.511143923 CET	57481	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.511157036 CET	57481	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.514638901 CET	80	57482	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.514650106 CET	8080	57483	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.514661074 CET	5651	57484	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.514730930 CET	57482	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.514764071 CET	57484	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.514764071 CET	57483	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.515213966 CET	57482	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.515228033 CET	57482	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.515247107 CET	57483	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.515258074 CET	57483	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.515279055 CET	57484	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.516415119 CET	57484	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.517643929 CET	8080	57481	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.517654896 CET	8080	57481	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.520642042 CET	80	57482	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.520651102 CET	80	57482	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.520659924 CET	8080	57483	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.520668983 CET	8080	57483	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.520678997 CET	5651	57484	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.522811890 CET	5651	57484	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.525821924 CET	5651	57467	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.527086973 CET	57485	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.527137041 CET	57467	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.527165890 CET	57467	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.532584906 CET	5651	57485	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.532638073 CET	5651	57467	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.532721043 CET	57485	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.532948017 CET	57485	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.532959938 CET	57485	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.540803909 CET	5651	57485	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.540819883 CET	5651	57485	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.592036009 CET	5651	57479	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:58.592103958 CET	57479	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:58.592187881 CET	57479	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:58.598342896 CET	5651	57479	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:58.616254091 CET	57486	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.618539095 CET	57487	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:58.620531082 CET	57489	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.620631933 CET	57488	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.621236086 CET	57490	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.621803999 CET	5651	57486	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.621898890 CET	57486	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.622098923 CET	57486	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.622397900 CET	57486	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.624615908 CET	5651	57487	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:58.624933004 CET	57487	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:58.625154018 CET	57487	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:58.625334978 CET	57487	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:58.626000881 CET	8080	57489	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.626144886 CET	57489	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.626372099 CET	57489	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.626383066 CET	57489	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:53:58.626513004 CET	5651	57488	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.626569986 CET	57488	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.626760006 CET	57488	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.626771927 CET	57488	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.627434969 CET	8080	57490	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.627489090 CET	57490	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.627692938 CET	5651	57486	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.627713919 CET	57490	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.627746105 CET	5651	57486	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.628514051 CET	57490	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:53:58.630875111 CET	5651	57487	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:58.631083012 CET	5651	57487	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:58.631880999 CET	8080	57489	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.631989002 CET	8080	57489	111.90.140.51	192.168.2.7
Oct 29, 2024 16:53:58.632147074 CET	5651	57488	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.632767916 CET	5651	57488	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.633497000 CET	8080	57490	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.634042978 CET	8080	57490	65.21.245.7	192.168.2.7
Oct 29, 2024 16:53:58.718511105 CET	5651	57480	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:58.718699932 CET	57480	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:58.718730927 CET	57480	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:58.724402905 CET	5651	57480	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:58.830686092 CET	57491	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:58.836052895 CET	5651	57491	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:58.836129904 CET	57491	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:58.836543083 CET	57491	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:58.836565971 CET	57491	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:58.841941118 CET	5651	57491	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:58.842374086 CET	5651	57491	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:59.443295956 CET	5651	57487	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:59.443408966 CET	57487	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:59.443408966 CET	57487	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:59.453645945 CET	5651	57487	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:59.489224911 CET	57492	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:59.494683981 CET	5651	57492	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:59.495871067 CET	57492	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:59.496121883 CET	57492	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:59.496121883 CET	57492	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:59.501678944 CET	5651	57492	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:59.502165079 CET	5651	57492	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:59.708179951 CET	5651	57491	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:59.709872007 CET	57491	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:59.709912062 CET	57491	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:59.716459990 CET	5651	57491	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:59.812764883 CET	57493	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:59.818304062 CET	5651	57493	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:59.818603992 CET	57493	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:59.819243908 CET	57493	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:59.820174932 CET	57493	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:53:59.824681044 CET	5651	57493	111.90.140.34	192.168.2.7
Oct 29, 2024 16:53:59.825787067 CET	5651	57493	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:00.351725101 CET	5651	57492	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:00.351871967 CET	57492	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:00.352128983 CET	57492	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:00.357536077 CET	5651	57492	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:00.470984936 CET	57494	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:00.476864100 CET	5651	57494	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:00.476933002 CET	57494	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:00.479255915 CET	57494	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:00.479279041 CET	57494	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:00.484636068 CET	5651	57494	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:00.485390902 CET	5651	57494	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:00.558166027 CET	5651	57494	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:00.580806017 CET	57495	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:00.586704969 CET	5651	57495	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:00.588123083 CET	57495	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:00.588404894 CET	57495	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:00.588433981 CET	57495	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:00.594090939 CET	5651	57495	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:00.594491959 CET	5651	57495	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:00.697879076 CET	5651	57493	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:00.697966099 CET	57493	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:00.698096991 CET	57493	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:00.703533888 CET	5651	57493	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:00.799084902 CET	57496	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:00.804589033 CET	5651	57496	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:00.804675102 CET	57496	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:00.805241108 CET	57496	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:00.805274963 CET	57496	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:00.811031103 CET	5651	57496	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:00.811044931 CET	5651	57496	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:01.432755947 CET	5651	57495	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:01.433902979 CET	57495	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:01.436976910 CET	57495	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:01.442563057 CET	5651	57495	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:01.457901001 CET	57497	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:01.463275909 CET	5651	57497	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:01.463350058 CET	57497	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:01.466581106 CET	57497	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:01.467559099 CET	57497	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:01.472014904 CET	5651	57497	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:01.473094940 CET	5651	57497	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:01.657715082 CET	5651	57496	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:01.657845974 CET	57496	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:01.658137083 CET	57496	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:01.664091110 CET	5651	57496	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:01.722978115 CET	57498	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:01.728859901 CET	5651	57498	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:01.728924990 CET	57498	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:01.989763975 CET	57498	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:01.989814043 CET	57498	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:01.995462894 CET	5651	57498	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:01.995501995 CET	5651	57498	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:02.331285954 CET	5651	57497	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:02.333024979 CET	57497	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:02.333102942 CET	57497	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:02.338682890 CET	5651	57497	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:02.434922934 CET	57499	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:02.440686941 CET	5651	57499	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:02.442682028 CET	57499	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:02.442899942 CET	57499	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:02.442909002 CET	57499	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:02.448892117 CET	5651	57499	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:02.448909998 CET	5651	57499	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:02.571743965 CET	5651	57498	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:02.571872950 CET	57498	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:02.571872950 CET	57498	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:02.577424049 CET	5651	57498	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:02.664007902 CET	57500	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:02.669433117 CET	5651	57500	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:02.669524908 CET	57500	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:02.671485901 CET	57500	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:02.671500921 CET	57500	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:02.676953077 CET	5651	57500	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:02.677572012 CET	5651	57500	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:03.276504040 CET	5651	57499	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:03.276592970 CET	57499	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.276654005 CET	57499	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.282145977 CET	5651	57499	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:03.311805964 CET	57501	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.317707062 CET	5651	57501	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:03.317876101 CET	57501	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.318221092 CET	57501	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.318238974 CET	57501	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.323766947 CET	5651	57501	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:03.323946953 CET	5651	57501	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:03.517653942 CET	5651	57500	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:03.517797947 CET	57500	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.517864943 CET	57500	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.524137020 CET	5651	57500	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:03.536294937 CET	57502	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.541770935 CET	5651	57502	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:03.541924953 CET	57502	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.543323994 CET	57502	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.543340921 CET	57502	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.547573090 CET	5651	57502	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:03.547626019 CET	57502	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.547712088 CET	57502	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.548738003 CET	5651	57502	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:03.548801899 CET	5651	57502	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:03.553009033 CET	5651	57502	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:03.553118944 CET	5651	57502	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:03.640211105 CET	57503	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.646249056 CET	5651	57503	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:03.649252892 CET	57503	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.652462959 CET	57503	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.652462959 CET	57503	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:03.658037901 CET	5651	57503	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:03.658134937 CET	5651	57503	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:04.163707972 CET	5651	57501	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:04.164752007 CET	57501	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:04.164916039 CET	57501	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:04.170492887 CET	5651	57501	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:04.187391043 CET	57504	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:04.192852020 CET	5651	57504	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:04.193845034 CET	57504	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:04.194263935 CET	57504	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:04.194274902 CET	57504	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:04.199784040 CET	5651	57504	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:04.199841976 CET	5651	57504	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:04.485903025 CET	5651	57503	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:04.489968061 CET	57503	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:04.520369053 CET	57503	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:04.527278900 CET	5651	57503	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:04.791537046 CET	57505	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:04.797023058 CET	5651	57505	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:04.797096014 CET	57505	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:04.820585012 CET	57505	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:04.820625067 CET	57505	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:04.827364922 CET	5651	57505	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:04.827442884 CET	5651	57505	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:05.034543991 CET	5651	57504	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:05.035906076 CET	57504	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:05.035988092 CET	57504	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:05.041460037 CET	5651	57504	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:05.073842049 CET	57506	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:05.079235077 CET	5651	57506	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:05.079319954 CET	57506	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:05.079699039 CET	57506	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:05.079709053 CET	57506	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:05.085500956 CET	5651	57506	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:05.085526943 CET	5651	57506	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:05.644807100 CET	5651	57505	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:05.644886971 CET	57505	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:05.645036936 CET	57505	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:05.650882959 CET	5651	57505	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:05.717489004 CET	57507	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:05.724782944 CET	5651	57507	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:05.725945950 CET	57507	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:05.726325035 CET	57507	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:05.726335049 CET	57507	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:05.733441114 CET	5651	57507	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:05.733469963 CET	5651	57507	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:05.932204008 CET	5651	57506	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:05.933861971 CET	57506	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:05.933912992 CET	57506	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:05.939414978 CET	5651	57506	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:06.053615093 CET	57508	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:06.060504913 CET	5651	57508	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:06.061855078 CET	57508	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:06.062096119 CET	57508	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:06.062109947 CET	57508	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:06.068825006 CET	5651	57508	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:06.068850040 CET	5651	57508	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:06.586481094 CET	5651	57507	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:06.586688042 CET	57507	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:06.587639093 CET	57507	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:06.594187975 CET	5651	57507	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:06.708677053 CET	57509	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:06.714235067 CET	5651	57509	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:06.714310884 CET	57509	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:06.715545893 CET	57509	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:06.715584040 CET	57509	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:06.720964909 CET	5651	57509	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:06.721004963 CET	5651	57509	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:06.946479082 CET	5651	57508	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:06.949842930 CET	57508	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:06.949887037 CET	57508	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:06.955631971 CET	5651	57508	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:06.989969969 CET	8080	57481	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:06.993869066 CET	57481	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:06.993910074 CET	57481	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.004554987 CET	5651	57484	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.004590034 CET	80	57482	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.004620075 CET	8080	57483	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.004626036 CET	57484	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.004674911 CET	57482	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.004673958 CET	57483	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.004841089 CET	57484	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.005364895 CET	8080	57481	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.010162115 CET	5651	57484	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.011043072 CET	5651	57485	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.011105061 CET	57485	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.012676001 CET	57482	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.019649029 CET	80	57482	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.022377968 CET	57483	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.024879932 CET	57485	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.027942896 CET	8080	57483	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.031042099 CET	5651	57485	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.051119089 CET	57510	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.054090023 CET	57511	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:07.056845903 CET	5651	57510	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.057123899 CET	57510	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.059566975 CET	5651	57511	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:07.059664965 CET	57511	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:07.105144978 CET	5651	57486	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.105873108 CET	57486	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.108891964 CET	8080	57489	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.109940052 CET	57489	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.118506908 CET	8080	57490	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.118585110 CET	57490	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.119309902 CET	5651	57488	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.121851921 CET	57488	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.163851023 CET	57510	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.163851023 CET	57510	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.169337988 CET	5651	57510	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.169410944 CET	5651	57510	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.252912998 CET	57511	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:07.258435965 CET	5651	57511	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:07.263684034 CET	57511	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:07.270005941 CET	5651	57511	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:07.317373037 CET	57512	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.323057890 CET	80	57512	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.325860023 CET	57512	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.403820038 CET	57488	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.407188892 CET	57490	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.408406973 CET	57489	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.408478022 CET	57486	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.409395933 CET	5651	57488	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.412813902 CET	8080	57490	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.413608074 CET	57512	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.413634062 CET	57512	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.413830996 CET	8080	57489	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.414180040 CET	57513	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.414526939 CET	57514	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.414596081 CET	57515	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.414729118 CET	5651	57486	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.419070005 CET	80	57512	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.419092894 CET	80	57512	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.419578075 CET	5651	57513	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.419843912 CET	8080	57514	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.419912100 CET	8080	57515	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.419991016 CET	57513	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.420033932 CET	57514	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.420053005 CET	57515	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.420495033 CET	57515	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.420495033 CET	57515	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.424731016 CET	57513	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.424777031 CET	57513	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.424979925 CET	57514	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.424993038 CET	57514	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.426013947 CET	8080	57515	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.426664114 CET	8080	57515	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.430068970 CET	57516	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.430072069 CET	5651	57513	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.430109978 CET	5651	57513	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.430656910 CET	8080	57514	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.430721998 CET	8080	57514	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.435415983 CET	8080	57516	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.435496092 CET	57516	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.440680981 CET	57516	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.440711021 CET	57517	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.441093922 CET	57516	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.445792913 CET	57518	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.446186066 CET	8080	57516	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.446209908 CET	8080	57517	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.446326017 CET	57517	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.446391106 CET	8080	57516	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.448612928 CET	57517	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.448612928 CET	57517	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.452287912 CET	5651	57518	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.452394962 CET	57518	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.452965021 CET	57518	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.453190088 CET	57518	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:07.454001904 CET	8080	57517	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.454236031 CET	8080	57517	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.458859921 CET	5651	57518	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.458993912 CET	5651	57518	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:07.470477104 CET	57519	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.475975990 CET	5651	57519	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.476061106 CET	57519	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.476416111 CET	57519	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.476416111 CET	57519	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:07.481715918 CET	5651	57519	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.481929064 CET	5651	57519	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:07.580593109 CET	5651	57509	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:07.580698013 CET	57509	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:07.584320068 CET	57509	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:07.590214014 CET	5651	57509	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:07.688834906 CET	57520	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:07.694382906 CET	5651	57520	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:07.694492102 CET	57520	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:07.695202112 CET	57520	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:07.695219994 CET	57520	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:07.700629950 CET	5651	57520	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:07.700674057 CET	5651	57520	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:07.967339039 CET	5651	57511	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:07.968020916 CET	57511	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:07.968020916 CET	57511	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:07.973776102 CET	5651	57511	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:08.019556046 CET	57521	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:08.025578976 CET	5651	57521	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:08.025810957 CET	57521	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:08.026439905 CET	57521	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:08.026439905 CET	57521	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:08.032318115 CET	5651	57521	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:08.032351017 CET	5651	57521	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:08.519345045 CET	5651	57520	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:08.519893885 CET	57520	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:08.520059109 CET	57520	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:08.526671886 CET	5651	57520	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:08.573122025 CET	57522	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:08.578636885 CET	5651	57522	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:08.580338955 CET	57522	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:08.581393957 CET	57522	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:08.581403971 CET	57522	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:08.589298964 CET	5651	57522	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:08.589313984 CET	5651	57522	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:08.874619961 CET	5651	57521	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:08.874778032 CET	57521	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:08.874825001 CET	57521	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:08.880662918 CET	5651	57521	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:08.895716906 CET	57523	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:08.901928902 CET	5651	57523	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:08.902040005 CET	57523	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:08.902434111 CET	57523	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:08.902434111 CET	57523	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:08.909269094 CET	5651	57523	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:08.909446001 CET	5651	57523	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:09.503067017 CET	5651	57522	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:09.503134966 CET	57522	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:09.513148069 CET	57522	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:09.518734932 CET	5651	57522	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:09.566543102 CET	57524	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:09.572165966 CET	5651	57524	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:09.572532892 CET	57524	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:09.591916084 CET	57524	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:09.592044115 CET	57524	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:09.598248959 CET	5651	57524	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:09.598546982 CET	5651	57524	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:09.850375891 CET	5651	57523	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:09.850662947 CET	57523	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:09.997420073 CET	57523	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:10.003694057 CET	5651	57523	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:10.114119053 CET	57525	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:10.119910002 CET	5651	57525	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:10.120012999 CET	57525	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:10.122631073 CET	57525	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:10.122631073 CET	57525	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:10.128021955 CET	5651	57525	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:10.128405094 CET	5651	57525	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:10.739960909 CET	5651	57524	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:10.740036011 CET	57524	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:10.740268946 CET	57524	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:10.740984917 CET	5651	57524	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:10.741038084 CET	57524	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:10.745747089 CET	5651	57524	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:10.861567974 CET	57526	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:10.867182016 CET	5651	57526	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:10.867263079 CET	57526	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:10.868208885 CET	57526	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:10.868236065 CET	57526	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:10.873811960 CET	5651	57526	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:10.874129057 CET	5651	57526	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:10.974402905 CET	5651	57525	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:10.977982998 CET	57525	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:10.977982998 CET	57525	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:10.983396053 CET	5651	57525	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:11.092030048 CET	57527	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:11.097768068 CET	5651	57527	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:11.097846031 CET	57527	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:11.098767042 CET	57527	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:11.098781109 CET	57527	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:11.104516983 CET	5651	57527	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:11.104635954 CET	5651	57527	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:11.702306986 CET	5651	57526	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:11.705962896 CET	57526	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:11.708847046 CET	57526	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:11.714231014 CET	5651	57526	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:11.734225988 CET	57528	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:11.739646912 CET	5651	57528	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:11.741885900 CET	57528	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:11.742135048 CET	57528	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:11.742152929 CET	57528	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:11.747909069 CET	5651	57528	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:11.748168945 CET	5651	57528	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:11.968611002 CET	5651	57527	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:11.969883919 CET	57527	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:11.969950914 CET	57527	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:11.975513935 CET	5651	57527	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:12.066658974 CET	57529	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:12.072251081 CET	5651	57529	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:12.072958946 CET	57529	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:12.073215008 CET	57529	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:12.073226929 CET	57529	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:12.078598022 CET	5651	57529	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:12.078613043 CET	5651	57529	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:12.587522030 CET	5651	57528	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:12.587728024 CET	57528	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:12.725992918 CET	57528	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:12.731652975 CET	5651	57528	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:12.831770897 CET	57530	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:12.837204933 CET	5651	57530	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:12.837277889 CET	57530	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:12.841118097 CET	57530	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:12.841142893 CET	57530	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:12.847012997 CET	5651	57530	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:12.847081900 CET	5651	57530	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:12.921348095 CET	5651	57529	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:12.921412945 CET	57529	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:12.921454906 CET	57529	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:12.926949978 CET	5651	57529	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:12.941273928 CET	57531	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:12.947690010 CET	5651	57531	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:12.947768927 CET	57531	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:12.949383974 CET	57531	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:12.949398994 CET	57531	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:12.954848051 CET	5651	57531	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:12.955065012 CET	5651	57531	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:13.729429007 CET	5651	57530	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:13.729516983 CET	57530	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:13.729567051 CET	57530	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:13.735025883 CET	5651	57530	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:13.810625076 CET	57532	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:13.816771030 CET	5651	57531	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:13.816848993 CET	5651	57532	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:13.816884041 CET	57531	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:13.817145109 CET	57531	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:13.817234039 CET	57532	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:13.817583084 CET	57532	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:13.817583084 CET	57532	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:13.822627068 CET	5651	57531	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:13.823101044 CET	5651	57532	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:13.823133945 CET	5651	57532	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:13.923834085 CET	57533	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:13.929474115 CET	5651	57533	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:13.929611921 CET	57533	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:13.930785894 CET	57533	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:13.930785894 CET	57533	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:13.937457085 CET	5651	57533	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:13.937592983 CET	5651	57533	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:14.668701887 CET	5651	57532	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:14.668798923 CET	57532	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:14.668857098 CET	57532	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:14.674252987 CET	5651	57532	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:14.688580990 CET	57534	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:14.694212914 CET	5651	57534	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:14.694305897 CET	57534	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:14.695563078 CET	57534	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:14.695782900 CET	57534	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:14.701004982 CET	5651	57534	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:14.701117992 CET	5651	57534	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:14.789916992 CET	5651	57533	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:14.790661097 CET	57533	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:14.801913977 CET	57533	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:14.807967901 CET	5651	57533	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:14.843272924 CET	57535	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:14.848880053 CET	5651	57535	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:14.848974943 CET	57535	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:14.884541988 CET	57535	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:14.884568930 CET	57535	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:14.890022039 CET	5651	57535	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:14.890062094 CET	5651	57535	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:15.522386074 CET	5651	57534	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:15.524204969 CET	57534	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:15.524249077 CET	57534	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:15.529618979 CET	5651	57534	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:15.566414118 CET	57536	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:15.571852922 CET	5651	57536	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:15.571919918 CET	57536	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:15.573101997 CET	57536	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:15.573115110 CET	57536	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:15.575032949 CET	5651	57510	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:15.575124979 CET	57510	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.575229883 CET	57510	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.578557014 CET	5651	57536	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:15.578583002 CET	5651	57536	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:15.581252098 CET	5651	57510	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:15.674623013 CET	57537	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.680725098 CET	5651	57537	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:15.680789948 CET	57537	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.681061983 CET	57537	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.681072950 CET	57537	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.686336994 CET	5651	57537	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:15.686465979 CET	5651	57537	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:15.695183992 CET	5651	57535	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:15.695230961 CET	57535	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:15.695436001 CET	57535	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:15.701174021 CET	5651	57535	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:15.780487061 CET	57538	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:15.785998106 CET	5651	57538	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:15.789874077 CET	57538	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:15.791114092 CET	57538	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:15.791145086 CET	57538	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:15.794063091 CET	80	57512	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:15.794123888 CET	57512	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.794262886 CET	57512	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.796526909 CET	5651	57538	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:15.796581984 CET	5651	57538	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:15.799554110 CET	80	57512	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:15.889487982 CET	5651	57513	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:15.889609098 CET	57513	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:15.889647961 CET	57513	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:15.893652916 CET	57539	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.895220995 CET	5651	57513	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:15.899168015 CET	80	57539	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:15.899290085 CET	57539	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.899919033 CET	57539	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.899950981 CET	57539	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.904366016 CET	8080	57514	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:15.904470921 CET	57514	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:15.904470921 CET	57514	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:15.905297995 CET	80	57539	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:15.905406952 CET	80	57539	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:15.909828901 CET	8080	57515	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:15.909909964 CET	57515	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.909909964 CET	57515	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.910005093 CET	8080	57514	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:15.915411949 CET	8080	57515	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:15.924698114 CET	8080	57516	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:15.924791098 CET	57516	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.924968958 CET	57516	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.930263042 CET	8080	57516	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:15.937464952 CET	8080	57517	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:15.937596083 CET	57517	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:15.937596083 CET	57517	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:15.938386917 CET	5651	57518	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:15.938443899 CET	57518	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:15.938529015 CET	57518	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:15.943413019 CET	8080	57517	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:15.943944931 CET	5651	57518	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:15.958986044 CET	5651	57519	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:15.959050894 CET	57519	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.959116936 CET	57519	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:15.964580059 CET	5651	57519	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:16.000519037 CET	57540	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:16.002161026 CET	57541	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:16.002851009 CET	57542	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:16.006247044 CET	8080	57540	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:16.007639885 CET	5651	57541	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:16.007765055 CET	57541	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:16.007766008 CET	57540	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:16.008351088 CET	5651	57542	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:16.008426905 CET	57542	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:16.008836031 CET	57540	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:16.008836031 CET	57541	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:16.008836031 CET	57540	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:16.008836031 CET	57541	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:16.009052992 CET	57542	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:16.009814024 CET	57542	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:16.014277935 CET	5651	57541	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:16.014319897 CET	8080	57540	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:16.014333963 CET	8080	57540	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:16.014348030 CET	5651	57541	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:16.014460087 CET	5651	57542	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:16.015264034 CET	5651	57542	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:16.027328014 CET	57543	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:16.032818079 CET	8080	57543	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:16.035913944 CET	57543	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:16.036305904 CET	57543	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:16.036315918 CET	57543	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:16.041845083 CET	8080	57543	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:16.041868925 CET	8080	57543	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:16.490113974 CET	5651	57536	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:16.493916988 CET	57536	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:16.493962049 CET	57536	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:16.499403954 CET	5651	57536	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:16.553067923 CET	57544	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:16.558700085 CET	5651	57544	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:16.558790922 CET	57544	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:16.562983036 CET	57544	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:16.562999010 CET	57544	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:16.568949938 CET	5651	57544	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:16.568977118 CET	5651	57544	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:16.627372026 CET	5651	57538	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:16.627441883 CET	57538	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:16.627482891 CET	57538	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:16.633033037 CET	5651	57538	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:16.657140970 CET	57545	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:16.662883043 CET	5651	57545	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:16.662951946 CET	57545	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:16.663157940 CET	57545	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:16.663192987 CET	57545	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:16.668776035 CET	5651	57545	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:16.668881893 CET	5651	57545	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:17.422580004 CET	5651	57544	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:17.425934076 CET	57544	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:17.429828882 CET	57544	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:17.436243057 CET	5651	57544	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:17.490638971 CET	5651	57545	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:17.493907928 CET	57545	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:17.493937016 CET	57545	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:17.500078917 CET	5651	57545	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:17.535255909 CET	57546	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:17.541048050 CET	5651	57546	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:17.541125059 CET	57546	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:17.541614056 CET	57546	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:17.541631937 CET	57546	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:17.547344923 CET	5651	57546	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:17.547369003 CET	5651	57546	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:18.379110098 CET	5651	57546	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:18.379168987 CET	57546	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:18.379359007 CET	57546	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:18.384620905 CET	5651	57546	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:18.403963089 CET	57547	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:18.409656048 CET	5651	57547	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:18.413876057 CET	57547	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:18.414089918 CET	57547	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:18.414089918 CET	57547	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:18.419651031 CET	5651	57547	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:18.419682980 CET	5651	57547	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:19.242096901 CET	5651	57547	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:19.245882034 CET	57547	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:19.246064901 CET	57547	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:19.251964092 CET	5651	57547	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:19.279280901 CET	57548	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:19.284857035 CET	5651	57548	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:19.286091089 CET	57548	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:19.286091089 CET	57548	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:19.286108971 CET	57548	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:19.295219898 CET	5651	57548	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:19.295260906 CET	5651	57548	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:20.160007000 CET	5651	57548	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:20.160068989 CET	57548	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:20.160129070 CET	57548	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:20.165709972 CET	5651	57548	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:20.282763958 CET	57549	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:20.288500071 CET	5651	57549	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:20.288614988 CET	57549	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:20.291662931 CET	57549	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:20.292406082 CET	57549	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:20.297559977 CET	5651	57549	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:20.297812939 CET	5651	57549	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:21.147459030 CET	5651	57549	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:21.147591114 CET	57549	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:21.147634983 CET	57549	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:21.153053999 CET	5651	57549	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:21.247306108 CET	57550	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:21.252995968 CET	5651	57550	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:21.254144907 CET	57550	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:21.254328012 CET	57550	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:21.254328012 CET	57550	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:21.260348082 CET	5651	57550	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:21.260385990 CET	5651	57550	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:22.119679928 CET	5651	57550	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:22.119950056 CET	57550	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:22.120321989 CET	57550	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:22.125674009 CET	5651	57550	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:22.238571882 CET	57551	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:22.244029999 CET	5651	57551	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:22.244201899 CET	57551	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:22.245979071 CET	57551	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:22.246119976 CET	57551	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:22.251656055 CET	5651	57551	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:22.251719952 CET	5651	57551	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:23.077950001 CET	5651	57551	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:23.078224897 CET	57551	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:23.078372955 CET	57551	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:23.083703041 CET	5651	57551	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:23.109288931 CET	57552	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:23.114813089 CET	5651	57552	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:23.116110086 CET	57552	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:23.116560936 CET	57552	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:23.116605997 CET	57552	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:23.121953011 CET	5651	57552	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:23.121970892 CET	5651	57552	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:23.952982903 CET	5651	57552	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:23.953912973 CET	57552	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:23.954170942 CET	57552	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:23.959465027 CET	5651	57552	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:23.983061075 CET	57553	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:23.988573074 CET	5651	57553	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:23.989633083 CET	57553	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:23.989973068 CET	57553	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:23.991991997 CET	57553	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:23.995594978 CET	5651	57553	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:23.997489929 CET	5651	57553	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:24.156229019 CET	5651	57537	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.156497002 CET	57537	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.156593084 CET	57537	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.162225962 CET	5651	57537	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.214266062 CET	57554	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.220189095 CET	5651	57554	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.220334053 CET	57554	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.221621990 CET	57554	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.222342968 CET	57554	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.227044106 CET	5651	57554	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.227791071 CET	5651	57554	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.404155970 CET	80	57539	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.405869007 CET	57539	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.414437056 CET	57539	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.419801950 CET	80	57539	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.490850925 CET	5651	57542	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.491238117 CET	5651	57541	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:24.491576910 CET	57542	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.491630077 CET	57541	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:24.494558096 CET	8080	57540	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.494893074 CET	57540	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.544341087 CET	8080	57543	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:24.544426918 CET	57543	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:24.565659046 CET	57542	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.571094036 CET	5651	57542	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.597162008 CET	57541	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:24.600349903 CET	57540	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.602696896 CET	5651	57541	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:24.605834007 CET	8080	57540	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.623502016 CET	57543	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:24.628943920 CET	8080	57543	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:24.666083097 CET	57555	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.670037031 CET	57556	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.674046993 CET	80	57555	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.674143076 CET	57557	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.674221992 CET	57558	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:24.674271107 CET	57555	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.674426079 CET	57559	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:24.674499989 CET	57555	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.674510002 CET	57555	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.677469969 CET	5651	57556	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.677881002 CET	57556	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.678054094 CET	57556	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.678054094 CET	57556	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.681828022 CET	8080	57557	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.681862116 CET	5651	57558	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:24.681961060 CET	8080	57559	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:24.682049036 CET	57557	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.682106972 CET	80	57555	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.682137012 CET	80	57555	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.682146072 CET	57559	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:24.682148933 CET	57558	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:24.682574987 CET	57557	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.682585955 CET	57557	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:24.682707071 CET	57558	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:24.682723999 CET	57558	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:24.682740927 CET	57559	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:24.685736895 CET	5651	57556	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.685769081 CET	5651	57556	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.685779095 CET	57559	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:24.690080881 CET	8080	57557	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.690119982 CET	8080	57557	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:24.690175056 CET	5651	57558	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:24.690203905 CET	5651	57558	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:24.690232038 CET	8080	57559	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:24.693295956 CET	8080	57559	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:24.845308065 CET	5651	57553	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:24.845377922 CET	57553	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:24.845442057 CET	57553	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:24.850811958 CET	5651	57553	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:24.863615990 CET	57560	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:24.871382952 CET	5651	57560	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:24.871454954 CET	57560	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:24.871875048 CET	57560	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:24.871926069 CET	57560	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:24.879832029 CET	5651	57560	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:24.879882097 CET	5651	57560	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:25.924195051 CET	5651	57560	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:25.924474001 CET	57560	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:25.924520016 CET	57560	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:25.930262089 CET	5651	57560	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:25.954385042 CET	57561	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:25.959798098 CET	5651	57561	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:25.959954023 CET	57561	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:25.960922003 CET	57561	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:25.960937023 CET	57561	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:25.966329098 CET	5651	57561	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:25.966360092 CET	5651	57561	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:26.832796097 CET	5651	57561	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:26.834007978 CET	57561	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:26.834008932 CET	57561	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:26.839473963 CET	5651	57561	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:26.935657978 CET	57562	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:26.941211939 CET	5651	57562	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:26.941411972 CET	57562	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:26.941652060 CET	57562	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:26.941652060 CET	57562	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:26.947055101 CET	5651	57562	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:26.947110891 CET	5651	57562	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:27.823928118 CET	5651	57562	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:27.823997974 CET	57562	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:27.824054003 CET	57562	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:27.829797029 CET	5651	57562	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:27.922774076 CET	57563	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:27.928152084 CET	5651	57563	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:27.928209066 CET	57563	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:27.928479910 CET	57563	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:27.928494930 CET	57563	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:27.934109926 CET	5651	57563	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:27.934334040 CET	5651	57563	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:28.769929886 CET	5651	57563	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:28.769990921 CET	57563	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:28.770045042 CET	57563	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:28.775876999 CET	5651	57563	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:28.832092047 CET	57564	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:28.837579012 CET	5651	57564	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:28.837672949 CET	57564	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:28.839078903 CET	57564	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:28.839078903 CET	57564	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:28.845078945 CET	5651	57564	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:28.845092058 CET	5651	57564	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:29.689951897 CET	5651	57564	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:29.692015886 CET	57564	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:29.692015886 CET	57564	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:29.697621107 CET	5651	57564	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:29.780086040 CET	57565	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:29.785623074 CET	5651	57565	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:29.787929058 CET	57565	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:29.788168907 CET	57565	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:29.788188934 CET	57565	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:29.794190884 CET	5651	57565	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:29.794203043 CET	5651	57565	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:30.621016979 CET	5651	57565	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:30.621875048 CET	57565	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:30.622060061 CET	57565	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:30.627429962 CET	5651	57565	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:30.660782099 CET	57566	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:30.666199923 CET	5651	57566	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:30.666260958 CET	57566	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:30.666738987 CET	57566	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:30.666966915 CET	57566	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:30.672102928 CET	5651	57566	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:30.673156023 CET	5651	57566	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:31.509162903 CET	5651	57566	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:31.513930082 CET	57566	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:31.513983965 CET	57566	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:31.519270897 CET	5651	57566	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:31.550957918 CET	57567	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:31.556324005 CET	5651	57567	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:31.556385040 CET	57567	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:31.718755960 CET	57567	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:31.718775034 CET	57567	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:31.724231005 CET	5651	57567	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:31.724303961 CET	5651	57567	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:32.386858940 CET	5651	57567	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:32.386938095 CET	57567	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:32.387326002 CET	57567	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:32.393657923 CET	5651	57567	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:32.406503916 CET	57568	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:32.412110090 CET	5651	57568	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:32.412211895 CET	57568	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:32.412904978 CET	57568	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:32.412904978 CET	57568	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:32.418337107 CET	5651	57568	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:32.418946028 CET	5651	57568	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:32.698306084 CET	5651	57554	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:32.701992989 CET	57554	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:32.705842018 CET	57554	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:32.711240053 CET	5651	57554	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:32.737292051 CET	57569	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:32.742974043 CET	5651	57569	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:32.743076086 CET	57569	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:32.744929075 CET	57569	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:32.744929075 CET	57569	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:32.750516891 CET	5651	57569	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:32.750555992 CET	5651	57569	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:33.236145020 CET	5651	57556	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:33.236258984 CET	80	57555	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:33.236385107 CET	57555	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.236407995 CET	57556	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.236433983 CET	57555	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.236444950 CET	57556	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.236588955 CET	5651	57558	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:33.236603975 CET	8080	57557	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:33.236665964 CET	57558	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:33.236784935 CET	8080	57559	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:33.236826897 CET	57557	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.236835957 CET	57559	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:33.237219095 CET	57558	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:33.237580061 CET	57557	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.237993956 CET	57559	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:33.242260933 CET	80	57555	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:33.242487907 CET	5651	57556	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:33.243356943 CET	5651	57558	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:33.243386030 CET	8080	57557	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:33.243398905 CET	8080	57559	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:33.252240896 CET	5651	57568	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:33.253889084 CET	57568	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:33.253907919 CET	57568	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:33.259943962 CET	5651	57568	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:33.282090902 CET	57570	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.284152985 CET	57571	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.285258055 CET	57572	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:33.285330057 CET	57573	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.287719011 CET	80	57570	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:33.289866924 CET	5651	57571	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:33.289933920 CET	57570	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.289951086 CET	57571	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.290338993 CET	57570	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.290369034 CET	57570	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.290797949 CET	5651	57572	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:33.290827036 CET	8080	57573	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:33.290870905 CET	57572	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:33.290896893 CET	57573	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.291840076 CET	57571	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.291851044 CET	57571	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.291966915 CET	57573	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.291985989 CET	57573	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:33.292012930 CET	57572	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:33.292021990 CET	57572	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:33.292221069 CET	57574	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:33.293785095 CET	57575	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:33.296786070 CET	80	57570	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:33.296869993 CET	80	57570	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:33.297885895 CET	5651	57571	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:33.298320055 CET	5651	57571	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:33.298599005 CET	8080	57573	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:33.298612118 CET	8080	57573	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:33.298624039 CET	5651	57572	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:33.298707962 CET	5651	57572	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:33.298723936 CET	5651	57574	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:33.298794031 CET	57574	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:33.299474001 CET	57574	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:33.299474001 CET	57574	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:33.299927950 CET	8080	57575	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:33.299993992 CET	57575	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:33.300195932 CET	57575	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:33.300209045 CET	57575	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:33.305342913 CET	5651	57574	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:33.305375099 CET	5651	57574	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:33.305974960 CET	8080	57575	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:33.306068897 CET	8080	57575	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:34.145118952 CET	5651	57572	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:34.145203114 CET	57572	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:34.145291090 CET	57572	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:34.151743889 CET	5651	57572	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:34.158878088 CET	57576	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:34.164450884 CET	5651	57576	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:34.164525986 CET	57576	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:34.165225029 CET	57576	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:34.165261984 CET	57576	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:34.170917988 CET	5651	57576	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:34.171418905 CET	5651	57576	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:35.020339012 CET	5651	57576	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:35.025945902 CET	57576	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:35.026052952 CET	57576	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:35.031518936 CET	5651	57576	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:35.141922951 CET	57577	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:35.399113894 CET	5651	57577	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:35.399210930 CET	57577	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:35.402666092 CET	57577	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:35.402739048 CET	57577	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:35.408102036 CET	5651	57577	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:35.408392906 CET	5651	57577	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:36.260823011 CET	5651	57577	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:36.265891075 CET	57577	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:36.265948057 CET	57577	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:36.271609068 CET	5651	57577	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:36.342364073 CET	57578	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:36.348110914 CET	5651	57578	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:36.349916935 CET	57578	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:36.350106955 CET	57578	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:36.350136042 CET	57578	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:36.355895042 CET	5651	57578	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:36.355957031 CET	5651	57578	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:37.193021059 CET	5651	57578	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:37.195931911 CET	57578	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:37.196006060 CET	57578	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:37.201775074 CET	5651	57578	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:37.218641996 CET	57579	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:37.224425077 CET	5651	57579	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:37.225907087 CET	57579	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:37.226288080 CET	57579	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:37.226299047 CET	57579	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:37.231601954 CET	5651	57579	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:37.231713057 CET	5651	57579	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:38.114893913 CET	5651	57579	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:38.114969015 CET	57579	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:38.115008116 CET	57579	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:38.120696068 CET	5651	57579	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:38.207925081 CET	57580	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:38.213607073 CET	5651	57580	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:38.215931892 CET	57580	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:38.216206074 CET	57580	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:38.216206074 CET	57580	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:38.221688032 CET	5651	57580	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:38.221745014 CET	5651	57580	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:39.067023039 CET	5651	57580	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:39.067116976 CET	57580	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:39.067214966 CET	57580	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:39.073055029 CET	5651	57580	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:39.088537931 CET	57581	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:39.094317913 CET	5651	57581	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:39.094417095 CET	57581	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:39.094997883 CET	57581	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:39.095021963 CET	57581	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:39.100522995 CET	5651	57581	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:39.100581884 CET	5651	57581	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:39.187645912 CET	57582	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:39.193171024 CET	5651	57582	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:39.193917036 CET	57582	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:39.194226027 CET	57582	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:39.194263935 CET	57582	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:39.200057983 CET	5651	57582	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:39.200402975 CET	5651	57582	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:40.362930059 CET	5651	57581	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:40.363089085 CET	57581	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:40.363401890 CET	57581	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:40.364418983 CET	5651	57582	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:40.364604950 CET	57582	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:40.364646912 CET	57582	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:40.367415905 CET	5651	57581	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:40.367468119 CET	57581	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:40.368691921 CET	5651	57582	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:40.368742943 CET	57582	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:40.373312950 CET	5651	57581	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:40.373332024 CET	5651	57582	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:40.409446001 CET	57583	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:40.414977074 CET	5651	57583	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:40.415198088 CET	57583	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:40.418451071 CET	57583	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:40.418472052 CET	57583	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:40.424038887 CET	5651	57583	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:40.424308062 CET	5651	57583	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:41.243789911 CET	5651	57569	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.243865967 CET	57569	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.243984938 CET	57569	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.251940966 CET	5651	57569	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.252784014 CET	5651	57583	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:41.252849102 CET	57583	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:41.252943039 CET	57583	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:41.258702040 CET	5651	57583	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:41.311491013 CET	57584	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:41.311556101 CET	57585	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.317243099 CET	5651	57584	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:41.317490101 CET	5651	57585	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.317559004 CET	57584	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:41.317559004 CET	57585	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.319644928 CET	57584	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:41.319668055 CET	57584	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:41.319668055 CET	57585	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.319679976 CET	57585	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.325056076 CET	5651	57584	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:41.325071096 CET	5651	57584	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:41.325083971 CET	5651	57585	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.325189114 CET	5651	57585	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.769351959 CET	8080	57573	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.772088051 CET	57573	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.772088051 CET	57573	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.777709961 CET	8080	57573	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.783720970 CET	5651	57574	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:41.783788919 CET	57574	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:41.783847094 CET	57574	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:41.784125090 CET	5651	57571	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.784249067 CET	57571	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.784249067 CET	57571	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.790333033 CET	5651	57574	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:41.790730000 CET	5651	57571	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.792182922 CET	8080	57575	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:41.792244911 CET	57575	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:41.792308092 CET	57575	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:41.798599005 CET	8080	57575	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:41.801719904 CET	80	57570	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.805890083 CET	57570	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.806653023 CET	57570	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.812000990 CET	80	57570	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.815916061 CET	57586	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.817445993 CET	57587	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.817548037 CET	57588	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:41.817739010 CET	57589	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.821723938 CET	8080	57586	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.823043108 CET	80	57587	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.823138952 CET	57586	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.823407888 CET	57587	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.823420048 CET	57586	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.823420048 CET	57586	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.823461056 CET	57587	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.823467016 CET	5651	57588	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:41.823494911 CET	57587	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.823498964 CET	5651	57589	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.823527098 CET	57588	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:41.823566914 CET	57589	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.823842049 CET	57589	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.823842049 CET	57589	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.823870897 CET	57588	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:41.823894024 CET	57588	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:41.828939915 CET	8080	57586	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.828954935 CET	8080	57586	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.828972101 CET	80	57587	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.828985929 CET	80	57587	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.829186916 CET	5651	57589	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.829200029 CET	5651	57589	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.829714060 CET	5651	57588	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:41.834237099 CET	5651	57588	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:41.839099884 CET	57590	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:41.844670057 CET	8080	57590	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:41.844913960 CET	57590	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:41.845129967 CET	57590	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:41.845155954 CET	57590	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:41.850724936 CET	8080	57590	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:41.850776911 CET	8080	57590	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:41.921309948 CET	57591	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.927093029 CET	80	57591	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.927937984 CET	57591	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.928261995 CET	57591	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.928280115 CET	57591	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:41.934099913 CET	80	57591	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:41.934283972 CET	80	57591	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:42.184453011 CET	5651	57584	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:42.185910940 CET	57584	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:42.185955048 CET	57584	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:42.193156004 CET	5651	57584	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:42.260401011 CET	57592	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:42.570009947 CET	5651	57592	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:42.571486950 CET	57592	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:42.894351959 CET	57592	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:42.894351959 CET	57592	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:42.899827957 CET	5651	57592	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:42.899935007 CET	5651	57592	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:43.417526960 CET	5651	57592	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:43.417964935 CET	57592	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:43.418148994 CET	57592	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:43.424009085 CET	5651	57592	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:43.451227903 CET	57593	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:43.457153082 CET	5651	57593	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:43.458924055 CET	57593	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:43.458924055 CET	57593	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:43.461841106 CET	57593	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:43.464806080 CET	5651	57593	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:43.467159033 CET	5651	57593	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:44.299704075 CET	5651	57593	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:44.301925898 CET	57593	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:44.302150965 CET	57593	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:44.307832003 CET	5651	57593	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:44.346391916 CET	57594	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:44.352907896 CET	5651	57594	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:44.352991104 CET	57594	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:44.353257895 CET	57594	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:44.353313923 CET	57594	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:44.358700991 CET	5651	57594	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:44.358764887 CET	5651	57594	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:45.197101116 CET	5651	57594	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:45.197279930 CET	57594	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:45.197427034 CET	57594	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:45.203016043 CET	5651	57594	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:45.313908100 CET	57595	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:45.319658995 CET	5651	57595	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:45.319737911 CET	57595	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:45.319924116 CET	57595	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:45.319937944 CET	57595	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:45.325804949 CET	5651	57595	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:45.326040983 CET	5651	57595	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:46.205249071 CET	5651	57595	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:46.205393076 CET	57595	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:46.205393076 CET	57595	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:46.211075068 CET	5651	57595	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:46.296019077 CET	57596	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:46.301525116 CET	5651	57596	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:46.301678896 CET	57596	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:46.302539110 CET	57596	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:46.302576065 CET	57596	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:46.308052063 CET	5651	57596	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:46.308322906 CET	5651	57596	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:47.130217075 CET	5651	57596	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:47.130317926 CET	57596	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:47.130372047 CET	57596	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:47.135700941 CET	5651	57596	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:47.179646015 CET	57597	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:47.185370922 CET	5651	57597	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:47.185446978 CET	57597	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:47.185628891 CET	57597	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:47.185642958 CET	57597	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:47.191097975 CET	5651	57597	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:47.191724062 CET	5651	57597	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:48.025511980 CET	5651	57597	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:48.025966883 CET	57597	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:48.029870033 CET	57597	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:48.036251068 CET	5651	57597	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:48.052376032 CET	57598	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:48.057869911 CET	5651	57598	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:48.058290005 CET	57598	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:48.060792923 CET	57598	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:48.060792923 CET	57598	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:48.066370964 CET	5651	57598	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:48.066404104 CET	5651	57598	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:48.950241089 CET	5651	57598	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:48.954056025 CET	57598	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:48.954056025 CET	57598	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:48.959950924 CET	5651	57598	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:49.048207045 CET	57599	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:49.054188013 CET	5651	57599	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:49.055675983 CET	57599	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:49.056724072 CET	57599	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:49.057004929 CET	57599	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:49.064116955 CET	5651	57599	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:49.064368010 CET	5651	57599	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:49.803774118 CET	5651	57585	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:49.806024075 CET	57585	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:49.806024075 CET	57585	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:49.811645031 CET	5651	57585	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:49.888483047 CET	5651	57599	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:49.888565063 CET	57599	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:49.888736010 CET	57599	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:49.894278049 CET	5651	57599	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:49.914354086 CET	57600	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:49.916042089 CET	57601	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:49.920090914 CET	5651	57600	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:49.920165062 CET	57600	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:49.920934916 CET	57600	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:49.920967102 CET	57600	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:49.921761990 CET	5651	57601	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:49.921837091 CET	57601	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:49.922679901 CET	57601	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:49.922691107 CET	57601	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:49.926352978 CET	5651	57600	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:49.926543951 CET	5651	57600	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:49.928143024 CET	5651	57601	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:49.928276062 CET	5651	57601	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.014672041 CET	57602	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:50.020317078 CET	5651	57602	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:50.025909901 CET	57602	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:50.026170015 CET	57602	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:50.026180029 CET	57602	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:50.031599998 CET	5651	57602	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:50.031759024 CET	5651	57602	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:50.299956083 CET	5651	57588	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:50.304353952 CET	57588	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:50.304354906 CET	57588	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:50.305819988 CET	5651	57589	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.305882931 CET	57589	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.305922985 CET	57589	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.307238102 CET	8080	57586	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.307348013 CET	57586	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.307394981 CET	57586	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.307522058 CET	80	57587	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.307754040 CET	57587	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.308120012 CET	57587	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.309808969 CET	5651	57588	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:50.311382055 CET	5651	57589	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.312724113 CET	8080	57586	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.313882113 CET	80	57587	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.321557045 CET	8080	57590	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:50.321634054 CET	57590	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:50.321681976 CET	57590	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:50.327162981 CET	8080	57590	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:50.357171059 CET	57603	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.358890057 CET	57604	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.362287998 CET	57605	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.362632036 CET	8080	57603	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.362667084 CET	57606	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:50.362694025 CET	57603	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.363826036 CET	57603	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.363837957 CET	57603	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.364454031 CET	5651	57604	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.364547014 CET	57604	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.365151882 CET	57604	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.365164995 CET	57604	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.367786884 CET	80	57605	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.367846012 CET	57605	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.368216991 CET	5651	57606	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:50.368259907 CET	57606	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:50.369302034 CET	8080	57603	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.369329929 CET	8080	57603	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.370524883 CET	5651	57604	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.370574951 CET	5651	57604	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.373140097 CET	57605	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.373157024 CET	57605	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.373508930 CET	57606	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:50.373528957 CET	57606	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:50.374826908 CET	57607	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:50.379085064 CET	80	57605	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.379129887 CET	80	57605	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.379230976 CET	5651	57606	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:50.379244089 CET	5651	57606	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:50.380171061 CET	8080	57607	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:50.380225897 CET	57607	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:50.382688999 CET	57607	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:50.382724047 CET	57607	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:50.388155937 CET	8080	57607	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:50.388339043 CET	8080	57607	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:50.416601896 CET	80	57591	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.417866945 CET	57591	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.417866945 CET	57591	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.423343897 CET	80	57591	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.449845076 CET	57608	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.455435038 CET	80	57608	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.457923889 CET	57608	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.458187103 CET	57608	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.458201885 CET	57608	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:50.464848995 CET	80	57608	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.466376066 CET	80	57608	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:50.766540051 CET	5651	57600	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:50.766853094 CET	57600	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:50.767071009 CET	57600	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:50.772442102 CET	5651	57600	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:50.783061028 CET	57609	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:50.788769007 CET	5651	57609	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:50.788837910 CET	57609	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:50.789156914 CET	57609	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:50.789176941 CET	57609	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:50.794615984 CET	5651	57609	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:50.794713020 CET	5651	57609	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:50.857144117 CET	5651	57602	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:50.857357979 CET	57602	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:50.857403040 CET	57602	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:50.862938881 CET	5651	57602	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:50.890609026 CET	57610	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:50.896208048 CET	5651	57610	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:50.896280050 CET	57610	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:50.897571087 CET	57610	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:50.897581100 CET	57610	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:50.903040886 CET	5651	57610	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:50.903218031 CET	5651	57610	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:51.695735931 CET	5651	57609	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:51.697915077 CET	57609	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:51.697951078 CET	57609	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:51.703643084 CET	5651	57609	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:51.738435030 CET	5651	57610	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:51.738502026 CET	57610	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:51.738806963 CET	57610	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:51.744395971 CET	5651	57610	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:51.768018007 CET	57611	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:51.773426056 CET	5651	57611	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:51.773494005 CET	57611	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:51.774226904 CET	57611	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:51.774245024 CET	57611	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:51.779671907 CET	5651	57611	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:51.780018091 CET	5651	57611	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:52.635200024 CET	5651	57611	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:52.635343075 CET	57611	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:52.640964031 CET	57611	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:52.646424055 CET	5651	57611	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:52.750129938 CET	57612	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:52.755574942 CET	5651	57612	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:52.755747080 CET	57612	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:52.756181955 CET	57612	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:52.756357908 CET	57612	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:52.761612892 CET	5651	57612	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:52.762167931 CET	5651	57612	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:53.580771923 CET	5651	57612	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:53.580846071 CET	57612	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:53.580912113 CET	57612	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:53.625528097 CET	57613	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:54.008786917 CET	57612	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:54.640388966 CET	5651	57612	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:54.640461922 CET	57612	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:54.642164946 CET	5651	57612	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:54.642209053 CET	57612	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:54.646152020 CET	5651	57612	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:54.646245003 CET	57612	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:54.648175955 CET	5651	57612	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:54.648247004 CET	5651	57613	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:54.648308992 CET	57613	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:54.648384094 CET	5651	57612	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:54.648432016 CET	57612	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:54.649988890 CET	57613	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:54.650182009 CET	57613	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:54.655524969 CET	5651	57613	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:54.655580997 CET	5651	57613	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:55.660752058 CET	5651	57613	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:55.661926985 CET	57613	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:55.661978960 CET	57613	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:55.667421103 CET	5651	57613	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:55.704088926 CET	57614	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:55.709625006 CET	5651	57614	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:55.714258909 CET	57614	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:55.725248098 CET	57614	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:55.725285053 CET	57614	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:55.730750084 CET	5651	57614	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:55.730840921 CET	5651	57614	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:56.561582088 CET	5651	57614	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:56.561670065 CET	57614	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:56.561708927 CET	57614	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:56.567106962 CET	5651	57614	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:56.582540989 CET	57615	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:56.588268995 CET	5651	57615	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:56.589916945 CET	57615	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:56.590102911 CET	57615	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:56.590111971 CET	57615	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:56.595398903 CET	5651	57615	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:56.595443964 CET	5651	57615	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:57.422267914 CET	5651	57615	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:57.422352076 CET	57615	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:57.422713995 CET	57615	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:57.428232908 CET	5651	57615	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:57.856244087 CET	57616	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:57.861969948 CET	5651	57616	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:57.862055063 CET	57616	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:57.890551090 CET	57616	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:57.890597105 CET	57616	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:57.891593933 CET	57617	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:57.896089077 CET	5651	57616	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:57.896174908 CET	5651	57616	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:57.897201061 CET	5651	57617	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:57.897927999 CET	57617	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:57.899566889 CET	57617	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:57.899566889 CET	57617	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:57.905045986 CET	5651	57617	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:57.905231953 CET	5651	57617	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:58.397349119 CET	5651	57601	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:58.397443056 CET	57601	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:58.397542953 CET	57601	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:58.402964115 CET	5651	57601	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:58.437788010 CET	57618	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:58.443299055 CET	5651	57618	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:58.444679976 CET	57618	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:58.445523024 CET	57618	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:58.445543051 CET	57618	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:58.451029062 CET	5651	57618	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:58.451044083 CET	5651	57618	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.086318970 CET	5651	57616	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:59.086472988 CET	5651	57617	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:59.086483002 CET	57616	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:59.086556911 CET	57617	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:59.086633921 CET	57616	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:59.086899996 CET	57617	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:59.087258101 CET	8080	57603	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.087308884 CET	5651	57604	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.087327957 CET	5651	57606	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:59.087332010 CET	57603	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.087340117 CET	80	57605	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.087389946 CET	57604	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.087394953 CET	57606	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:59.087414980 CET	57605	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.087457895 CET	8080	57607	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:59.087776899 CET	57607	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:59.087835073 CET	80	57608	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.087846041 CET	5651	57616	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:59.087899923 CET	57616	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:59.087934017 CET	5651	57617	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:59.087966919 CET	57608	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.088000059 CET	57617	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:59.088772058 CET	8080	57603	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.088865042 CET	5651	57604	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.088875055 CET	80	57605	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.088922024 CET	5651	57606	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:59.088926077 CET	57603	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.088932037 CET	8080	57607	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:59.088942051 CET	57605	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.088948011 CET	57604	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.088970900 CET	57607	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:59.088973045 CET	57606	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:59.090420961 CET	57603	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.091718912 CET	57604	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.092463017 CET	57606	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:59.092837095 CET	57605	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.093059063 CET	5651	57616	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:59.093168020 CET	5651	57617	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:59.094202995 CET	57607	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:59.094335079 CET	57608	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.097938061 CET	8080	57603	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.097948074 CET	5651	57604	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.098159075 CET	5651	57606	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:59.098191977 CET	80	57605	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.099515915 CET	8080	57607	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:59.100156069 CET	80	57608	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.124469995 CET	57619	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:59.129964113 CET	5651	57619	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:59.130157948 CET	57619	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:59.131191969 CET	57619	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:59.131205082 CET	57619	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:59.136676073 CET	5651	57619	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:59.136692047 CET	5651	57619	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:59.225807905 CET	57620	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.226641893 CET	57621	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.227047920 CET	57622	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.227404118 CET	57624	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:59.227467060 CET	57623	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:59.227988958 CET	57625	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:59.231518984 CET	5651	57620	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.231622934 CET	57620	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.232197046 CET	80	57621	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.232274055 CET	57621	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.232486963 CET	8080	57622	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.232650042 CET	57622	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.232815981 CET	8080	57624	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:59.232839108 CET	5651	57623	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:59.232875109 CET	57624	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:59.232914925 CET	57623	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:59.233457088 CET	5651	57625	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:59.233525991 CET	57625	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:59.233742952 CET	57620	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.233742952 CET	57620	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.233900070 CET	57621	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.233922005 CET	57621	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.233973980 CET	57622	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.233973980 CET	57622	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:54:59.234016895 CET	57623	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:59.234039068 CET	57623	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:59.234097958 CET	57624	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:59.234114885 CET	57624	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:54:59.234122038 CET	57625	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:59.234122038 CET	57625	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:54:59.239073992 CET	5651	57620	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.239192963 CET	5651	57620	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.239310980 CET	80	57621	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.239329100 CET	80	57621	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.239341974 CET	8080	57622	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.239351988 CET	8080	57622	111.90.140.51	192.168.2.7
Oct 29, 2024 16:54:59.239586115 CET	5651	57623	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:59.239630938 CET	5651	57623	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:59.239641905 CET	8080	57624	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:59.239653111 CET	8080	57624	65.21.245.7	192.168.2.7
Oct 29, 2024 16:54:59.239664078 CET	5651	57625	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:59.239674091 CET	5651	57625	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:59.985173941 CET	5651	57619	111.90.140.34	192.168.2.7
Oct 29, 2024 16:54:59.985265970 CET	57619	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:00.048696041 CET	57619	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:00.055344105 CET	5651	57619	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:00.158878088 CET	5651	57625	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:00.158962011 CET	57625	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:00.209599972 CET	57625	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:00.215255976 CET	5651	57625	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:00.558228970 CET	57626	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:00.559042931 CET	57627	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:00.563714027 CET	5651	57626	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:00.563791037 CET	57626	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:00.564203024 CET	57626	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:00.564229965 CET	57626	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:00.564430952 CET	5651	57627	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:00.564543962 CET	57627	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:00.564963102 CET	57627	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:00.564981937 CET	57627	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:00.569602013 CET	5651	57626	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:00.569674969 CET	5651	57626	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:00.570555925 CET	5651	57627	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:00.570566893 CET	5651	57627	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:01.421833992 CET	5651	57626	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:01.422334909 CET	5651	57627	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:01.422440052 CET	57626	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:01.422530890 CET	57626	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:01.422533035 CET	57627	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:01.422569036 CET	57627	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:01.427985907 CET	5651	57626	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:01.428172112 CET	5651	57627	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:01.500509977 CET	57628	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:01.507066965 CET	5651	57628	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:01.509954929 CET	57628	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:01.510541916 CET	57628	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:01.510557890 CET	57628	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:01.515954018 CET	5651	57628	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:01.516489029 CET	5651	57628	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:02.356909990 CET	5651	57628	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:02.357471943 CET	57628	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:02.357580900 CET	57628	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:02.364178896 CET	5651	57628	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:02.373843908 CET	57629	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:02.379450083 CET	5651	57629	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:02.379530907 CET	57629	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:02.381369114 CET	57629	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:02.381378889 CET	57629	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:02.386992931 CET	5651	57629	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:02.387069941 CET	5651	57629	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:03.241028070 CET	5651	57629	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:03.245938063 CET	57629	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:03.246525049 CET	57629	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:03.252012968 CET	5651	57629	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:03.361749887 CET	57630	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:03.367290020 CET	5651	57630	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:03.367367983 CET	57630	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:03.367702961 CET	57630	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:03.367702961 CET	57630	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:03.373394966 CET	5651	57630	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:03.373476028 CET	5651	57630	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:04.206639051 CET	5651	57630	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:04.206713915 CET	57630	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:04.206769943 CET	57630	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:04.212214947 CET	5651	57630	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:04.233241081 CET	57631	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:04.239511013 CET	5651	57631	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:04.241969109 CET	57631	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:04.242227077 CET	57631	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:04.242239952 CET	57631	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:04.247832060 CET	5651	57631	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:04.247870922 CET	5651	57631	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:05.277767897 CET	5651	57631	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:05.277934074 CET	57631	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:05.277934074 CET	57631	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:05.283360004 CET	5651	57631	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:05.327709913 CET	57632	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:05.333256006 CET	5651	57632	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:05.333353996 CET	57632	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:05.333784103 CET	57632	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:05.333795071 CET	57632	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:05.339165926 CET	5651	57632	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:05.339176893 CET	5651	57632	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:06.187975883 CET	5651	57632	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:06.193953991 CET	57632	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:06.194019079 CET	57632	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:06.201173067 CET	5651	57632	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:06.202183962 CET	57633	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:06.209739923 CET	5651	57633	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:06.211982965 CET	57633	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:06.212275982 CET	57633	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:06.212294102 CET	57633	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:06.220269918 CET	5651	57633	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:06.220438004 CET	5651	57633	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:06.316102982 CET	57634	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:06.321798086 CET	5651	57634	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:06.321939945 CET	57634	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:06.322278023 CET	57634	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:06.322278023 CET	57634	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:06.327656031 CET	5651	57634	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:06.327728987 CET	5651	57634	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:06.927180052 CET	5651	57618	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:06.928817987 CET	57618	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:06.948302031 CET	57618	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:06.953972101 CET	5651	57618	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.068470001 CET	5651	57633	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:07.068593025 CET	57633	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:07.162992954 CET	5651	57634	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:07.163352966 CET	57634	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:07.172898054 CET	57633	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:07.178738117 CET	5651	57633	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:07.180310011 CET	57634	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:07.186135054 CET	5651	57634	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:07.254647970 CET	57635	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.255574942 CET	57636	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:07.260488987 CET	5651	57635	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.260564089 CET	57635	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.261077881 CET	5651	57636	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:07.261681080 CET	57636	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:07.262124062 CET	57635	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.262146950 CET	57635	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.262526989 CET	57636	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:07.262542009 CET	57636	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:07.267426968 CET	5651	57635	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.267537117 CET	5651	57635	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.268178940 CET	5651	57636	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:07.268290043 CET	5651	57636	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:07.716160059 CET	5651	57620	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.716226101 CET	57620	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.716708899 CET	57620	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.720561028 CET	5651	57623	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:07.720722914 CET	57623	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:07.720834017 CET	57623	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:07.721708059 CET	8080	57622	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.721796989 CET	57622	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.722228050 CET	5651	57620	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.722382069 CET	57622	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.726246119 CET	5651	57623	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:07.727739096 CET	8080	57622	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.731756926 CET	80	57621	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.732485056 CET	8080	57624	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:07.732961893 CET	57624	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:07.732964039 CET	57621	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.732999086 CET	57621	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.733228922 CET	57624	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:07.737482071 CET	57637	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.738315105 CET	80	57621	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.738486052 CET	8080	57624	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:07.738749981 CET	57638	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.739074945 CET	57639	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:07.742978096 CET	8080	57637	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.744282007 CET	5651	57638	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.744601965 CET	5651	57639	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:07.744707108 CET	57637	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.744903088 CET	57639	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:07.744908094 CET	57638	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.745107889 CET	57638	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.745107889 CET	57638	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.745136023 CET	57637	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.745148897 CET	57637	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.745179892 CET	57639	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:07.745179892 CET	57639	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:07.750621080 CET	5651	57638	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.750658035 CET	5651	57638	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.750669956 CET	8080	57637	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.750679016 CET	8080	57637	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.750688076 CET	5651	57639	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:07.750699043 CET	5651	57639	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:07.847325087 CET	57640	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:07.847351074 CET	57641	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.853094101 CET	8080	57640	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:07.853121042 CET	80	57641	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.853163958 CET	57640	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:07.853202105 CET	57641	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.854511023 CET	57640	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:07.854533911 CET	57640	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:07.855849981 CET	57641	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.855900049 CET	57641	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:07.860425949 CET	8080	57640	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:07.860441923 CET	8080	57640	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:07.861269951 CET	80	57641	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:07.861282110 CET	80	57641	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:08.098117113 CET	5651	57636	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:08.098225117 CET	57636	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:08.098273039 CET	57636	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:08.103756905 CET	5651	57636	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:08.197108030 CET	57642	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:08.202724934 CET	5651	57642	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:08.202827930 CET	57642	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:08.203301907 CET	57642	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:08.203340054 CET	57642	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:08.208667994 CET	5651	57642	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:08.208682060 CET	5651	57642	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:09.930185080 CET	5651	57642	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:09.930345058 CET	57642	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:09.930389881 CET	57642	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:09.930730104 CET	5651	57642	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:09.930931091 CET	57642	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:09.931215048 CET	5651	57642	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:09.931282043 CET	57642	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:10.034662008 CET	57643	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:10.253621101 CET	57642	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:10.984899998 CET	5651	57642	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:10.985977888 CET	57642	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:10.987741947 CET	5651	57642	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:10.987821102 CET	57642	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:10.991317987 CET	5651	57642	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:10.991333008 CET	5651	57643	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:10.991344929 CET	5651	57642	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:10.991476059 CET	57643	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:10.991483927 CET	57642	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:10.991719007 CET	57643	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:10.991719007 CET	57643	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:11.273416996 CET	5651	57643	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:11.273432970 CET	5651	57643	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:12.136101007 CET	5651	57643	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:12.136164904 CET	57643	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:12.144922972 CET	57643	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:12.150465012 CET	5651	57643	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:12.484057903 CET	57644	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:12.489785910 CET	5651	57644	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:12.489888906 CET	57644	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:12.512598038 CET	57644	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:12.512646914 CET	57644	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:12.518204927 CET	5651	57644	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:12.518217087 CET	5651	57644	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:13.325411081 CET	5651	57644	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:13.325480938 CET	57644	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:13.331754923 CET	57644	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:13.337239981 CET	5651	57644	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:13.421216965 CET	57645	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:13.426801920 CET	5651	57645	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:13.429964066 CET	57645	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:13.430164099 CET	57645	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:13.430175066 CET	57645	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:13.435472012 CET	5651	57645	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:13.435798883 CET	5651	57645	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:14.290216923 CET	5651	57645	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:14.293962955 CET	57645	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:14.294004917 CET	57645	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:14.299386978 CET	5651	57645	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:14.411012888 CET	57646	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:14.416585922 CET	5651	57646	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:14.416670084 CET	57646	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:14.417728901 CET	57646	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:14.417728901 CET	57646	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:14.423218966 CET	5651	57646	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:14.423228979 CET	5651	57646	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:15.261048079 CET	5651	57646	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:15.261112928 CET	57646	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:15.261162043 CET	57646	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:15.266587019 CET	5651	57646	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:15.279583931 CET	57647	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:15.285073996 CET	5651	57647	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:15.285963058 CET	57647	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:15.286181927 CET	57647	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:15.286195040 CET	57647	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:15.291613102 CET	5651	57647	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:15.292042971 CET	5651	57647	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:15.743535995 CET	5651	57635	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:15.744452000 CET	57635	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:15.744452953 CET	57635	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:15.749866009 CET	5651	57635	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:15.836882114 CET	57648	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:15.842380047 CET	5651	57648	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:15.842458010 CET	57648	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:15.843126059 CET	57648	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:15.843126059 CET	57648	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:15.848501921 CET	5651	57648	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:15.848617077 CET	5651	57648	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:16.164202929 CET	5651	57647	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:16.164330959 CET	57647	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:16.164375067 CET	57647	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:16.169727087 CET	5651	57647	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:16.240547895 CET	8080	57637	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:16.240612030 CET	57637	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.240706921 CET	5651	57638	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:16.240708113 CET	57637	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.240777969 CET	57638	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.241153002 CET	57638	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.241352081 CET	5651	57639	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:16.241451025 CET	57639	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:16.242496014 CET	57639	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:16.246114016 CET	8080	57637	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:16.246854067 CET	5651	57638	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:16.248105049 CET	5651	57639	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:16.267807007 CET	57649	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.268596888 CET	57650	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:16.268942118 CET	57651	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:16.269076109 CET	57652	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.273576975 CET	5651	57649	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:16.273956060 CET	57649	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.274185896 CET	57649	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.274195910 CET	57649	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.274926901 CET	5651	57650	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:16.274966955 CET	5651	57651	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:16.275029898 CET	57650	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:16.275382996 CET	57650	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:16.275382996 CET	57651	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:16.275393963 CET	57650	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:16.275404930 CET	8080	57652	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:16.275435925 CET	57651	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:16.275464058 CET	57651	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:16.275474072 CET	57652	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.275650978 CET	57652	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.277908087 CET	57652	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.279520988 CET	5651	57649	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:16.279921055 CET	5651	57649	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:16.281056881 CET	5651	57650	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:16.281474113 CET	5651	57650	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:16.281483889 CET	5651	57651	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:16.281491995 CET	5651	57651	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:16.281538963 CET	8080	57652	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:16.284351110 CET	8080	57652	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:16.330569029 CET	8080	57640	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:16.334009886 CET	57640	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:16.337905884 CET	57640	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:16.344465017 CET	8080	57640	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:16.363811970 CET	80	57641	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:16.363878012 CET	57641	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.363964081 CET	57641	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.371105909 CET	80	57641	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:16.381263971 CET	57653	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:16.381453991 CET	57654	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.388164997 CET	8080	57653	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:16.388276100 CET	57653	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:16.388523102 CET	80	57654	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:16.388582945 CET	57654	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.388957977 CET	57653	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:16.389087915 CET	57653	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:16.389132977 CET	57654	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.389194012 CET	57654	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:16.395855904 CET	8080	57653	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:16.395865917 CET	8080	57653	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:16.395875931 CET	80	57654	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:16.395893097 CET	80	57654	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:17.172199011 CET	5651	57650	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:17.172307014 CET	57650	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:17.172399044 CET	57650	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:17.177938938 CET	5651	57650	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:17.262124062 CET	57655	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:17.267784119 CET	5651	57655	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:17.267863989 CET	57655	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:17.268121958 CET	57655	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:17.268146992 CET	57655	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:17.273644924 CET	5651	57655	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:17.273663044 CET	5651	57655	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:18.128192902 CET	5651	57655	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:18.128319979 CET	57655	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:18.128766060 CET	57655	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:18.134260893 CET	5651	57655	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:18.236048937 CET	57656	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:18.241545916 CET	5651	57656	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:18.241625071 CET	57656	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:18.242361069 CET	57656	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:18.242361069 CET	57656	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:18.247694969 CET	5651	57656	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:18.247772932 CET	5651	57656	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:19.107229948 CET	5651	57656	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:19.107331038 CET	57656	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:19.107404947 CET	57656	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:19.112741947 CET	5651	57656	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:19.217561007 CET	57657	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:19.223170996 CET	5651	57657	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:19.225982904 CET	57657	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:19.226227999 CET	57657	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:19.226241112 CET	57657	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:19.231615067 CET	5651	57657	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:19.231630087 CET	5651	57657	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:20.065246105 CET	5651	57657	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:20.065314054 CET	57657	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:20.065349102 CET	57657	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:20.070848942 CET	5651	57657	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:20.099169970 CET	57658	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:20.105051041 CET	5651	57658	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:20.105144024 CET	57658	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:20.109872103 CET	57658	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:20.109910965 CET	57658	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:20.115223885 CET	5651	57658	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:20.115362883 CET	5651	57658	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:20.979286909 CET	5651	57658	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:20.979360104 CET	57658	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:20.979495049 CET	57658	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:20.985002995 CET	5651	57658	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:21.081998110 CET	57659	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:21.087640047 CET	5651	57659	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:21.087836981 CET	57659	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:21.089050055 CET	57659	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:21.089162111 CET	57659	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:21.094526052 CET	5651	57659	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:21.094604015 CET	5651	57659	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:21.951904058 CET	5651	57659	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:21.952189922 CET	57659	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:21.955971003 CET	57659	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:21.961801052 CET	5651	57659	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:22.065855026 CET	57660	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:22.071722031 CET	5651	57660	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:22.071894884 CET	57660	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:22.072792053 CET	57660	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:22.072792053 CET	57660	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:22.078228951 CET	5651	57660	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:22.078268051 CET	5651	57660	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:22.907846928 CET	5651	57660	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:22.907946110 CET	57660	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:22.908436060 CET	57660	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:22.913748026 CET	5651	57660	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:22.946309090 CET	57661	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:22.951827049 CET	5651	57661	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:22.951901913 CET	57661	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:22.952239990 CET	57661	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:22.952258110 CET	57661	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:22.957645893 CET	5651	57661	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:22.957792044 CET	5651	57661	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:23.792844057 CET	5651	57661	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:23.792931080 CET	57661	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:24.003910065 CET	57661	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:24.009633064 CET	5651	57661	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:24.094785929 CET	57662	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:24.100290060 CET	5651	57662	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:24.100466013 CET	57662	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:24.100795984 CET	57662	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:24.100795984 CET	57662	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:24.106199980 CET	5651	57662	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:24.106750011 CET	5651	57662	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:24.333111048 CET	5651	57648	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:24.336762905 CET	57648	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.336822987 CET	57648	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.342291117 CET	5651	57648	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:24.365834951 CET	57663	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.371233940 CET	5651	57663	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:24.371310949 CET	57663	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.372086048 CET	57663	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.372086048 CET	57663	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.377382040 CET	5651	57663	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:24.377393961 CET	5651	57663	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:24.757841110 CET	5651	57651	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:24.758008957 CET	57651	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:24.758061886 CET	57651	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:24.758774996 CET	5651	57649	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:24.758876085 CET	57649	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.759568930 CET	57649	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.763221025 CET	8080	57652	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:24.763353109 CET	57652	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.763381004 CET	5651	57651	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:24.764364958 CET	57652	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.764826059 CET	5651	57649	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:24.769696951 CET	8080	57652	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:24.803878069 CET	57664	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.805562019 CET	57665	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.805888891 CET	57666	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:24.809376001 CET	8080	57664	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:24.809492111 CET	57664	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.809674978 CET	57664	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.809699059 CET	57664	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.810962915 CET	5651	57665	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:24.811032057 CET	57665	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.811249018 CET	57665	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.811275005 CET	5651	57666	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:24.811307907 CET	57665	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.811337948 CET	57666	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:24.811486959 CET	57666	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:24.811503887 CET	57666	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:24.814975023 CET	8080	57664	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:24.814990997 CET	8080	57664	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:24.816570044 CET	5651	57665	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:24.816593885 CET	5651	57665	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:24.816766024 CET	5651	57666	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:24.816778898 CET	5651	57666	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:24.873861074 CET	8080	57653	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:24.873980999 CET	57653	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:24.874114990 CET	57653	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:24.879430056 CET	8080	57653	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:24.910729885 CET	80	57654	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:24.911983013 CET	57654	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.912029028 CET	57654	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:24.916444063 CET	57667	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:24.917383909 CET	80	57654	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:24.921776056 CET	8080	57667	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:24.923998117 CET	57667	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:24.924202919 CET	57667	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:24.924222946 CET	57667	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:24.929483891 CET	8080	57667	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:24.929514885 CET	8080	57667	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:24.971890926 CET	5651	57662	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:24.972443104 CET	57662	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:24.972565889 CET	57662	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:24.977843046 CET	5651	57662	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:25.017044067 CET	57668	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:25.022581100 CET	5651	57668	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:25.022795916 CET	57668	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:25.023077965 CET	57668	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:25.023088932 CET	57668	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:25.028431892 CET	5651	57668	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:25.028446913 CET	5651	57668	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:25.029341936 CET	57669	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:25.034859896 CET	80	57669	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:25.034921885 CET	57669	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:25.035443068 CET	57669	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:25.035465002 CET	57669	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:25.040755987 CET	80	57669	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:25.040770054 CET	80	57669	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:25.864686012 CET	5651	57668	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:25.864866018 CET	57668	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:25.864911079 CET	57668	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:25.870537043 CET	5651	57668	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:25.892558098 CET	57670	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:25.898252010 CET	5651	57670	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:25.898324966 CET	57670	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:25.898621082 CET	57670	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:25.898633003 CET	57670	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:25.903980970 CET	5651	57670	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:25.904426098 CET	5651	57670	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:26.755520105 CET	5651	57670	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:26.755624056 CET	57670	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:26.755901098 CET	57670	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:26.762573957 CET	5651	57670	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:26.770267963 CET	57671	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:26.775834084 CET	5651	57671	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:26.775911093 CET	57671	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:26.787545919 CET	57671	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:26.787573099 CET	57671	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:26.793061972 CET	5651	57671	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:26.793107033 CET	5651	57671	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:27.597908974 CET	5651	57671	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:27.597995043 CET	57671	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:27.598095894 CET	57671	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:27.603585958 CET	5651	57671	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:27.642432928 CET	57672	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:27.648725986 CET	5651	57672	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:27.648818970 CET	57672	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:27.650197029 CET	57672	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:27.650243044 CET	57672	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:27.655710936 CET	5651	57672	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:27.655777931 CET	5651	57672	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:28.492063046 CET	5651	57672	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:28.494029999 CET	57672	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:28.497921944 CET	57672	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:28.503446102 CET	5651	57672	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:28.522308111 CET	57673	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:28.527884007 CET	5651	57673	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:28.528093100 CET	57673	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:28.528520107 CET	57673	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:28.528618097 CET	57673	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:28.533934116 CET	5651	57673	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:28.534259081 CET	5651	57673	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:29.376666069 CET	5651	57673	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:29.376849890 CET	57673	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:29.376945019 CET	57673	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:29.382368088 CET	5651	57673	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:29.393249989 CET	57674	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:29.398955107 CET	5651	57674	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:29.399019957 CET	57674	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:29.399338007 CET	57674	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:29.399477005 CET	57674	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:29.404778004 CET	5651	57674	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:29.405004978 CET	5651	57674	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:30.253972054 CET	5651	57674	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:30.256289959 CET	57674	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:30.256371975 CET	57674	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:30.261753082 CET	5651	57674	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:30.267712116 CET	57675	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:30.276175022 CET	5651	57675	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:30.280261993 CET	57675	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:30.280433893 CET	57675	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:30.280433893 CET	57675	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:30.285967112 CET	5651	57675	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:30.286179066 CET	5651	57675	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:30.377060890 CET	57676	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:30.382730961 CET	5651	57676	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:30.384560108 CET	57676	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:30.384761095 CET	57676	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:30.384772062 CET	57676	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:30.390311003 CET	5651	57676	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:30.390342951 CET	5651	57676	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:31.110655069 CET	5651	57675	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:31.110824108 CET	57675	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:31.112771034 CET	57675	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:31.122615099 CET	5651	57675	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:31.241957903 CET	5651	57676	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:31.242574930 CET	57676	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:31.489217997 CET	57676	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:31.503494024 CET	57677	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:31.593691111 CET	57678	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:31.745213032 CET	5651	57676	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:31.745224953 CET	5651	57677	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:31.745237112 CET	5651	57678	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:31.745318890 CET	57677	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:31.745347977 CET	57678	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:31.749351978 CET	57677	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:31.749373913 CET	57678	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:31.749375105 CET	57678	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:31.749412060 CET	57677	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:31.754853964 CET	5651	57677	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:31.754865885 CET	5651	57678	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:31.754883051 CET	5651	57678	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:31.754893064 CET	5651	57677	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:32.597542048 CET	5651	57678	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:32.597614050 CET	57678	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:32.597731113 CET	57678	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:32.603319883 CET	5651	57677	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:32.603450060 CET	57677	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:32.603450060 CET	57677	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:32.603748083 CET	5651	57678	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:32.608969927 CET	5651	57677	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:32.680619001 CET	57679	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:32.686156988 CET	5651	57679	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:32.686229944 CET	57679	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:32.686614037 CET	57679	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:32.686614037 CET	57679	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:32.691997051 CET	5651	57679	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:32.692049980 CET	5651	57679	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:32.855442047 CET	5651	57663	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:32.855513096 CET	57663	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:32.855623007 CET	57663	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:32.861094952 CET	5651	57663	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:32.894239902 CET	57680	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:32.899698019 CET	5651	57680	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:32.901983976 CET	57680	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:32.902234077 CET	57680	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:32.902244091 CET	57680	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.243360996 CET	57680	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.398302078 CET	5651	57680	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.398317099 CET	5651	57680	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.398761034 CET	8080	57664	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.398837090 CET	57664	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.398911953 CET	5651	57666	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:33.398925066 CET	5651	57665	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.398998976 CET	57666	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:33.399028063 CET	57665	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.399209976 CET	57664	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.399782896 CET	5651	57680	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.399840117 CET	57666	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:33.400568008 CET	57665	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.405869007 CET	8080	57664	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.406584024 CET	5651	57666	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:33.407320976 CET	5651	57665	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.413821936 CET	8080	57667	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:33.413917065 CET	57667	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:33.413948059 CET	57667	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:33.420722961 CET	8080	57667	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:33.436229944 CET	57681	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.438700914 CET	57682	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:33.438913107 CET	57683	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:33.441638947 CET	8080	57681	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.444541931 CET	8080	57682	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:33.444668055 CET	57681	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.444736004 CET	5651	57683	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:33.444765091 CET	57682	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:33.444967031 CET	57681	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.444989920 CET	57681	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.445007086 CET	57683	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:33.445130110 CET	57682	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:33.445141077 CET	57682	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:33.445182085 CET	57683	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:33.445190907 CET	57683	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:33.450632095 CET	8080	57681	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.450643063 CET	8080	57681	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.450663090 CET	8080	57682	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:33.450671911 CET	8080	57682	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:33.450680971 CET	5651	57683	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:33.450690985 CET	5651	57683	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:33.455686092 CET	57684	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.461124897 CET	5651	57684	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.461256027 CET	57684	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.461679935 CET	57684	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.461940050 CET	57684	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.467233896 CET	5651	57684	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.467374086 CET	5651	57684	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.523464918 CET	80	57669	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.523827076 CET	57669	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.523961067 CET	57669	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.527784109 CET	5651	57679	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:33.527857065 CET	57679	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:33.528069973 CET	57679	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:33.529455900 CET	80	57669	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.533452988 CET	5651	57679	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:33.563122034 CET	57685	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.563302994 CET	57686	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:33.568599939 CET	80	57685	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.568670988 CET	57685	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.568842888 CET	5651	57686	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:33.568897009 CET	57686	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:33.571589947 CET	57685	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.571616888 CET	57685	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:33.571640968 CET	57686	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:33.571651936 CET	57686	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:33.577033043 CET	80	57685	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.577044010 CET	80	57685	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:33.577053070 CET	5651	57686	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:33.577061892 CET	5651	57686	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:35.477894068 CET	5651	57686	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:35.477957010 CET	57686	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:35.478470087 CET	57686	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:35.483820915 CET	5651	57686	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:35.517273903 CET	57687	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:35.522751093 CET	5651	57687	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:35.525990009 CET	57687	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:35.526259899 CET	57687	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:35.529930115 CET	57687	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:35.531570911 CET	5651	57687	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:35.535626888 CET	5651	57687	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:36.366384983 CET	5651	57687	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:36.366478920 CET	57687	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:36.366600990 CET	57687	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:36.372186899 CET	5651	57687	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:36.396744967 CET	57688	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:36.402245998 CET	5651	57688	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:36.402364969 CET	57688	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:36.402616978 CET	57688	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:36.402616978 CET	57688	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:36.407933950 CET	5651	57688	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:36.407952070 CET	5651	57688	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:37.432614088 CET	5651	57688	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:37.436058998 CET	57688	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:37.436100006 CET	57688	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:37.444120884 CET	5651	57688	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:37.489810944 CET	57689	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:37.495264053 CET	5651	57689	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:37.495338917 CET	57689	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:37.496407986 CET	57689	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:37.496429920 CET	57689	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:37.501770973 CET	5651	57689	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:37.501827002 CET	5651	57689	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:38.359383106 CET	5651	57689	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:38.359558105 CET	57689	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:38.359612942 CET	57689	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:38.365509987 CET	5651	57689	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:38.473944902 CET	57690	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:38.479396105 CET	5651	57690	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:38.480036974 CET	57690	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:38.480732918 CET	57690	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:38.480763912 CET	57690	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:38.486114025 CET	5651	57690	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:38.486124039 CET	5651	57690	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:39.328063011 CET	5651	57690	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:39.328218937 CET	57690	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:39.328555107 CET	57690	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:39.333858967 CET	5651	57690	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:39.346208096 CET	57691	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:39.351722956 CET	5651	57691	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:39.352771997 CET	57691	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:39.354170084 CET	57691	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:39.354525089 CET	57691	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:39.359616041 CET	5651	57691	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:39.359873056 CET	5651	57691	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:40.428597927 CET	5651	57691	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:40.429996014 CET	57691	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:40.430171013 CET	57691	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:40.435918093 CET	5651	57691	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:40.500030994 CET	57692	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:40.505599022 CET	5651	57692	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:40.505682945 CET	57692	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:40.507343054 CET	57692	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:40.507380962 CET	57692	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:40.512813091 CET	5651	57692	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:40.512959003 CET	5651	57692	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:41.408308029 CET	5651	57692	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:41.408387899 CET	57692	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:41.408510923 CET	57692	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:41.413847923 CET	5651	57692	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:41.431305885 CET	57693	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:41.436774015 CET	5651	57693	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:41.436846972 CET	57693	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:41.437916040 CET	57693	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:41.437964916 CET	57693	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:41.443758965 CET	5651	57693	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:41.443789005 CET	5651	57693	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:41.620083094 CET	5651	57680	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:41.624319077 CET	57680	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:41.624423027 CET	57680	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:41.630069017 CET	5651	57680	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:41.640815973 CET	57694	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:41.647910118 CET	5651	57694	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:41.648013115 CET	57694	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:41.648478985 CET	57694	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:41.648515940 CET	57694	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:41.653888941 CET	5651	57694	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:41.654061079 CET	5651	57694	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:41.927382946 CET	5651	57683	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:41.927623987 CET	57683	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:41.927623987 CET	57683	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:41.930296898 CET	8080	57681	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:41.930529118 CET	8080	57682	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:41.930632114 CET	57681	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:41.930638075 CET	57682	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:41.933170080 CET	5651	57683	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:41.934572935 CET	57681	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:41.940244913 CET	8080	57681	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:41.941255093 CET	57682	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:41.944281101 CET	5651	57684	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:41.944340944 CET	57684	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:41.944698095 CET	57684	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:41.946613073 CET	8080	57682	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:41.950102091 CET	5651	57684	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:41.999898911 CET	57695	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:42.000572920 CET	57696	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:42.001326084 CET	57697	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:42.001960039 CET	57698	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:42.005274057 CET	5651	57695	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:42.005369902 CET	57695	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:42.005820990 CET	57695	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:42.005832911 CET	57695	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:42.006242037 CET	8080	57696	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:42.006688118 CET	5651	57697	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:42.006762981 CET	57696	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:42.007397890 CET	8080	57698	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:42.007425070 CET	57697	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:42.007425070 CET	57697	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:42.007477045 CET	57698	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:42.007486105 CET	57697	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:42.007833958 CET	57696	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:42.007848978 CET	57696	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:42.007951021 CET	57698	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:42.007967949 CET	57698	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:42.011270046 CET	5651	57695	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:42.011300087 CET	5651	57695	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:42.013093948 CET	5651	57697	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:42.013123035 CET	5651	57697	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:42.013183117 CET	8080	57696	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:42.013231993 CET	8080	57696	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:42.013314009 CET	8080	57698	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:42.013341904 CET	8080	57698	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:42.060070038 CET	80	57685	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:42.060134888 CET	57685	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:42.060275078 CET	57685	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:42.065557003 CET	80	57685	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:42.085436106 CET	57699	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:42.090881109 CET	80	57699	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:42.090980053 CET	57699	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:42.091443062 CET	57699	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:42.091466904 CET	57699	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:42.096838951 CET	80	57699	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:42.096849918 CET	80	57699	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:42.304445982 CET	5651	57693	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:42.306018114 CET	57693	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:42.306714058 CET	57693	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:42.318114996 CET	5651	57693	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:42.421386003 CET	57700	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:42.427076101 CET	5651	57700	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:42.427165031 CET	57700	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:42.430066109 CET	57700	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:42.430066109 CET	57700	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:42.435522079 CET	5651	57700	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:42.435543060 CET	5651	57700	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:43.267997026 CET	5651	57700	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:43.268167019 CET	57700	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:43.268309116 CET	57700	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:43.274039030 CET	5651	57700	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:43.290904045 CET	57701	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:43.296483040 CET	5651	57701	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:43.296664953 CET	57701	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:43.297317028 CET	57701	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:43.297341108 CET	57701	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:43.302767992 CET	5651	57701	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:43.302799940 CET	5651	57701	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:44.156317949 CET	5651	57701	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:44.156409025 CET	57701	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:44.156461954 CET	57701	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:44.161886930 CET	5651	57701	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:44.268045902 CET	57702	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:44.274211884 CET	5651	57702	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:44.278003931 CET	57702	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:44.278511047 CET	57702	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:44.278563023 CET	57702	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:44.284013987 CET	5651	57702	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:44.284037113 CET	5651	57702	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:45.113203049 CET	5651	57702	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:45.113259077 CET	57702	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:45.113395929 CET	57702	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:45.119043112 CET	5651	57702	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:45.173218966 CET	57703	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:45.178750992 CET	5651	57703	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:45.178832054 CET	57703	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:45.179788113 CET	57703	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:45.179836988 CET	57703	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:45.185066938 CET	5651	57703	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:45.185142040 CET	5651	57703	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:46.054337978 CET	5651	57703	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:46.054421902 CET	57703	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:46.054522038 CET	57703	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:46.059896946 CET	5651	57703	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:46.124140978 CET	57704	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:46.129535913 CET	5651	57704	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:46.129990101 CET	57704	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:46.130506039 CET	57704	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:46.130506039 CET	57704	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:46.136159897 CET	5651	57704	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:46.136291981 CET	5651	57704	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:47.035995007 CET	5651	57704	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:47.040361881 CET	57704	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:47.040522099 CET	57704	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:47.045926094 CET	5651	57704	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:47.113388062 CET	57705	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:47.119568110 CET	5651	57705	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:47.119637012 CET	57705	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:47.119832993 CET	57705	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:47.119844913 CET	57705	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:47.125322104 CET	5651	57705	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:47.125348091 CET	5651	57705	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:48.013828993 CET	5651	57705	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:48.013895988 CET	57705	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:48.014206886 CET	57705	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:48.019893885 CET	5651	57705	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:48.131098986 CET	57706	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:48.136497021 CET	5651	57706	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:48.136656046 CET	57706	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:48.143703938 CET	57706	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:48.143703938 CET	57706	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:48.149132967 CET	5651	57706	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:48.149333954 CET	5651	57706	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:48.985028982 CET	5651	57706	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:48.985106945 CET	57706	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:48.985409021 CET	57706	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:48.990766048 CET	5651	57706	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:49.083731890 CET	57707	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:49.089102030 CET	5651	57707	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:49.089207888 CET	57707	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:49.091377020 CET	57707	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:49.091984987 CET	57707	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:49.096693039 CET	5651	57707	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:49.097398043 CET	5651	57707	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:50.001378059 CET	5651	57707	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:50.001440048 CET	57707	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:50.001724005 CET	57707	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:50.007380962 CET	5651	57707	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:50.065990925 CET	57708	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:50.071300030 CET	5651	57708	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:50.072025061 CET	57708	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:50.072423935 CET	57708	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:50.072437048 CET	57708	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:50.077810049 CET	5651	57708	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:50.078385115 CET	5651	57708	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:50.159284115 CET	5651	57694	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.159532070 CET	57694	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.159604073 CET	57694	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.165339947 CET	5651	57694	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.199753046 CET	57709	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.205166101 CET	5651	57709	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.205243111 CET	57709	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.205662012 CET	57709	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.205734015 CET	57709	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.210941076 CET	5651	57709	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.211327076 CET	5651	57709	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.487494946 CET	8080	57696	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.487588882 CET	57696	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.487668991 CET	57696	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.490572929 CET	8080	57698	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:50.490843058 CET	57698	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:50.491086006 CET	5651	57697	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:50.491163015 CET	57697	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:50.491321087 CET	57698	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:50.491559982 CET	57697	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:50.493165970 CET	8080	57696	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.497118950 CET	8080	57698	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:50.497344971 CET	5651	57697	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:50.497844934 CET	5651	57695	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.497895956 CET	57695	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.498011112 CET	57695	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.504045010 CET	5651	57695	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.507771969 CET	57710	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.508038998 CET	57711	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:50.508574009 CET	57712	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:50.514169931 CET	8080	57710	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.514389038 CET	5651	57711	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:50.514489889 CET	57710	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.514909029 CET	8080	57712	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:50.514969110 CET	57711	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:50.514969110 CET	57712	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:50.518253088 CET	57710	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.518275976 CET	57710	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.518349886 CET	57712	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:50.518349886 CET	57712	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:50.518369913 CET	57711	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:50.518369913 CET	57711	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:50.524245977 CET	8080	57710	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.524292946 CET	8080	57710	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.524310112 CET	8080	57712	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:50.524322987 CET	8080	57712	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:50.524337053 CET	5651	57711	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:50.524350882 CET	5651	57711	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:50.609337091 CET	80	57699	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.612436056 CET	57713	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.617392063 CET	57699	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.617392063 CET	57699	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.617877007 CET	5651	57713	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.621325016 CET	57713	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.621325016 CET	57713	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.621325016 CET	57713	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.623677015 CET	80	57699	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.626687050 CET	5651	57713	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.627161026 CET	5651	57713	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.725207090 CET	57714	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.730560064 CET	80	57714	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.731570959 CET	57714	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.732460022 CET	57714	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.732460022 CET	57714	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:50.737811089 CET	80	57714	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.738584042 CET	80	57714	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:50.937148094 CET	5651	57708	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:50.937446117 CET	57708	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:50.937633038 CET	57708	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:55:50.943073988 CET	5651	57708	111.90.140.34	192.168.2.7
Oct 29, 2024 16:55:58.704277039 CET	5651	57709	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:58.704673052 CET	57709	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:58.991465092 CET	8080	57710	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:58.991606951 CET	57710	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:58.997944117 CET	8080	57712	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:58.998006105 CET	57712	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:59.004808903 CET	5651	57711	65.21.245.7	192.168.2.7
Oct 29, 2024 16:55:59.004941940 CET	57711	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:55:59.110699892 CET	5651	57713	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:59.110793114 CET	57713	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:55:59.401913881 CET	80	57714	111.90.140.51	192.168.2.7
Oct 29, 2024 16:55:59.401973963 CET	57714	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.532526970 CET	57709	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.535991907 CET	57710	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.536870003 CET	57711	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:01.537297010 CET	57712	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:01.537981033 CET	5651	57709	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.538630962 CET	57713	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.539309978 CET	57714	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.541290998 CET	8080	57710	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.542140007 CET	5651	57711	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:01.542668104 CET	8080	57712	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:01.543987036 CET	5651	57713	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.544589043 CET	80	57714	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.551280022 CET	57715	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:01.556719065 CET	5651	57715	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:01.556844950 CET	57715	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:01.557378054 CET	57715	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:01.557378054 CET	57715	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:01.558520079 CET	57716	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.562853098 CET	5651	57715	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:01.563014030 CET	57717	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.563600063 CET	5651	57715	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:01.564399958 CET	5651	57716	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.564519882 CET	57716	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.567187071 CET	57716	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.567200899 CET	57716	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.567334890 CET	57718	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:01.568377972 CET	8080	57717	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.568470001 CET	57717	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.568670034 CET	57717	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.568712950 CET	57717	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.569356918 CET	57719	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.572459936 CET	5651	57716	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.572686911 CET	5651	57716	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.572696924 CET	5651	57718	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:01.572817087 CET	57718	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:01.572983027 CET	57718	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:01.572983980 CET	57718	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:01.573951960 CET	8080	57717	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.574409008 CET	8080	57717	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.574650049 CET	80	57719	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.574830055 CET	57719	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.575073004 CET	57719	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.575073957 CET	57719	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.578263998 CET	5651	57718	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:01.578398943 CET	5651	57718	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:01.580370903 CET	80	57719	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.580777884 CET	80	57719	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.593086004 CET	57720	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:01.598460913 CET	8080	57720	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:01.602123022 CET	57720	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:01.602329969 CET	57720	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:01.602341890 CET	57720	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:01.607784986 CET	8080	57720	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:01.608023882 CET	8080	57720	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:01.664156914 CET	57721	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.666192055 CET	57722	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.668521881 CET	57723	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.668818951 CET	57724	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:01.669728994 CET	5651	57721	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.669810057 CET	57721	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.670109987 CET	57721	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.670109987 CET	57721	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.671545029 CET	8080	57722	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.671603918 CET	57722	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.671916008 CET	57722	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.671982050 CET	57722	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.673823118 CET	80	57723	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.673901081 CET	57723	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.674146891 CET	8080	57724	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:01.674158096 CET	57723	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.674168110 CET	57723	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:01.674204111 CET	57724	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:01.674555063 CET	57724	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:01.674555063 CET	57724	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:01.675456047 CET	5651	57721	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.675467014 CET	5651	57721	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.677329063 CET	8080	57722	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.677355051 CET	8080	57722	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.679620981 CET	80	57723	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.679630041 CET	80	57723	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:01.679924965 CET	8080	57724	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:01.680035114 CET	8080	57724	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:02.434096098 CET	5651	57715	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:02.434206963 CET	57715	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:02.434324980 CET	57715	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:02.440155029 CET	5651	57715	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:02.545298100 CET	57725	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:02.551224947 CET	5651	57725	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:02.551769972 CET	57725	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:02.552031994 CET	57725	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:02.552031994 CET	57725	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:02.557554007 CET	5651	57725	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:02.557566881 CET	5651	57725	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:03.390162945 CET	5651	57725	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:03.390324116 CET	57725	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:03.390495062 CET	57725	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:03.396342039 CET	5651	57725	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:03.408638954 CET	57726	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:03.414057970 CET	5651	57726	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:03.414134026 CET	57726	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:03.414323092 CET	57726	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:03.414343119 CET	57726	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:03.419703007 CET	5651	57726	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:03.419825077 CET	5651	57726	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:04.307786942 CET	5651	57726	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:04.308463097 CET	57726	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:04.308574915 CET	57726	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:04.314141989 CET	5651	57726	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:04.392580986 CET	57727	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:04.398605108 CET	5651	57727	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:04.398947954 CET	57727	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:04.399323940 CET	57727	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:04.399323940 CET	57727	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:04.404633045 CET	5651	57727	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:04.404644012 CET	5651	57727	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:05.275285006 CET	5651	57727	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:05.275422096 CET	57727	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:05.275422096 CET	57727	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:05.281042099 CET	5651	57727	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:05.378612041 CET	57728	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:05.384438038 CET	5651	57728	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:05.386221886 CET	57728	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:05.386221886 CET	57728	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:05.387532949 CET	57728	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:05.391685963 CET	5651	57728	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:05.392930031 CET	5651	57728	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:06.264487028 CET	5651	57728	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:06.264554024 CET	57728	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:06.264596939 CET	57728	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:06.269937992 CET	5651	57728	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:06.373328924 CET	57729	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:06.378746033 CET	5651	57729	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:06.379122019 CET	57729	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:06.379257917 CET	57729	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:06.379309893 CET	57729	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:06.385072947 CET	5651	57729	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:06.385083914 CET	5651	57729	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:07.273118019 CET	5651	57729	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:07.273205996 CET	57729	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:07.273315907 CET	57729	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:07.278629065 CET	5651	57729	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:07.344213009 CET	57730	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:07.349944115 CET	5651	57730	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:07.350152969 CET	57730	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:07.350358963 CET	57730	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:07.350358963 CET	57730	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:07.355693102 CET	5651	57730	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:07.355703115 CET	5651	57730	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:08.203435898 CET	5651	57730	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:08.203520060 CET	57730	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:08.203592062 CET	57730	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:08.209007025 CET	5651	57730	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:08.221653938 CET	57731	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:08.227087021 CET	5651	57731	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:08.227159977 CET	57731	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:08.227407932 CET	57731	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:08.227407932 CET	57731	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:08.233326912 CET	5651	57731	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:08.233700037 CET	5651	57731	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:09.100191116 CET	5651	57731	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:09.100418091 CET	57731	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:09.100449085 CET	57731	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:09.105757952 CET	5651	57731	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:09.203417063 CET	57732	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:09.208776951 CET	5651	57732	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:09.208900928 CET	57732	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:09.209089994 CET	57732	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:09.209108114 CET	57732	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:09.214385986 CET	5651	57732	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:09.214411020 CET	5651	57732	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:10.044349909 CET	5651	57716	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.044437885 CET	57716	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.044477940 CET	57716	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.050241947 CET	5651	57716	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.050843000 CET	8080	57717	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.050965071 CET	57717	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.050965071 CET	57717	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.056677103 CET	8080	57717	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.064232111 CET	5651	57718	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:10.064312935 CET	57718	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:10.064344883 CET	57718	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:10.067471981 CET	80	57719	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.067572117 CET	57719	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.067572117 CET	57719	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.069674969 CET	5651	57718	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:10.072912931 CET	80	57719	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.079598904 CET	57733	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.081095934 CET	5651	57732	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:10.081154108 CET	57732	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:10.081187963 CET	57732	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:10.085825920 CET	80	57733	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.085910082 CET	57733	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.086076975 CET	57733	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.086076975 CET	57733	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.086765051 CET	5651	57732	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:10.091563940 CET	80	57733	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.091573954 CET	80	57733	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.094175100 CET	8080	57720	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:10.094300985 CET	57720	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:10.094300985 CET	57720	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:10.099812031 CET	8080	57720	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:10.100271940 CET	57734	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:10.100434065 CET	57735	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.100563049 CET	57736	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.106343031 CET	5651	57734	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:10.106414080 CET	57734	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:10.106431007 CET	8080	57735	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.106442928 CET	5651	57736	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.106498003 CET	57736	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.106504917 CET	57735	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.106853962 CET	57734	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:10.106853962 CET	57734	5651	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:10.106957912 CET	57735	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.106986046 CET	57735	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.107009888 CET	57736	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.107009888 CET	57736	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.113240957 CET	5651	57734	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:10.113291979 CET	5651	57734	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:10.113333941 CET	8080	57735	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.113344908 CET	8080	57735	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.113409996 CET	5651	57736	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.113548040 CET	5651	57736	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.148200035 CET	8080	57722	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.148400068 CET	57722	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.148400068 CET	57722	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.153834105 CET	8080	57722	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.155261040 CET	5651	57721	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.155335903 CET	57721	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.155385017 CET	57721	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.157079935 CET	8080	57724	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:10.157160997 CET	57724	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:10.157330990 CET	57724	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:10.158229113 CET	80	57723	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.158313990 CET	57723	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.158539057 CET	57723	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.160797119 CET	5651	57721	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.162836075 CET	8080	57724	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:10.164319038 CET	80	57723	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.192773104 CET	57737	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.193886995 CET	57740	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.193890095 CET	57739	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.193954945 CET	57738	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:10.194823027 CET	57741	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:10.198679924 CET	8080	57737	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.198753119 CET	57737	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.198978901 CET	57737	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.198978901 CET	57737	8080	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.199947119 CET	80	57739	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.199959993 CET	5651	57740	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.200036049 CET	57739	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.200165033 CET	8080	57738	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:10.200201035 CET	57740	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.200227022 CET	57738	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:10.200411081 CET	57739	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.200411081 CET	57739	80	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.200437069 CET	57740	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.200452089 CET	57740	5651	192.168.2.7	111.90.140.51
Oct 29, 2024 16:56:10.200459957 CET	57738	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:10.200474024 CET	57738	8080	192.168.2.7	65.21.245.7
Oct 29, 2024 16:56:10.200903893 CET	5651	57741	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:10.200963974 CET	57741	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:10.201131105 CET	57741	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:10.201142073 CET	57741	5651	192.168.2.7	111.90.140.34
Oct 29, 2024 16:56:10.204972029 CET	8080	57737	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.205598116 CET	8080	57737	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.206818104 CET	80	57739	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.206829071 CET	80	57739	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.206834078 CET	5651	57740	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.206836939 CET	5651	57740	111.90.140.51	192.168.2.7
Oct 29, 2024 16:56:10.206844091 CET	8080	57738	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:10.206846952 CET	8080	57738	65.21.245.7	192.168.2.7
Oct 29, 2024 16:56:10.207166910 CET	5651	57741	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:10.207833052 CET	5651	57741	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:11.046618938 CET	5651	57741	111.90.140.34	192.168.2.7
Oct 29, 2024 16:56:11.046897888 CET	57741	5651	192.168.2.7	111.90.140.34

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 16:51:49.473534107 CET	64896	53	192.168.2.7	1.1.1.1
Oct 29, 2024 16:51:56.707535028 CET	55138	53	192.168.2.7	1.1.1.1
Oct 29, 2024 16:52:03.560512066 CET	53	55637	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 16:51:49.473534107 CET	192.168.2.7	1.1.1.1	0x4b1	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 16:51:56.707535028 CET	192.168.2.7	1.1.1.1	0x4b0	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 16:51:49.481267929 CET	1.1.1.1	192.168.2.7	0x4b1	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 16:51:56.716756105 CET	1.1.1.1	192.168.2.7	0x4b0	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

armmf.adobe.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	57246	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:52:14.665236950 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:52:14.665250063 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	57270	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:52:23.289731026 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:52:23.289757013 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	57280	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:52:23.390639067 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:52:23.390686989 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	57283	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:52:23.486838102 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:52:23.486897945 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	57296	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:52:31.994604111 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:52:31.994617939 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	57299	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:52:32.113146067 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:52:32.113163948 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	57313	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:52:40.629681110 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:52:40.629695892 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	57338	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:52:49.180615902 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:52:49.180629015 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	57354	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:52:57.802619934 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:52:57.802661896 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	57372	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:53:06.443159103 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:53:06.443315983 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	57395	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:53:14.979008913 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:53:14.979008913 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	57409	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:53:23.512618065 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:53:23.512629986 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	57422	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:53:32.044857979 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:53:32.044883013 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	57443	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:53:40.620251894 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:53:40.620253086 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	57459	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:53:49.988482952 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:53:49.988672018 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	57464	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:53:50.003985882 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:53:50.004012108 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	57482	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:53:58.515213966 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:53:58.515228033 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	57512	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:54:07.413608074 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:54:07.413634062 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	57539	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:54:15.899919033 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:54:15.899950981 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	57555	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:54:24.674499989 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:54:24.674510002 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	57570	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:54:33.290338993 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:54:33.290369034 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	57587	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:54:41.823461056 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:54:41.823494911 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	57591	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:54:41.928261995 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:54:41.928280115 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	57605	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:54:50.373140097 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:54:50.373157024 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	57608	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:54:50.458187103 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:54:50.458201885 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	57621	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:54:59.233900070 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:54:59.233922005 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	57641	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:55:07.855849981 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:55:07.855900049 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	57654	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:55:16.389132977 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:55:16.389194012 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	57669	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:55:25.035443068 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:55:25.035465002 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	57685	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:55:33.571589947 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:55:33.571616888 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	57699	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:55:42.091443062 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:55:42.091466904 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	57714	111.90.140.51	80	8624	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:55:50.732460022 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:55:50.732460022 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.7	57719	111.90.140.51	80

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:56:01.575073004 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:56:01.575073957 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	57723	111.90.140.51	80

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:56:01.674158096 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:56:01.674168110 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	57733	111.90.140.51	80

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:56:10.086076975 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:56:10.086076975 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	57739	111.90.140.51	80

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 16:56:10.200411081 CET	6	OUT	Data Raw: 00 00 00 07 Data Ascii:
Oct 29, 2024 16:56:10.200411081 CET	6	OUT	Data Raw: 00 00 00 03 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49742	96.6.160.189	443	7696	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 15:52:00 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-10-29 15:52:01 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Tue, 29 Oct 2024 15:52:01 GMT Connection: close

Target ID:	0
Start time:	11:51:43
Start date:	29/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	11:51:43
Start date:	29/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	11:51:43
Start date:	29/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	11:51:43
Start date:	29/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	11:51:44
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\J4zGPhVRV3.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\J4zGPhVRV3.exe"
Imagebase:	0x7ff69e570000
File size:	25'298'721 bytes
MD5 hash:	3BCA758CE1D5C3858AC8E10A2A38B514
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:51:46
Start date:	29/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\file.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	11:51:46
Start date:	29/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user~1\AppData\Local\Temp\winrar.msi" /qn
Imagebase:	0x7ff6406d0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:51:46
Start date:	29/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0xa30000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:51:47
Start date:	29/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:51:47
Start date:	29/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:51:47
Start date:	29/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1740,i,9168305141304841160,3939740794304371731,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	11:51:47
Start date:	29/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	11:51:49
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 454D404CF2CD6CFC0CCDA935FCCB9601
Imagebase:	0x200000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:51:58
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\Users\user~1\AppData\Local\Temp\winrar.msi"
Imagebase:	0x620000
File size:	11'149'576 bytes
MD5 hash:	2F0D3D1ABD463AC64AA4E743B50AA055
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000010.00000000.1422949051.00000000010D9000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe, Author: ditekSHen
Antivirus matches:	Detection: 26%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:52:03
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
Imagebase:	0x4f0000
File size:	21'972'744 bytes
MD5 hash:	4251BB135CC9A31DD42F0BE1FBC30A86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000012.00000000.1478283984.00000000019E5000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe, Author: ditekSHen
Antivirus matches:	Detection: 26%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:01:27
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Imagebase:	0x4f0000
File size:	21'972'744 bytes
MD5 hash:	4251BB135CC9A31DD42F0BE1FBC30A86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:01:29
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
Imagebase:	0x4f0000
File size:	21'972'744 bytes
MD5 hash:	4251BB135CC9A31DD42F0BE1FBC30A86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:01:30
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -service
Imagebase:	0x4f0000
File size:	21'972'744 bytes
MD5 hash:	4251BB135CC9A31DD42F0BE1FBC30A86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000015.00000002.3800200492.00000000041C8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000015.00000003.1568447250.0000000005E6A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000015.00000002.3759250551.00000000026C8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	13:01:31
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" -firewall
Imagebase:	0x4f0000
File size:	21'972'744 bytes
MD5 hash:	4251BB135CC9A31DD42F0BE1FBC30A86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:01:32
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
Imagebase:	0x620000
File size:	11'149'576 bytes
MD5 hash:	2F0D3D1ABD463AC64AA4E743B50AA055
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000017.00000002.3745548454.000000000329A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000017.00000002.3745548454.0000000003276000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	13:01:32
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Imagebase:	0x620000
File size:	11'149'576 bytes
MD5 hash:	2F0D3D1ABD463AC64AA4E743B50AA055
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000018.00000002.3760276212.0000000004DF8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000018.00000002.3748231450.000000000325A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000018.00000002.3748231450.0000000003228000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000018.00000002.3760276212.0000000004E3C000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	13:01:41
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
Imagebase:	0x620000
File size:	11'149'576 bytes
MD5 hash:	2F0D3D1ABD463AC64AA4E743B50AA055
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:01:48
Start date:	29/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	13:02:03
Start date:	29/10/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff729330000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:02:03
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	27

Executed Functions

Function 00007FF69E59B190 Relevance: 123.9, APIs: 60, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E57255C: GetDlgItem.USER32 ref: 00007FF69E5725AC
Part of subcall function 00007FF69E57255C: SetWindowTextW.USER32 ref: 00007FF69E5725C8

EndDialog.USER32 ref: 00007FF69E59B2D0
SetDlgItemTextW.USER32 ref: 00007FF69E59B320
GetMessageW.USER32 ref: 00007FF69E59B350
IsDialogMessageW.USER32 ref: 00007FF69E59B369
TranslateMessage.USER32 ref: 00007FF69E59B37B
DispatchMessageW.USER32 ref: 00007FF69E59B389
EndDialog.USER32 ref: 00007FF69E59B3D3
GetDlgItem.USER32 ref: 00007FF69E59B410
SendMessageW.USER32 ref: 00007FF69E59B431
SendMessageW.USER32 ref: 00007FF69E59B449
SetFocus.USER32 ref: 00007FF69E59B452
GetLastError.KERNEL32 ref: 00007FF69E59B634
GetLastError.KERNEL32 ref: 00007FF69E59B665
GetTickCount.KERNEL32 ref: 00007FF69E59B68B
GetLastError.KERNEL32 ref: 00007FF69E59B6F5
GetCommandLineW.KERNEL32 ref: 00007FF69E59B841
CreateFileMappingW.KERNEL32 ref: 00007FF69E59B900
MapViewOfFile.KERNEL32 ref: 00007FF69E59B923
Sleep.KERNEL32 ref: 00007FF69E59B9B6
UnmapViewOfFile.KERNEL32 ref: 00007FF69E59B9DF
CloseHandle.KERNEL32 ref: 00007FF69E59B9E8
SetDlgItemTextW.USER32 ref: 00007FF69E59BCDE
DialogBoxParamW.USER32 ref: 00007FF69E59C0D7
EndDialog.USER32 ref: 00007FF69E59C0EF
EnableWindow.USER32 ref: 00007FF69E59C2A6
SendMessageW.USER32 ref: 00007FF69E59C2F8
ShellExecuteExW.SHELL32 ref: 00007FF69E59B95B

Part of subcall function 00007FF69E58AAE0: LoadStringW.USER32 ref: 00007FF69E58AB67
Part of subcall function 00007FF69E58AAE0: LoadStringW.USER32 ref: 00007FF69E58AB80

SendMessageW.USER32 ref: 00007FF69E59BEC3
SendDlgItemMessageW.USER32 ref: 00007FF69E59BEEA
GetDlgItem.USER32 ref: 00007FF69E59BEF8
SendMessageW.USER32 ref: 00007FF69E59BF12
GetDlgItem.USER32 ref: 00007FF69E59BF4F
SetDlgItemTextW.USER32 ref: 00007FF69E59BFEC
SetDlgItemTextW.USER32 ref: 00007FF69E59C004
SetDlgItemTextW.USER32 ref: 00007FF69E59C321
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59C363
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59C369
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59C36F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59C375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59C37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59C381
SendDlgItemMessageW.USER32 ref: 00007FF69E59C449
EndDialog.USER32 ref: 00007FF69E59C463
GetDlgItem.USER32 ref: 00007FF69E59C491
SetFocus.USER32 ref: 00007FF69E59C49A
SendDlgItemMessageW.USER32 ref: 00007FF69E59C53E
FindFirstFileW.KERNEL32 ref: 00007FF69E59C562
FindClose.KERNEL32 ref: 00007FF69E59C68A
SendDlgItemMessageW.USER32 ref: 00007FF69E59C7AF

Part of subcall function 00007FF69E57129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF69E571396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59CAA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59CAAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59CAB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59CABB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59CAC1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59CAC7

Strings

winrarsfxmappingfile.tmp, xrefs: 00007FF69E59B8E0
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF69E59B799
p, xrefs: 00007FF69E59B7AB
@, xrefs: 00007FF69E59B7B6
STARTDLG, xrefs: 00007FF69E59B1CA
__tmp_rar_sfx_access_check_, xrefs: 00007FF69E59B6A9
runas, xrefs: 00007FF69E59B7C9
%s %s, xrefs: 00007FF69E59C6D9, 00007FF69E59C946
REPLACEFILEDLG, xrefs: 00007FF69E59C3D3
LICENSEDLG, xrefs: 00007FF69E59C0C9

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Item$Message$_invalid_parameter_noinfo_noreturn$Send$DialogText$File$ErrorLast$CloseFindFocusLoadStringViewWindow$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleLineMappingParamShellSleepTickTranslateUnmap
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 255727823-2702805183
Opcode ID: 72cfb2ad78d0d9446a3cab55664ab3f843447492cfe0ed25f3b642488b1e3680
Instruction ID: ad465e65330ef3900582886a51f03f93ae4ec9fd03a633463eff095fc382ef99
Opcode Fuzzy Hash: 72cfb2ad78d0d9446a3cab55664ab3f843447492cfe0ed25f3b642488b1e3680
Instruction Fuzzy Hash: 1CD2B461E1868241FA70DB25E8F42F96361EFA5780F8041B6F94DC76A6DF3EE584C720

Function 00007FF69E59CE88 Relevance: 65.0, APIs: 26, Strings: 10, Instructions: 1963windowfileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF69E59D5F3
SendMessageW.USER32 ref: 00007FF69E59D626
SendMessageW.USER32 ref: 00007FF69E59D655
MoveFileW.KERNEL32 ref: 00007FF69E59DB4B
MoveFileExW.KERNEL32 ref: 00007FF69E59DB69
GetTempPathW.KERNEL32 ref: 00007FF69E59DC49

Part of subcall function 00007FF69E571FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E571FFB

EndDialog.USER32 ref: 00007FF69E59DFCA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF69E59EEE3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59EEEF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59EF07
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59EF0D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59EF13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59EF19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59EF1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59EF25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59EF2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59EF31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59EF37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59EF3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59EF43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59EF49
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59EF4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59EF55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59EF5B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF69E59EF67
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF69E59EF73

Strings

.tmp, xrefs: 00007FF69E59DA85
HIDE, xrefs: 00007FF69E59E9E5, 00007FF69E59E9F4
ProgramFilesDir, xrefs: 00007FF69E59D4F0
.lnk, xrefs: 00007FF69E59E406, 00007FF69E59E415
@set:user, xrefs: 00007FF69E59DD96, 00007FF69E59DDA5
MAX, xrefs: 00007FF69E59EA82, 00007FF69E59EA91
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF69E59D501
<br>, xrefs: 00007FF69E59D6DA, 00007FF69E59D6E9
lnk, xrefs: 00007FF69E59E3CA, 00007FF69E59E3D9
MIN, xrefs: 00007FF69E59EAE5, 00007FF69E59EAF4

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$FileMessageMoveSend$DialogItemPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 3007431893-3916287355
Opcode ID: 00a9634cf1621ffdf9648ab056032cbdcf5fe38b242edf5d97e187864c5a1c60
Instruction ID: c7d6a107ca3d8d911c0c3a8a824fbe7449fa7c717701805ca84092b91fe7f647
Opcode Fuzzy Hash: 00a9634cf1621ffdf9648ab056032cbdcf5fe38b242edf5d97e187864c5a1c60
Instruction Fuzzy Hash: CD13C472B0478285EB20DF64D8E02EC27B1FB60398F904576EA1D97AD9DF3AD594C360

Function 00007FF69E5A0754 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 380
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF69E58DFD0: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF69E58E018
Part of subcall function 00007FF69E58DFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF69E58E030
Part of subcall function 00007FF69E58DFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF69E58E05D

Part of subcall function 00007FF69E5862DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF69E5862F2
Part of subcall function 00007FF69E5862DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF69E58632C

Part of subcall function 00007FF69E59946C: OleInitialize.OLE32 ref: 00007FF69E599486
Part of subcall function 00007FF69E59946C: SHGetMalloc.SHELL32 ref: 00007FF69E5994D4

GetCommandLineW.KERNEL32 ref: 00007FF69E5A096E
OpenFileMappingW.KERNEL32 ref: 00007FF69E5A0A07
MapViewOfFile.KERNEL32 ref: 00007FF69E5A0A30
UnmapViewOfFile.KERNEL32 ref: 00007FF69E5A0A46
MapViewOfFile.KERNEL32 ref: 00007FF69E5A0A63
UnmapViewOfFile.KERNEL32 ref: 00007FF69E5A0ACA
CloseHandle.KERNEL32 ref: 00007FF69E5A0AD3
SetEnvironmentVariableW.KERNEL32 ref: 00007FF69E5A0BAD
GetLocalTime.KERNEL32 ref: 00007FF69E5A0BB8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69E5A0C13
SetEnvironmentVariableW.KERNEL32 ref: 00007FF69E5A0C26
GetModuleHandleW.KERNEL32 ref: 00007FF69E5A0C2E
LoadIconW.USER32 ref: 00007FF69E5A0C4D
DialogBoxParamW.USER32 ref: 00007FF69E5A0CB6
Sleep.KERNEL32 ref: 00007FF69E5A0CE6
DeleteObject.GDI32 ref: 00007FF69E5A0D0D
DeleteObject.GDI32 ref: 00007FF69E5A0D1F
CloseHandle.KERNEL32 ref: 00007FF69E5A0D67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5A0DD7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5A0DDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5A0DE3

Part of subcall function 00007FF69E59FD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF69E59FD43
Part of subcall function 00007FF69E59FD0C: SetEnvironmentVariableW.KERNELBASE ref: 00007FF69E59FDBC

Strings

winrarsfxmappingfile.tmp, xrefs: 00007FF69E5A09F9
sfxstime, xrefs: 00007FF69E5A0C1F
sfxname, xrefs: 00007FF69E5A0B9B
STARTDLG, xrefs: 00007FF69E5A0CA5
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF69E5A0C02

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 1048086575-3710569615
Opcode ID: cf857dfdb846402a04b639880a0f56ecddc48e970ed32f05d0be7d60c6edf358
Instruction ID: c2f638f211bc77f5517aee6f0c69c11b6af424c68be61404b925d3268df3350c
Opcode Fuzzy Hash: cf857dfdb846402a04b639880a0f56ecddc48e970ed32f05d0be7d60c6edf358
Instruction Fuzzy Hash: 96127A61E18B8286EB30DB24E8E52B96361FFA5794F404171FA5D87AA5DF3EE140C730

Function 00007FF69E58A4AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69E58A504

Part of subcall function 00007FF69E590F68: WideCharToMultiByte.KERNEL32 ref: 00007FF69E590F99

SetDlgItemTextW.USER32 ref: 00007FF69E58A573
GetWindowRect.USER32 ref: 00007FF69E58A5AD
GetClientRect.USER32 ref: 00007FF69E58A5BB
GetWindowLongPtrW.USER32 ref: 00007FF69E58A66C
GetWindowRect.USER32 ref: 00007FF69E58A6B2
SetWindowTextW.USER32 ref: 00007FF69E58A6EC
GetSystemMetrics.USER32 ref: 00007FF69E58A6F7
GetWindow.USER32 ref: 00007FF69E58A708
GetWindowRect.USER32 ref: 00007FF69E58A746
GetWindow.USER32 ref: 00007FF69E58A808

Strings

$%s:, xrefs: 00007FF69E58A4EF
CAPTION, xrefs: 00007FF69E58A6CF

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 2100155373-404845831
Opcode ID: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction ID: c70d2d0d6fe89fc610e3afb11eb3c170bd6dc5d059035d195f03bc08abeaad96
Opcode Fuzzy Hash: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction Fuzzy Hash: 1E912B32B2864186E764DF39E89066977A0FB94784F405436FE4D97B58DF3DE805CB10

Function 00007FF69E598624 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExW.KERNELBASE ref: 00007FF69E59863D
SizeofResource.KERNEL32 ref: 00007FF69E598659
LoadResource.KERNEL32 ref: 00007FF69E598673
LockResource.KERNEL32 ref: 00007FF69E598685
GlobalAlloc.KERNELBASE ref: 00007FF69E5986A6
GlobalLock.KERNEL32 ref: 00007FF69E5986BB
CreateStreamOnHGlobal.COMBASE ref: 00007FF69E5986E8
GdipAlloc.GDIPLUS ref: 00007FF69E5986FE
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF69E598769
GlobalUnlock.KERNEL32 ref: 00007FF69E59878C
GlobalFree.KERNEL32 ref: 00007FF69E598795

Strings

PNG, xrefs: 00007FF69E59862F

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction ID: 0c6ebcb8a309d08aceffaec00ea1d6e4210a68eaaeed653b13d4348bd8d3e756
Opcode Fuzzy Hash: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction Fuzzy Hash: C3414365E09B0691EF249B16D4A437963A0EF98B90F484475EE0DC7364EF7EE448C320

Function 00007FF69E57F930 Relevance: 17.2, APIs: 8, Strings: 1, Instructions: 1417COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E581239
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E58123F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E581245
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E58124B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E581251
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E581257
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E58125D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E581263

Strings

__tmp_reference_source_, xrefs: 00007FF69E57FCCF, 00007FF69E57FCDE

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: 0b103013559008ad7c4ced657c1ca4236a45656b3d3cf544ff6173fbd4f8462d
Instruction ID: dfa1e3a5447c36f11cc1008ae0a5feb575c4ac646c7f4d127f9ceb85a48b484d
Opcode Fuzzy Hash: 0b103013559008ad7c4ced657c1ca4236a45656b3d3cf544ff6173fbd4f8462d
Instruction Fuzzy Hash: 71E2B962A186C292FA74CB25E1E03FE6761FBA1750F404172EB9D836A5CF3EE455C720

Function 00007FF69E574840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57511E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E575124
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57512A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E575E16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E575E1C

Strings

CMT, xrefs: 00007FF69E5759B2

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: CMT
API String ID: 3668304517-2756464174
Opcode ID: 55bf8bc242d77ff464b4b637a4409c1e03917795df1080568c491ddd117196ec
Instruction ID: f9f151a13a119c8a6dba104908fe026334f7671b0a2992d5b0e325e77caa733f
Opcode Fuzzy Hash: 55bf8bc242d77ff464b4b637a4409c1e03917795df1080568c491ddd117196ec
Instruction Fuzzy Hash: 74E21462B1868296EB34DB75D4A02FD67A1FB64384F408075EB5E83792DF3EE464C320

Function 00007FF69E5840BC Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF69E58410B
FindFirstFileW.KERNELBASE ref: 00007FF69E58415E
GetLastError.KERNEL32 ref: 00007FF69E5841AF
FindNextFileW.KERNEL32 ref: 00007FF69E5841D7
GetLastError.KERNEL32 ref: 00007FF69E5841E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E58430F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E584315

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: 66fe9aa60096915ead2717382f71102c76cb13127cdb9d07ef3d60804a2b80c6
Instruction ID: 52dc0fafe7152f31208cca3af862323a708b63f894b6b1fda14d587faf33e2e5
Opcode Fuzzy Hash: 66fe9aa60096915ead2717382f71102c76cb13127cdb9d07ef3d60804a2b80c6
Instruction Fuzzy Hash: E061C562A18A4681EA20DB28E8E027D6361FBA57B4F105371FEBD836D9DF3DD944C710

Function 00007FF69E575E24 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 586COMMON

Download Yara Rule

Strings

CMT, xrefs: 00007FF69E5759B2, 00007FF69E57675B

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: bb8f32dfb39c41a2f4cffe25f113d86e3364d78267da2167cd0a984ef8db8d77
Instruction ID: eef4a6a49d82507874d5d52cb340b2bdb10feccdc7dea02e779e8f970c8dbcee
Opcode Fuzzy Hash: bb8f32dfb39c41a2f4cffe25f113d86e3364d78267da2167cd0a984ef8db8d77
Instruction Fuzzy Hash: 6D42E462B086819BEB38DB74C1A02FD77A1EB21344F404176EB5ED3696DF7AE528C310

Function 00007FF69E591F20 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a42af491d0f316df573d8ea8d59481ea3cca52ac339acf3c7ff9db876b099fa
Instruction ID: 3d40b89f4e1ec9898deaecefbb86ddcb7ad8f97586f38fa8aebfe5cbf591dcf4
Opcode Fuzzy Hash: 0a42af491d0f316df573d8ea8d59481ea3cca52ac339acf3c7ff9db876b099fa
Instruction Fuzzy Hash: D0E104A2A082828AEB74CF28A0E42BD7791FB64748F454175EB4EC7785DF3EED418714

Function 00007FF69E593484 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3f9089be966249862bf56ce032710d6eb03eb50aa34be6e58aa05575d530c2
Instruction ID: c937213a8fcd8dfea2fcc8957d30832fd2499df23e767a0027f67d184f388c47
Opcode Fuzzy Hash: 8c3f9089be966249862bf56ce032710d6eb03eb50aa34be6e58aa05575d530c2
Instruction Fuzzy Hash: FAB1EFA2B05AC992DE28CB66D6586E9A391F714FC4F888032EE0D8B742DF3DE155C310

Function 00007FF69E584928 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID:
API String ID: 3340455307-0
Opcode ID: d99ac025a94b608eca77987ee7e6c376c25c1b26fb53395ef183edcb2a2d0eda
Instruction ID: dc8a8a1bf0ea5ce9d34358b76e8768a7d67da50280bda9fb6b192ff4f39c8bbd
Opcode Fuzzy Hash: d99ac025a94b608eca77987ee7e6c376c25c1b26fb53395ef183edcb2a2d0eda
Instruction Fuzzy Hash: 97412822B2566286FB74DF22A9A177A2253FBE4784F048031EE4D87794DE3DE842C714

Function 00007FF69E58DFD0 Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF69E58E018
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF69E58E030
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF69E58E05D
CreateFileW.KERNEL32 ref: 00007FF69E58E3F0
SetFilePointer.KERNEL32 ref: 00007FF69E58E40E
ReadFile.KERNEL32 ref: 00007FF69E58E436

Part of subcall function 00007FF69E58DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF69E58DDDF

CompareStringW.KERNELBASE ref: 00007FF69E58E559
CloseHandle.KERNEL32 ref: 00007FF69E58E4F3

Part of subcall function 00007FF69E571FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E571FFB

Part of subcall function 00007FF69E5851A4: GetVersionExW.KERNEL32 ref: 00007FF69E5851D5

Part of subcall function 00007FF69E58DFD0: LoadLibraryExW.KERNELBASE ref: 00007FF69E58DEFF
Part of subcall function 00007FF69E58DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E58DFB5
Part of subcall function 00007FF69E58DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E58DFBB
Part of subcall function 00007FF69E58DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E58DFC1
Part of subcall function 00007FF69E58DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E58DFC7

AllocConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF69E58E74B
GetCurrentProcessId.KERNEL32(?,?,?,00000000,?), ref: 00007FF69E58E755
AttachConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF69E58E75D
GetStdHandle.KERNEL32(?,?,?,00000000,?), ref: 00007FF69E58E780
WriteConsoleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF69E58E799
Sleep.KERNEL32(?,?,?,00000000,?), ref: 00007FF69E58E7A4
FreeConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF69E58E7AA
ExitProcess.KERNEL32 ref: 00007FF69E58E7BB

Strings

ieframe.dll, xrefs: 00007FF69E58E120
srvcli.dll, xrefs: 00007FF69E58E221
cscapi.dll, xrefs: 00007FF69E58E22F
samcli.dll, xrefs: 00007FF69E58E2C9
mpr.dll, xrefs: 00007FF69E58E291
sfc_os.dll, xrefs: 00007FF69E58E091
netapi32.dll, xrefs: 00007FF69E58E16B
dhcpcsvc6.dll, xrefs: 00007FF69E58E31D
dsrole.dll, xrefs: 00007FF69E58E37F
XmlLite.dll, xrefs: 00007FF69E58E339
secur32.dll, xrefs: 00007FF69E58E1CD
clbcatq.dll, xrefs: 00007FF69E58E0E9
ws2_32.dll, xrefs: 00007FF69E58E0FF
wkscli.dll, xrefs: 00007FF69E58E2E5
dwmapi.dll, xrefs: 00007FF69E58E0BD, 00007FF69E58E661
RpcRtRemote.dll, xrefs: 00007FF69E58E363
slc.dll, xrefs: 00007FF69E58E23D
devrtl.dll, xrefs: 00007FF69E58E29F
lpk.dll, xrefs: 00007FF69E58E0D3
dnsapi.DLL, xrefs: 00007FF69E58E259
propsys.dll, xrefs: 00007FF69E58E2AD
samlib.dll, xrefs: 00007FF69E58E2D7
netutils.dll, xrefs: 00007FF69E58E283
shdocvw.dll, xrefs: 00007FF69E58E179
shell32.dll, xrefs: 00007FF69E58E1BF
ntshrui.dll, xrefs: 00007FF69E58E12B
SSPICLI.DLL, xrefs: 00007FF69E58E09C
iphlpapi.DLL, xrefs: 00007FF69E58E267
msasn1.dll, xrefs: 00007FF69E58E195
version.dll, xrefs: 00007FF69E58E07B
DXGIDebug.dll, xrefs: 00007FF69E58E086, 00007FF69E58E5B6
cryptbase.dll, xrefs: 00007FF69E58E0C8
rasadhlp.dll, xrefs: 00007FF69E58E30F
profapi.dll, xrefs: 00007FF69E58E205
usp10.dll, xrefs: 00007FF69E58E0DE
peerdist.dll, xrefs: 00007FF69E58E38D
kernel32, xrefs: 00007FF69E58E011
cryptui.dll, xrefs: 00007FF69E58E1A3
userenv.dll, xrefs: 00007FF69E58E15D
psapi.dll, xrefs: 00007FF69E58E115
comres.dll, xrefs: 00007FF69E58E0F4
SetDllDirectoryW, xrefs: 00007FF69E58E026
aclui.dll, xrefs: 00007FF69E58E371
crypt32.dll, xrefs: 00007FF69E58E187
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF69E58E73B
dhcpcsvc.dll, xrefs: 00007FF69E58E32B
cryptsp.dll, xrefs: 00007FF69E58E355
wintrust.dll, xrefs: 00007FF69E58E1B1
atl.dll, xrefs: 00007FF69E58E136
ws2help.dll, xrefs: 00007FF69E58E10A
uxtheme.dll, xrefs: 00007FF69E58E66D
rsaenh.dll, xrefs: 00007FF69E58E0A7
SetDefaultDllDirectories, xrefs: 00007FF69E58E053
mlang.dll, xrefs: 00007FF69E58E2BB
oleaccrc.dll, xrefs: 00007FF69E58E1E9
browcli.dll, xrefs: 00007FF69E58E301
setupapi.dll, xrefs: 00007FF69E58E141
ntmarta.dll, xrefs: 00007FF69E58E1F7
imageres.dll, xrefs: 00007FF69E58E24B
WINNSI.DLL, xrefs: 00007FF69E58E275
linkinfo.dll, xrefs: 00007FF69E58E347
dfscli.dll, xrefs: 00007FF69E58E2F3
UXTheme.dll, xrefs: 00007FF69E58E0B2
apphelp.dll, xrefs: 00007FF69E58E14F
WindowsCodecs.dll, xrefs: 00007FF69E58E213
cabinet.dll, xrefs: 00007FF69E58E1DB

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 1496594111-2013832382
Opcode ID: 34802ec4308bac0a765840d4883717106c0f60697b5732dd1b55c612bebcfb11
Instruction ID: f116dc7c63ae195f0edb1da7da3842ed62430266978b8e3cfc1e5e0dc654c95f
Opcode Fuzzy Hash: 34802ec4308bac0a765840d4883717106c0f60697b5732dd1b55c612bebcfb11
Instruction Fuzzy Hash: A1323C31E19B8295EB318F20E8A01E933B4FF65354F544276EA4D867A9EF3ED254C360

Function 00007FF69E5898DC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E588E58: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF69E588F8D

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69E589F75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E58A42F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E58A435

Part of subcall function 00007FF69E590BBC: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF69E590B44), ref: 00007FF69E590BE9

Strings

RTL, xrefs: 00007FF69E589F2E
@%s:, xrefs: 00007FF69E589F57
, xrefs: 00007FF69E589DF9
MENU, xrefs: 00007FF69E589DD9
,, xrefs: 00007FF69E589FAA
DIALOG, xrefs: 00007FF69E589DCD
DIRECTION, xrefs: 00007FF69E589DE5
$%s:, xrefs: 00007FF69E589F50
*messages***, xrefs: 00007FF69E589C04
*messages***, xrefs: 00007FF69E589BC6
STRINGS, xrefs: 00007FF69E589DC1

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: eada48ccb5f4113e0e5189e729fba0886f28cfa8a9499ddc0ab41924688ab6bf
Instruction ID: a958045f04200e3f3538cd48bbc09e83e768f48551f2c12af3d02e218092abfd
Opcode Fuzzy Hash: eada48ccb5f4113e0e5189e729fba0886f28cfa8a9499ddc0ab41924688ab6bf
Instruction Fuzzy Hash: EB62C222B2968295EB70DB24C4E42BD3365FB64784F804171FA4E876DAEF3EE544C360

Function 00007FF69E5A1900 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF69E5A1558: DloadProtectSection.DELAYIMP ref: 00007FF69E5A15C9

RaiseException.KERNEL32 ref: 00007FF69E5A19A7
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF69E5A1993

Part of subcall function 00007FF69E5A1868: DloadProtectSection.DELAYIMP ref: 00007FF69E5A18C7

LoadLibraryExA.KERNELBASE ref: 00007FF69E5A1A46
GetLastError.KERNEL32 ref: 00007FF69E5A1A54
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF69E5A1A86
RaiseException.KERNEL32 ref: 00007FF69E5A1A9A

Strings

H, xrefs: 00007FF69E5A1974

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction ID: 15c49c0850a05cb9fafa9fa73de6e9ab80040b74025c839c3a71521119014e44
Opcode Fuzzy Hash: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction Fuzzy Hash: B0917C72E05B569AEB60CF65D9942AC33B1FB28BA4F084075EE0D97744EF39E445C360

Function 00007FF69E59F4E0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF69E59F747
ShowWindow.USER32 ref: 00007FF69E59F786
GetExitCodeProcess.KERNEL32 ref: 00007FF69E59F7BD
CloseHandle.KERNEL32 ref: 00007FF69E59F7E7
ShowWindow.USER32 ref: 00007FF69E59F83F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59F8FB

Strings

p, xrefs: 00007FF69E59F529
.exe, xrefs: 00007FF69E59F7F2
.inf, xrefs: 00007FF69E59F675
Install, xrefs: 00007FF69E59F684

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 1054546013-3607691742
Opcode ID: db8ecbd514ff322f29a974296a08b1056670a56b0f2c036ad5285174391dee78
Instruction ID: 1769c9d775b1e99988f9b0b244cd494e6dd2f19ae1e1e67a0f6572b6cf8f73fc
Opcode Fuzzy Hash: db8ecbd514ff322f29a974296a08b1056670a56b0f2c036ad5285174391dee78
Instruction Fuzzy Hash: 4BC172A2F18A0295FB60DB65D9E02B92371FFA5784F4440B1EA4DC76A5DF3EE4918330

Function 00007FF69E59F0A4 Relevance: 16.6, APIs: 11, Instructions: 102
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF69E59AE1C: PeekMessageW.USER32 ref: 00007FF69E59AE32
Part of subcall function 00007FF69E59AE1C: GetMessageW.USER32 ref: 00007FF69E59AE49
Part of subcall function 00007FF69E59AE1C: IsDialogMessageW.USER32 ref: 00007FF69E59AE60
Part of subcall function 00007FF69E59AE1C: TranslateMessage.USER32 ref: 00007FF69E59AE6F
Part of subcall function 00007FF69E59AE1C: DispatchMessageW.USER32 ref: 00007FF69E59AE7A

GetDlgItem.USER32 ref: 00007FF69E59F0E3
ShowWindow.USER32 ref: 00007FF69E59F109
SendMessageW.USER32 ref: 00007FF69E59F11E
SendMessageW.USER32 ref: 00007FF69E59F136
SendMessageW.USER32 ref: 00007FF69E59F157
SendMessageW.USER32 ref: 00007FF69E59F173
SendMessageW.USER32 ref: 00007FF69E59F1B6
SendMessageW.USER32 ref: 00007FF69E59F1D4
SendMessageW.USER32 ref: 00007FF69E59F1E8
SendMessageW.USER32 ref: 00007FF69E59F212
SendMessageW.USER32 ref: 00007FF69E59F22A

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 3569833718-0
Opcode ID: 6d17268858d6b6aed380ad60cc2cf8b16547cb3a0c40a3112c59011326a33119
Instruction ID: a458dbd9bc4969b115c70a7ec5b1803f44196548afa6588c86cbb4cf1c10fa14
Opcode Fuzzy Hash: 6d17268858d6b6aed380ad60cc2cf8b16547cb3a0c40a3112c59011326a33119
Instruction Fuzzy Hash: C5410435F14A0286F720CF61EC60BB92360FB55B88F445076ED0A47B94CE3EE4858760

Function 00007FF69E57EF10 Relevance: 11.0, APIs: 7, Instructions: 453COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57F542
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57F548
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57F554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57F55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57F560
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57F56C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57F572

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: f0ceac670109cddac8d87af407790801409e6a3541c24d556b6e5f57a5733dbb
Instruction ID: 0b8038592940133439dd5cbebaae84a4c0ac1207c0937335c1cbfbaf13f08ae6
Opcode Fuzzy Hash: f0ceac670109cddac8d87af407790801409e6a3541c24d556b6e5f57a5733dbb
Instruction Fuzzy Hash: FD12F462F1874185EB30CB64D4A42AC2372FB657A8F408276EE5C97AE5DF3ED495C320

Function 00007FF69E5824C0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF69E58259B
GetLastError.KERNEL32 ref: 00007FF69E5825AE
CreateFileW.KERNEL32 ref: 00007FF69E58260E
GetLastError.KERNEL32 ref: 00007FF69E582617
SetFileTime.KERNEL32 ref: 00007FF69E5826C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E582736

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 457c136b954a564df8b26438416fd4b17eefbc135de7b21dacf5200ecc0fc64e
Instruction ID: e3083c8a0ccff43e6bc64977a11bbccfc7eccd2386aae5f21e14f4b4546593f9
Opcode Fuzzy Hash: 457c136b954a564df8b26438416fd4b17eefbc135de7b21dacf5200ecc0fc64e
Instruction Fuzzy Hash: E161E566E1864186E7308B29E59036E6BB1FB987A8F101334EFAD43AD4DF3ED054C710

Function 00007FF69E59FD0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF69E59FD43
SetEnvironmentVariableW.KERNELBASE ref: 00007FF69E59FDBC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59FE1B

Strings

sfxcmd, xrefs: 00007FF69E59FD3C
sfxpar, xrefs: 00007FF69E59FDB5

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: 48e58e823320ee2e30a8ba7f247afa82eb81b269a21fe23b9d6641b37ea74fe4
Instruction ID: 3f38dafc35ddc71d57b4e6350752abcf9910aff0b9b82344da76830676531876
Opcode Fuzzy Hash: 48e58e823320ee2e30a8ba7f247afa82eb81b269a21fe23b9d6641b37ea74fe4
Instruction Fuzzy Hash: 8D319C72E14B0684EB208B65E8E41BC2371FB68B98F541171EA1D977A9DE39D041C364

Function 00007FF69E59B014 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF69E59B02A
GetObjectW.GDI32 ref: 00007FF69E59B05B
DeleteObject.GDI32 ref: 00007FF69E59B095
DeleteObject.GDI32 ref: 00007FF69E59B0C5

Part of subcall function 00007FF69E598624: FindResourceExW.KERNELBASE ref: 00007FF69E59863D
Part of subcall function 00007FF69E598624: SizeofResource.KERNEL32 ref: 00007FF69E598659
Part of subcall function 00007FF69E598624: LoadResource.KERNEL32 ref: 00007FF69E598673
Part of subcall function 00007FF69E598624: LockResource.KERNEL32 ref: 00007FF69E598685
Part of subcall function 00007FF69E598624: GlobalAlloc.KERNELBASE ref: 00007FF69E5986A6
Part of subcall function 00007FF69E598624: GlobalLock.KERNEL32 ref: 00007FF69E5986BB
Part of subcall function 00007FF69E598624: CreateStreamOnHGlobal.COMBASE ref: 00007FF69E5986E8
Part of subcall function 00007FF69E598624: GdipAlloc.GDIPLUS ref: 00007FF69E5986FE
Part of subcall function 00007FF69E598624: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF69E598769
Part of subcall function 00007FF69E598624: GlobalUnlock.KERNEL32 ref: 00007FF69E59878C
Part of subcall function 00007FF69E598624: GlobalFree.KERNEL32 ref: 00007FF69E598795

Strings

], xrefs: 00007FF69E59B063

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Global$Resource$Object$AllocBitmapCreateDeleteGdipLoadLock$FindFreeFromSizeofStreamUnlock
String ID: ]
API String ID: 3561356813-3352871620
Opcode ID: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction ID: 84578f9fb8f8475c6a9d0a7baafa044f4ced3d6bde200599cb7818132703e06c
Opcode Fuzzy Hash: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction Fuzzy Hash: FA11B965F0934241FA749B11A6E43B95391EFA8BC4F4840B4F91D87B99DF2EE8448710

Function 00007FF69E59AE1C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF69E59AE32
GetMessageW.USER32 ref: 00007FF69E59AE49
IsDialogMessageW.USER32 ref: 00007FF69E59AE60
TranslateMessage.USER32 ref: 00007FF69E59AE6F
DispatchMessageW.USER32 ref: 00007FF69E59AE7A

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction ID: 9d2ac0c50b7a8db4d280ca2915d54c480fa5ff21d99cbba637d4f51256f54a9a
Opcode Fuzzy Hash: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction Fuzzy Hash: CEF03C29F3894282FB609B64E8E5A762361FFE0B05FC09072F54EC1854DF2ED548CB20

Function 00007FF69E5991E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF69E599211
SHAutoComplete.SHLWAPI ref: 00007FF69E599255

Part of subcall function 00007FF69E5913C4: CompareStringW.KERNEL32 ref: 00007FF69E5913E3

FindWindowExW.USER32 ref: 00007FF69E59923F

Strings

EDIT, xrefs: 00007FF69E59921B, 00007FF69E599233

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction ID: a9206f38b64a9859d62cf9cde4577e244f0f00378245ccc23b7ec4faa53348f9
Opcode Fuzzy Hash: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction Fuzzy Hash: AB016261F18A4781FE309B21A8B03F563A0EFB8740F885071E94D86755DE2ED1498760

Function 00007FF69E582CE0 Relevance: 6.1, APIs: 4, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(00007FF69E588C9A), ref: 00007FF69E582D22
WriteFile.KERNEL32 ref: 00007FF69E582D6C
WriteFile.KERNELBASE ref: 00007FF69E582D9A

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: c0878563cb540de980db5307815f43949119fc8f7ca07e724854b0feeef95fd0
Instruction ID: 896160aeb64b17fef405903d1b6658c47039b89ed97f00080a0ed9e27fbb6947
Opcode Fuzzy Hash: c0878563cb540de980db5307815f43949119fc8f7ca07e724854b0feeef95fd0
Instruction Fuzzy Hash: D8511826B2964292FA70CB25D4A477A2750FF68B90F445172FA0E87AD0DF3EE485C320

Function 00007FF69E5A03E0 Relevance: 6.1, APIs: 4, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowTextW.USER32 ref: 00007FF69E5A0556
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5A05C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5A05C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5A05CD

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$TextWindow
String ID:
API String ID: 2912839123-0
Opcode ID: 5bbef335480f89d9103c2d41cda01abea0e825fa5e52d7f7b27aac393a9d4e81
Instruction ID: a824ac0a447c927d195a22810cc752d782df8ff681014da2445a6a5f39f4a92d
Opcode Fuzzy Hash: 5bbef335480f89d9103c2d41cda01abea0e825fa5e52d7f7b27aac393a9d4e81
Instruction Fuzzy Hash: 7851B462F6465185FF209B64D8A53AD2322FF69BA4F400276FA1C96BD6DF6ED440C330

Function 00007FF69E5A2D6C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF69E5A2D7B

Part of subcall function 00007FF69E5A27FC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF69E5A281E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF69E5A2D90
__scrt_release_startup_lock.LIBCMT ref: 00007FF69E5A2DFE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF69E5A2E51

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction ID: 1d86b2f40966d7cac1ce14fecbeed5ad6845487cae1cc13b52f4409006eec011
Opcode Fuzzy Hash: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction Fuzzy Hash: 8D314C24E8C24352FA34AB64D5F23BA1391EF68764F4454B4F90ECB6D3DE2EA445C270

Function 00007FF69E583684 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,00000000,?,00007FF69E58309D), ref: 00007FF69E5836CE
CreateDirectoryW.KERNEL32 ref: 00007FF69E583733
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF69E58309D), ref: 00007FF69E583791
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5837CE

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: a981d72998619812671fb74e2af9e44be046492d5270f9ab3d6661079687cefa
Instruction ID: b0df261f1fb6c050bf80b28da1d6766ee770b9f71f5694b7d188e824d67b78c9
Opcode Fuzzy Hash: a981d72998619812671fb74e2af9e44be046492d5270f9ab3d6661079687cefa
Instruction Fuzzy Hash: 3331D322E2C68281EA309B25A4E42796351FFA87A0F540271FECDC26D6DF3ED5458620

Function 00007FF69E582320 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF69E582927,?,00100000,?,00000001,00000000,00000000,?,00007FF69E5814C1), ref: 00007FF69E582348
ReadFile.KERNELBASE ref: 00007FF69E582367
GetLastError.KERNEL32 ref: 00007FF69E58239B
GetLastError.KERNEL32 ref: 00007FF69E5823BA

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction ID: b0a98d42f5d2fdf279d8e151df67f18d4cd0b93ec200cded75e562d3e7663444
Opcode Fuzzy Hash: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction Fuzzy Hash: 0621D426E2CA0282EA305F11A4B023D6BA0FB79B94F244570FA5DC6684CF3ED885C730

Function 00007FF69E58E948 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E58ECD8: ResetEvent.KERNEL32 ref: 00007FF69E58ECF1
Part of subcall function 00007FF69E58ECD8: ReleaseSemaphore.KERNEL32 ref: 00007FF69E58ED07

ReleaseSemaphore.KERNEL32 ref: 00007FF69E58E974
CloseHandle.KERNELBASE ref: 00007FF69E58E993
DeleteCriticalSection.KERNEL32 ref: 00007FF69E58E9AA
CloseHandle.KERNEL32 ref: 00007FF69E58E9B7

Part of subcall function 00007FF69E58EA5C: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF69E58E95F,?,?,?,00007FF69E58463A,?,?,?), ref: 00007FF69E58EA63
Part of subcall function 00007FF69E58EA5C: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF69E58E95F,?,?,?,00007FF69E58463A,?,?,?), ref: 00007FF69E58EA6E

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction ID: c6743cdda1babc80385f718d25fc8f30868f76cd2a52609f95491343b81e00e6
Opcode Fuzzy Hash: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction Fuzzy Hash: 71014433E19A91A2E654DB21D99426D7330FB98BC0F045071EB5D43615CF3AE4B5C750

Function 00007FF69E58EAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF69E58EAE0
SetThreadPriority.KERNEL32 ref: 00007FF69E58EB36

Strings

CreateThread failed, xrefs: 00007FF69E58EAEE

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction ID: bbc5109038a786aa21aefee440e67edd6ac074561cf0d29ad609524252ee2a4a
Opcode Fuzzy Hash: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction Fuzzy Hash: F3118231A19A4292E720DB10E8E11797371FBA4788F5881B2F64D83668DF3EE591C720

Function 00007FF69E59946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E58DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF69E58DDDF

OleInitialize.OLE32 ref: 00007FF69E599486
SHGetMalloc.SHELL32 ref: 00007FF69E5994D4

Strings

riched20.dll, xrefs: 00007FF69E599475

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: b1936b3f38021c99ecd6522b050f6163774a90ef7a51b133bb98bdb322c125e4
Instruction ID: d9d8f9e8bb1f9785d2f2e4a8ddb25b5dfd917c56d88a1d43e04cf339458e140a
Opcode Fuzzy Hash: b1936b3f38021c99ecd6522b050f6163774a90ef7a51b133bb98bdb322c125e4
Instruction Fuzzy Hash: 4AF06875A18A4182E7209F60F4A516E73A0FF58754F444176F58D82754DF7DD18DCB10

Function 00007FF69E59095C Relevance: 4.7, APIs: 3, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E59853C: GlobalMemoryStatusEx.KERNEL32 ref: 00007FF69E59856C

Part of subcall function 00007FF69E58AAE0: LoadStringW.USER32 ref: 00007FF69E58AB67
Part of subcall function 00007FF69E58AAE0: LoadStringW.USER32 ref: 00007FF69E58AB80

Part of subcall function 00007FF69E571FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E571FFB

Part of subcall function 00007FF69E57129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF69E571396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5A01BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5A01C1
SendDlgItemMessageW.USER32 ref: 00007FF69E5A01F2

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LoadString$Concurrency::cancel_current_taskGlobalItemMemoryMessageSendStatus
String ID:
API String ID: 3106221260-0
Opcode ID: 45fd903f6b2aec8c71a10246635352740a8ca63c8d8b2cd055e955d931041677
Instruction ID: 4d518fd202fc6e8f4076f11642b1bd72188c01f17c103fb96490aac17d21c4d3
Opcode Fuzzy Hash: 45fd903f6b2aec8c71a10246635352740a8ca63c8d8b2cd055e955d931041677
Instruction Fuzzy Hash: 0651F462F5464296FB20ABB1D4A12FD2322EBA9BD4F404176FE0D977D6DE2ED500C360

Function 00007FF69E582134 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF69E5821CF
CreateFileW.KERNEL32 ref: 00007FF69E58223C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5822D8

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: 3b1c5875d2376cde5b1bec2bbb6cafe0f549f25560c923a31bace2492b4c6367
Instruction ID: eaf11c3f14a21ddbc24725d799474bb80cb0df6cc99a116a971a7c23c8a65db2
Opcode Fuzzy Hash: 3b1c5875d2376cde5b1bec2bbb6cafe0f549f25560c923a31bace2492b4c6367
Instruction Fuzzy Hash: 2C410677A1878582EB348B15E4A426967A0FB987B4F105370EFAD43AD5CF3EE490C710

Function 00007FF69E5723F8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF69E57243E
GetWindowTextW.USER32 ref: 00007FF69E572476
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E572505

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 107cbe78643896cd277503af9d79c84134f19e12336bfdef765791961383781f
Instruction ID: f4417487b5e8e7834df9146e23df1c6ad63c259aaa115bdad167c761e0ff6aea
Opcode Fuzzy Hash: 107cbe78643896cd277503af9d79c84134f19e12336bfdef765791961383781f
Instruction Fuzzy Hash: 6821C272A28B8181EA208B25A49017AB361FB9DBE0F144232FF9D43BA5DF3DD090C740

Function 00007FF69E591F94 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69E59205B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69E592077
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69E592093

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 7fdfb8b08260a68de66ecd622df27e98485fdb680c183650925e5cdb3d7d3185
Instruction ID: 6fb0bce015422b6cb8be033a048628f157e2d59c4245ec0afb605eae3b830c4c
Opcode Fuzzy Hash: 7fdfb8b08260a68de66ecd622df27e98485fdb680c183650925e5cdb3d7d3185
Instruction Fuzzy Hash: AA310752A0C69651FB349710F4E83F963A0FB64784F844071F28C86AA9DF7EE986C321

Function 00007FF69E583D34 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,00000000,00000001,?,00007FF69E5907E1), ref: 00007FF69E583D5E
SetFileAttributesW.KERNEL32 ref: 00007FF69E583DB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E583E1A

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 9ad1da1d281fb88a90e37ecd930f681ad4649b1953909ec7c8adb17a28908e15
Instruction ID: bc19c7fb596fd18a6d9e6f74a91b146184e05246fa072e7bd1872c303556ea49
Opcode Fuzzy Hash: 9ad1da1d281fb88a90e37ecd930f681ad4649b1953909ec7c8adb17a28908e15
Instruction Fuzzy Hash: 1221F822B1868181EE308B25E8E526D6361FF98BD4F005270FA9E83695DF3DD541CA10

Function 00007FF69E5831BC Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00007FF69E590822), ref: 00007FF69E5831E7
DeleteFileW.KERNEL32 ref: 00007FF69E583237
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5832A1

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 72c673f2880adfe6ea93f0d9f4cbebf29628e435fcdd813aa7a5852a82454db7
Instruction ID: b269f18c6eaa5237ba291ba085561533bab0f20ad5ef00a16ca29e503051cb17
Opcode Fuzzy Hash: 72c673f2880adfe6ea93f0d9f4cbebf29628e435fcdd813aa7a5852a82454db7
Instruction Fuzzy Hash: E621C822E2878181EE30CB25F4A526E6360FFA8BD4F501271FADE82A95DF3DD540C720

Function 00007FF69E5832BC Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00007FF69E58E5B1,?,?,?,00000000,?), ref: 00007FF69E5832E7
GetFileAttributesW.KERNELBASE ref: 00007FF69E583334
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E583399

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 40ad9405655d088623e5613f9ff1dd24c057f9c22428089c7716efbf5db7ae43
Instruction ID: 7fd029d46bcd7d86ee31f35c5d9ec7405f14f6d936c0546ecdbad1934fa208ff
Opcode Fuzzy Hash: 40ad9405655d088623e5613f9ff1dd24c057f9c22428089c7716efbf5db7ae43
Instruction Fuzzy Hash: A221C832A2878182EA308B28F49512D6361FBE9BA4F101371FA9D83BE5DF3DD440CB10

Function 00007FF69E5ABF64 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF69E5ABF48), ref: 00007FF69E5ABF8C
TerminateProcess.KERNEL32(?,?,?,00007FF69E5ABF48), ref: 00007FF69E5ABF97
ExitProcess.KERNEL32 ref: 00007FF69E5ABFA6

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction ID: 5836dc5535dbe12938c542be9e058a2433c10192559bdfca6f45873ee7211844
Opcode Fuzzy Hash: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction Fuzzy Hash: 5DE01A28E4430546EAB46B2198E53792352EFA8B51F1854B8E80A82396CE3EA4098671

Function 00007FF69E57F578 Relevance: 3.2, APIs: 2, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57F895
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57F89B

Part of subcall function 00007FF69E583EC8: FindClose.KERNELBASE(?,?,00000000,00007FF69E590811), ref: 00007FF69E583EFD

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: 44abb0682f967f460a7072b25e4fa972253f86b985b214d6bbaaf9474643afb7
Instruction ID: 26fb96561f92f8a1f1b1402f02f872603f93b358a1f05c8265100934825c8aec
Opcode Fuzzy Hash: 44abb0682f967f460a7072b25e4fa972253f86b985b214d6bbaaf9474643afb7
Instruction Fuzzy Hash: 5D91E273A18B8190EB20DF24D4D42AD6361FBA4798F908176FA4C87AE9DF7ED551C320

Function 00007FF69E573904 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E573AB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E573AB9

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 201b90534166b8da7461634ac6a816a56932a3fdfe7bfd1a1f820e126a9c965b
Instruction ID: 464184a73c5733d039c1592fc0afae7b90f2c15f664f5f75a1a002e2f6e0354e
Opcode Fuzzy Hash: 201b90534166b8da7461634ac6a816a56932a3fdfe7bfd1a1f820e126a9c965b
Instruction Fuzzy Hash: 61410562F1465184FB20DB71D4A12EC2320EF64BE8F148175FE5DA7ADACE3AD552C320

Function 00007FF69E582778 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,00000F99,?,00007FF69E58274D), ref: 00007FF69E5828A9
GetLastError.KERNEL32(?,00007FF69E58274D), ref: 00007FF69E5828B8

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction ID: 872a097660f616a5f27e044851d471c4ed38b3ed612893e2ddad963cc1804b72
Opcode Fuzzy Hash: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction Fuzzy Hash: 5F31F826F2974286EE704B6AD5D06B52750EF28BD4F141171FE1D87790DE3EE441CB60

Function 00007FF69E571474 Relevance: 3.1, APIs: 2, Instructions: 90COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF69E5715A3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5715A9

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 8daf687ad688f16a09269b498f1d42b7f5edb35663fb3cc122c6a0ab6a165668
Instruction ID: c69b929a83b75af505d9250a0fbaed238e778429e0fd5bb71c692025dc863080
Opcode Fuzzy Hash: 8daf687ad688f16a09269b498f1d42b7f5edb35663fb3cc122c6a0ab6a165668
Instruction Fuzzy Hash: 93315661B1464685EE289B5296901786391EB14FF0F588671FB3E87BD5EE3FE0A1C320

Function 00007FF69E5722BC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF69E5722F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5723F0

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: 5a2890223aea6d88e53338121990f25a14a9249d0429ebf34ef8f54134bab86e
Instruction ID: 2aef6c7d7b9ab17dd75cb292de0ea697a8fa93fe2b166666ac95deeed9051682
Opcode Fuzzy Hash: 5a2890223aea6d88e53338121990f25a14a9249d0429ebf34ef8f54134bab86e
Instruction Fuzzy Hash: 0D31F262A1974182EA308B15F4A537EB360EBA8790F448231FB9C47BE5DF3EE090C710

Function 00007FF69E582AD0 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF69E582AFE
SetFileTime.KERNELBASE ref: 00007FF69E582B9B

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction ID: 9badeae0a5437e1fdd75e2842900b24314e90731003726454094652c95da867c
Opcode Fuzzy Hash: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction Fuzzy Hash: AB21F426F2EB4651EA728E11D4A43BA6B94EF29795F1440B1EE4C43291EE3ED886C310

Function 00007FF69E58AAE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF69E58AB67
LoadStringW.USER32 ref: 00007FF69E58AB80

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction ID: aa7e9474f17a4af7a910fe0b93a0d69b8ad9debf8ab968d7841cdbb79e242580
Opcode Fuzzy Hash: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction Fuzzy Hash: 9911DD78B0961186EB609F06A8A006877A2FBA8FC0F948476EE0DD3721DF3DE5808354

Function 00007FF69E582BB0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF69E582C11
GetLastError.KERNEL32 ref: 00007FF69E582C1E

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction ID: 17667bbe590d66accc3660ec53cd20ad536af5516a7858582d7a7a98bcbc01d1
Opcode Fuzzy Hash: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction Fuzzy Hash: B311A235A1864191EB708B25E8D42796660FB68BB4F544371FB7D822D4CF3ED992C310

Function 00007FF69E57255C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E58A4AC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69E58A504
Part of subcall function 00007FF69E58A4AC: SetDlgItemTextW.USER32 ref: 00007FF69E58A573
Part of subcall function 00007FF69E58A4AC: GetWindowRect.USER32 ref: 00007FF69E58A5AD
Part of subcall function 00007FF69E58A4AC: GetClientRect.USER32 ref: 00007FF69E58A5BB

GetDlgItem.USER32 ref: 00007FF69E5725AC
SetWindowTextW.USER32 ref: 00007FF69E5725C8

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ItemRectTextWindow$Clientswprintf
String ID:
API String ID: 3322643685-0
Opcode ID: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction ID: c5db17222ad79d74488c51474c12df5d9b737bf5d7bac3a2d9ccb269712d64b7
Opcode Fuzzy Hash: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction Fuzzy Hash: 9901B554E1E25A41FF755752A0F42791351DF69740F0880B1F80D8A2DEEE2FE4D4C320

Function 00007FF69E58EB58 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF69E58EBAD,?,?,?,?,00007FF69E585752,?,?,?,00007FF69E5856DE), ref: 00007FF69E58EB5C
GetProcessAffinityMask.KERNEL32 ref: 00007FF69E58EB6F

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction ID: a1afacad1c872610ce40cf854280cca6b805808295fbd2ac63795a19491320bc
Opcode Fuzzy Hash: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction Fuzzy Hash: 2BE02B61F2458642DF288F55C8A14E973A2FFD8B40B849036F60BC3614EE2DE1458B00

Function 00007FF69E5A21D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF69E5A2200

Part of subcall function 00007FF69E5A2F7C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69E5A2F85

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF69E5A2206

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 14867973fed18b2c44dc58e1bcd5f94848bfca26dcf41195b9c376eff134a452
Instruction ID: 112654e1b54343f63ac9d09c2abca45c5fac7a63aea9f4c44353ad72663944a0
Opcode Fuzzy Hash: 14867973fed18b2c44dc58e1bcd5f94848bfca26dcf41195b9c376eff134a452
Instruction Fuzzy Hash: 17E0EC44E8D10B41FA7822611AF71B40040CF7D370E1857B0FA3EC42C2AE1EA4A1C170

Function 00007FF69E5AD90C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF69E5AD922
GetLastError.KERNEL32 ref: 00007FF69E5AD934

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction ID: 6bc52b07fdddc1a1aa0a07c0005373eedc9be47644aabf6ff6b8965210e4b75e
Opcode Fuzzy Hash: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction Fuzzy Hash: 61E0E651E4950746FF347BB258E52B81291DFB4769B0850B4E90DC7252EE3ED4C58730

Function 00007FF69E5733E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57388C

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 8973f6dd9431ba46d3bf1a88a46cf03a2367f8849ffb2f85ec4e02e103e92b3e
Instruction ID: 3e7662507b5ad0106358482737c8b775207fca74ddf40418e9297bd9604fbfab
Opcode Fuzzy Hash: 8973f6dd9431ba46d3bf1a88a46cf03a2367f8849ffb2f85ec4e02e103e92b3e
Instruction Fuzzy Hash: A9D1DD72B0968155EB388B2595E02BD67A1FB25B94F0480B5EB5D877A2CF3FF5708320

Function 00007FF69E585294 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E58551B

Part of subcall function 00007FF69E5913F4: CompareStringW.KERNEL32 ref: 00007FF69E59145A

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1017591355-0
Opcode ID: a143f18b4ccf410723d5b55495dd87be6177e3dd9b35435d6782b563dee17ef9
Instruction ID: ca6be02bfa91d45d56fa3ba617a55b0d3993990ec0ed697cacb7aa643d8bc2da
Opcode Fuzzy Hash: a143f18b4ccf410723d5b55495dd87be6177e3dd9b35435d6782b563dee17ef9
Instruction Fuzzy Hash: 35614491E2C24781FA709E2684B527E62B1EF71BD0F1450B1FE4DC6AE5EE6FE4418230

Function 00007FF69E591870 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E58E948: ReleaseSemaphore.KERNEL32 ref: 00007FF69E58E974
Part of subcall function 00007FF69E58E948: CloseHandle.KERNELBASE ref: 00007FF69E58E993
Part of subcall function 00007FF69E58E948: DeleteCriticalSection.KERNEL32 ref: 00007FF69E58E9AA
Part of subcall function 00007FF69E58E948: CloseHandle.KERNEL32 ref: 00007FF69E58E9B7

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E591ACB

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteReleaseSectionSemaphore_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 904680172-0
Opcode ID: 83a8608da7dc23804aca21668a1faaf692e5e9dd69844c9f3465cc8d5fef8d50
Instruction ID: af3dfeb8ad9e037763ee2212c3917ac76da80338b70a38cd95dbb6eef0278fc9
Opcode Fuzzy Hash: 83a8608da7dc23804aca21668a1faaf692e5e9dd69844c9f3465cc8d5fef8d50
Instruction Fuzzy Hash: E261B2A2B1569591EE28DB65D6A40FC7365FF50B90F944172F72D8BAC1CF2AE870C310

Function 00007FF69E57EC9C Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57EEB8

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d3e9fa35f1103ad580ad4f8a12127b3ececafcbd4c14c285a9c87c65cd680fd4
Instruction ID: fa1aec544758833a10e0d7783a9769e58660f4b60d7ecc743fec6b81efd2a9f9
Opcode Fuzzy Hash: d3e9fa35f1103ad580ad4f8a12127b3ececafcbd4c14c285a9c87c65cd680fd4
Instruction Fuzzy Hash: 8651D162A0878280FE249B25D4E53AD2751FBA5BD4F44817AFE4D87392CE3FE495C320

Function 00007FF69E57E7A8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E583EC8: FindClose.KERNELBASE(?,?,00000000,00007FF69E590811), ref: 00007FF69E583EFD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57E993

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: b25a0dcdf97d563b9153ddc70198164d8453106f1b1cd9031932cf08272d4a92
Instruction ID: 1599eac070163ea6d95472ce137ef5feb383934c9e656eca7de3b7938dfb5920
Opcode Fuzzy Hash: b25a0dcdf97d563b9153ddc70198164d8453106f1b1cd9031932cf08272d4a92
Instruction Fuzzy Hash: A0517F22A1878682FB708F25D4E536D2361FBA4B84F448176FA8D876A5DF3FD851C720

Function 00007FF69E581794 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E58187D

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 2ab291a55beab11c367d4576895bfd1e9e111fb744aff405aebdba5253b71b00
Instruction ID: 8fe966eb59442f634f660499a586ca625e1b5c2e15943f22f032cf67c7b663ff
Opcode Fuzzy Hash: 2ab291a55beab11c367d4576895bfd1e9e111fb744aff405aebdba5253b71b00
Instruction Fuzzy Hash: 6C410862B28A8142EA249A17AA91379A351FF94FC0F448475FF4C87F5ADF3DD4518700

Function 00007FF69E582F58 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5830C8

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: f5994b23863df56f13e19732c7b5392fac300bbdca5fd5cc38b58261a4c2634e
Instruction ID: 6d0a9d4a1e3544aa45bd8c7acc7caa5d08616b4a187393fe6ed1760da5f37f10
Opcode Fuzzy Hash: f5994b23863df56f13e19732c7b5392fac300bbdca5fd5cc38b58261a4c2634e
Instruction Fuzzy Hash: 0E412922A2870180EF349B29E1E53792361EFA5BD4F041175FA4D877AADF3EE440C720

Function 00007FF69E5ABDF8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF69E5ABE20

Part of subcall function 00007FF69E5ABFB0: GetModuleHandleExW.KERNEL32 ref: 00007FF69E5ABFD0
Part of subcall function 00007FF69E5ABFB0: GetProcAddress.KERNEL32 ref: 00007FF69E5ABFE6
Part of subcall function 00007FF69E5ABFB0: FreeLibrary.KERNEL32 ref: 00007FF69E5AC00B

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction ID: 5b9dc63cfb193f14b54e19ff528f89c4b3bdfa177d31887e33bef7f20fc46d2b
Opcode Fuzzy Hash: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction Fuzzy Hash: AF419D21E5864292EBB49B11D4F02782761EF74B50F4454B6FA0D876A1DF3FE88087B0

Function 00007FF69E57129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF69E571396

Part of subcall function 00007FF69E571F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69E571F89

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: 5c3fc0f1720a62962cfd68d86af4f4fa3b997526018769ff33dab12e8b863651
Instruction ID: 3cdab5a58355aba3cb2fa4d8c5bc5abb9e84b2f1c44ed5eff17f7c9d38d8772e
Opcode Fuzzy Hash: 5c3fc0f1720a62962cfd68d86af4f4fa3b997526018769ff33dab12e8b863651
Instruction Fuzzy Hash: 5A219522A0875185EA249F52A69027D6250FB24BF0F584770EF7EC7BD1DE7FE0618364

Function 00007FF69E5B124C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E5B1280

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction ID: 9493f6e4d19e62f21fd315e97e59448e6accb6412bbbfa68f370746e62f7ea37
Opcode Fuzzy Hash: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction Fuzzy Hash: F8115E32D1C64286F7709F52A5E0639B2A4FF60380F5801B5FA8DC7695DF2EE8408724

Function 00007FF69E573AD8 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E573B6C

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d36793c31387f104dd38dd6a9dfed600e2c4ae88e6f2c17daf49c6767410ecdf
Instruction ID: ddecd96c0f5e4727144b4886bbed9293c897eb434c85e1143eba9a8bd01fadb8
Opcode Fuzzy Hash: d36793c31387f104dd38dd6a9dfed600e2c4ae88e6f2c17daf49c6767410ecdf
Instruction Fuzzy Hash: 0D01C462E1868581EA319729E4E12297361FFE9BA0F409271FA9C47AA6DF2ED1408714

Function 00007FF69E5A1558 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF69E5A1604: GetModuleHandleW.KERNEL32(?,?,?,00007FF69E5A1573,?,?,?,00007FF69E5A192A), ref: 00007FF69E5A162B

DloadProtectSection.DELAYIMP ref: 00007FF69E5A15C9

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 902d746097657f35995c40355b3f554eba39218e3fb79a70aefbb70b68ceb6fd
Instruction ID: b455c3858959001f41faea766a853fe9345ff7dd404ac8ffa7ffa75659ee88c4
Opcode Fuzzy Hash: 902d746097657f35995c40355b3f554eba39218e3fb79a70aefbb70b68ceb6fd
Instruction Fuzzy Hash: 1B11BEA4D4850761FB70AB19E9E03701350EF38358F1401F5F90DC63A1EE3EA495CA70

Function 00007FF69E583EC8 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E5840BC: FindFirstFileW.KERNELBASE ref: 00007FF69E58410B
Part of subcall function 00007FF69E5840BC: FindFirstFileW.KERNELBASE ref: 00007FF69E58415E
Part of subcall function 00007FF69E5840BC: GetLastError.KERNEL32 ref: 00007FF69E5841AF

FindClose.KERNELBASE(?,?,00000000,00007FF69E590811), ref: 00007FF69E583EFD

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction ID: 4d741b2a20b8602f9edf88fc3b7f2cd3f274762ee5707d558231d74fd3f3709b
Opcode Fuzzy Hash: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction Fuzzy Hash: 70F0A46291824185EA20AB75A1911793760DB25BB4F1413B4FA3D472C7CE2DD844C765

Function 00007FF69E58273C Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF69E582755

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 7793d0dfaf1bed477703e517dfb550f1e48d00439aedf8bd4eeb9f79e866bcb3
Instruction ID: a79e4b2cb1433a66d1abd469ec3887d78820400bedf46bbbc96d4fd34b561cb1
Opcode Fuzzy Hash: 7793d0dfaf1bed477703e517dfb550f1e48d00439aedf8bd4eeb9f79e866bcb3
Instruction Fuzzy Hash: EFE0C216F2051582FF30AB3BC8A26791320EF9CFC4B4820B0EE4C87361CE3AD481CA10

Function 00007FF69E582490 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF69E5824A2

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction ID: 61b97c1b88491903d85fddb310b3d9fc7a2132590409bfa727134b60ee268ac5
Opcode Fuzzy Hash: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction Fuzzy Hash: 6AD0C92AE19841D2E920967598A103C2250EFA6735FA427A1E63EC16E1CE1E9496A231

Function 00007FF69E587FC4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF69E587FD2

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction ID: 310b94209f6f42396e1d8c6808bd57214beee4f1c587b7683b4cca7c7bb95f73
Opcode Fuzzy Hash: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction Fuzzy Hash: BCC08C21F19902C1DA189B26C8D902813A4FB60B04B644074E10CC1130CE2ECAEA9355

Function 00007FF69E5AFA04 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF69E5AFA59

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction ID: 51d4a2ee7a84c26000ec242026e70313a137a9752f55c4767af0a549ded487fa
Opcode Fuzzy Hash: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction Fuzzy Hash: 60F06D54B8960745FEB45E6199F13F41290EF79BA4F0C54B0E90ECABC1EE2EE6814230

Function 00007FF69E5820D0 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000001,00007FF69E58207E), ref: 00007FF69E5820F6

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction ID: 95ba6fe67cffea47ee4e2efbed7cb0394a2010793e463390eb01b7a717c2d5f4
Opcode Fuzzy Hash: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction Fuzzy Hash: 0AF02222E1828295FB708B30E0903782B61EB28BB8F2843B5F73C811C4CF29C895C721

Function 00007FF69E5AD94C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF69E5AD98A

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction ID: 48fb05b931ae075b35e6ef0c616f007614b3ed05b8be719dafea4ffdb1703384
Opcode Fuzzy Hash: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction Fuzzy Hash: 03F05810B8920B49FF747AB158F03B41290DFA87B8F0816B0F92EC62D1DE2EE4808330

Non-executed Functions

Function 00007FF69E57C2F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 754fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E57DE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF69E57CF4B), ref: 00007FF69E57DE27
Part of subcall function 00007FF69E57DE04: GetLastError.KERNEL32 ref: 00007FF69E57DE88
Part of subcall function 00007FF69E57DE04: CloseHandle.KERNEL32 ref: 00007FF69E57DE9B

wcscpy.LIBCMT ref: 00007FF69E57CBC8
wcscpy.LIBCMT ref: 00007FF69E57CBFE
CreateFileW.KERNEL32 ref: 00007FF69E57CC38
DeviceIoControl.KERNEL32 ref: 00007FF69E57CD01
CloseHandle.KERNEL32 ref: 00007FF69E57CD12
GetLastError.KERNEL32 ref: 00007FF69E57CD2E
RemoveDirectoryW.KERNEL32 ref: 00007FF69E57CD7D
DeleteFileW.KERNEL32 ref: 00007FF69E57CD88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57CE89
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57CE8F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57CE9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57CEA1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57CEAD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57CEB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57CEB9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57CEBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57CEC5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57CECB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57CED1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57CED7

Strings

\??\, xrefs: 00007FF69E57C392, 00007FF69E57C3B8
SeRestorePrivilege, xrefs: 00007FF69E57C343
UNC\, xrefs: 00007FF69E57C53F, 00007FF69E57C55D
SeCreateSymbolicLinkPrivilege, xrefs: 00007FF69E57C34F

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseErrorFileHandleLastwcscpy$ControlCreateCurrentDeleteDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2659423929-3508440684
Opcode ID: 06daf32ec71af5be28d5ebbea321446fab7e236c627a8ebd1d3548b4ada623bc
Instruction ID: d8d8855706773217b75c79d865d71cc26d1d3dd564e638dbdd52569412cb74c5
Opcode Fuzzy Hash: 06daf32ec71af5be28d5ebbea321446fab7e236c627a8ebd1d3548b4ada623bc
Instruction Fuzzy Hash: D762F462F1864285FB20DB74D4E42BD2361EFA57A4F508271FA6D936E5DF3AD094C320

Function 00007FF69E58F180 Relevance: 43.2, APIs: 22, Strings: 2, Instructions: 1205COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF69E590528

Part of subcall function 00007FF69E58AAE0: LoadStringW.USER32 ref: 00007FF69E58AB67
Part of subcall function 00007FF69E58AAE0: LoadStringW.USER32 ref: 00007FF69E58AB80

Part of subcall function 00007FF69E59B0DC: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF69E590429), ref: 00007FF69E59B110
Part of subcall function 00007FF69E59B0DC: SetLastError.KERNEL32 ref: 00007FF69E59B153

Part of subcall function 00007FF69E57129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF69E571396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E590490
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E590496
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59049C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5904A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5904A8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5904AE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5904B4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5904BA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5904C0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5904C6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5904CC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5904D2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5904D8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5904DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5904E4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5904EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5904F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5904F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E590532
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E590538

Strings

%s: %s, xrefs: 00007FF69E58FC11
%ls, xrefs: 00007FF69E58F3AC, 00007FF69E58F3FF

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastLoadString$Concurrency::cancel_current_taskInit_thread_footer
String ID: %ls$%s: %s
API String ID: 2539828978-2259941744
Opcode ID: 2558469245adfebd394a382959a1e83256cfe0ae662a2232536a91e5aa36abf2
Instruction ID: 3bb2a402eb6b81991226aa47938f27b34a61b601ec16724a978d992dfa07d2d1
Opcode Fuzzy Hash: 2558469245adfebd394a382959a1e83256cfe0ae662a2232536a91e5aa36abf2
Instruction Fuzzy Hash: D1B2EA62A5868282EA309B25D4E41FE6311FFE9790F504376F69D83BE6DF2ED540C720

Function 00007FF69E5B2550 Relevance: 22.3, APIs: 8, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E5B2C12
memcpy_s.LIBCMT ref: 00007FF69E5B35BF
memcpy_s.LIBCMT ref: 00007FF69E5B3666

Part of subcall function 00007FF69E5B38BC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E5B38EE

memcpy_s.LIBCMT ref: 00007FF69E5B372F

Part of subcall function 00007FF69E5AD008: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69E5AD02D

Strings

1#SNAN, xrefs: 00007FF69E5B37C9
1#INF, xrefs: 00007FF69E5B3807
1#QNAN, xrefs: 00007FF69E5B37E8
1#IND, xrefs: 00007FF69E5B37AA

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 1759834784-2761157908
Opcode ID: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction ID: 816faa9f4955618cef0f3951feeb7c1e3c940131a41e44fb3007cb52d2e3473b
Opcode Fuzzy Hash: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction Fuzzy Hash: 03B23B76E081828BE7358E25D4A07FD3791FB68788F185135EA09E7B85DF7AE504CB20

Function 00007FF69E581A48 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 375fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF69E581A97
GetLongPathNameW.KERNEL32 ref: 00007FF69E581AE0
GetShortPathNameW.KERNEL32 ref: 00007FF69E581B21
GetShortPathNameW.KERNEL32 ref: 00007FF69E581B6A

Part of subcall function 00007FF69E5913C4: CompareStringW.KERNEL32 ref: 00007FF69E5913E3

MoveFileW.KERNEL32 ref: 00007FF69E581DFE
MoveFileW.KERNEL32 ref: 00007FF69E581E65

Part of subcall function 00007FF69E582134: CreateFileW.KERNEL32 ref: 00007FF69E58223C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E581FE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E581FE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E581FED

Strings

rtmp, xrefs: 00007FF69E581CF4, 00007FF69E581D03

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: NamePath$File_invalid_parameter_noinfo_noreturn$LongMoveShort$CompareCreateString
String ID: rtmp
API String ID: 3587137053-870060881
Opcode ID: 9c3bb7f88da4111c64c98a90087a1f69369957be9c2dd9b46383191453a00ac9
Instruction ID: 0619056a66212f28761ca0362574c3901afb917148b1f1e1f91c3de53c9e737b
Opcode Fuzzy Hash: 9c3bb7f88da4111c64c98a90087a1f69369957be9c2dd9b46383191453a00ac9
Instruction Fuzzy Hash: C6F1E122B28A8281EB20CB65D5E01FD6761FBA53D4F501172FA4EC7AA9DF3DD484C760

Function 00007FF69E585B60 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF69E585BC2
GetFullPathNameW.KERNEL32 ref: 00007FF69E585C0E
GetFullPathNameW.KERNEL32 ref: 00007FF69E585D2B
GetFullPathNameW.KERNEL32 ref: 00007FF69E585D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E585EE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E585EE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E585EEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E585EF2

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: 94c40fc1776b877378c577d1225dc7de1713f847266351d9a4c2267181702c32
Instruction ID: 1b612a886dc5b40382975b3a214080aa7536ddb7d8c4e74e72d5d0d53e935e2a
Opcode Fuzzy Hash: 94c40fc1776b877378c577d1225dc7de1713f847266351d9a4c2267181702c32
Instruction Fuzzy Hash: 24A1C4A2F25A5184FE208B79D8A41BC2331EFA9BE4B145271EE6D97BD4DE3DE041C210

Function 00007FF69E5A3170 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF69E5A318C
RtlCaptureContext.KERNEL32 ref: 00007FF69E5A31B9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF69E5A31D3
RtlVirtualUnwind.KERNEL32 ref: 00007FF69E5A3214
IsDebuggerPresent.KERNEL32 ref: 00007FF69E5A3268
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF69E5A3289
UnhandledExceptionFilter.KERNEL32 ref: 00007FF69E5A3294

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction ID: 2e5148a7aa1f51bf445537bce38271fb1f38e18a664d94ab18d7a1918ceadddb
Opcode Fuzzy Hash: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction Fuzzy Hash: 1D315272A08B819AEB708F64E8A03ED7360FB94758F444479EB4D87B99DF39D548C720

Function 00007FF69E5A76D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF69E5A7751
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF69E5A7769
RtlVirtualUnwind.KERNEL32 ref: 00007FF69E5A77A4
IsDebuggerPresent.KERNEL32 ref: 00007FF69E5A77DD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF69E5A77E7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF69E5A77F2

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction ID: 560e49b07ef211cde10abb5c33843668c91af7044dc8090f645f1855b22b264b
Opcode Fuzzy Hash: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction Fuzzy Hash: 5C316232608B8196DB608F25E8902AE73A0FB94754F540175FA9D83B59DF39D545CB10

Function 00007FF69E571AA4 Relevance: 6.3, APIs: 4, Instructions: 285COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E571EA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E571EAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E571EB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E571EBB

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: f1c6c325f9f3faed7a740967ccba3cb284d408a97d6dcbce278d86fae0ae8c65
Instruction ID: 02430dbf68b43408dd0da8476e74291e39fbcd1bede603b8051e0fceedf19442
Opcode Fuzzy Hash: f1c6c325f9f3faed7a740967ccba3cb284d408a97d6dcbce278d86fae0ae8c65
Instruction Fuzzy Hash: 5CB10462B1468685EB209F25D9A02ED2361FFA97D4F409272FA4CC7B99DF3ED540C320

Function 00007FF69E5AFA94 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E5AFAC4

Part of subcall function 00007FF69E5A7934: GetCurrentProcess.KERNEL32(00007FF69E5B0CCD), ref: 00007FF69E5A7961

Strings

., xrefs: 00007FF69E5AFEE4
*?, xrefs: 00007FF69E5AFAEB

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction ID: f830848473da4ac9c92f771929c4caa1a6c0c0786b342be15f27c29caffb5732
Opcode Fuzzy Hash: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction Fuzzy Hash: 02510462B54B9985EB20DFA298A00BC63A4FB68BE8B444131EE1D57F85DF3DD0428330

Function 00007FF69E5B2080 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF69E5B210B

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction ID: d473644ca65be18a82fb03d0eb6a46ece912266f72fa0642e3d0a38e2781bb74
Opcode Fuzzy Hash: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction Fuzzy Hash: 0BD1A436F1828687DB34CF15B19466AB791FBA8784F188134EB4E97B44DE3DE841CB20

Function 00007FF69E57B6D8 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF69E57BA9D), ref: 00007FF69E57B6E5
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF69E57BA9D), ref: 00007FF69E57B719
LocalFree.KERNEL32(?,?,?,?,?,?,?,00007FF69E57BA9D), ref: 00007FF69E57B743

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: a471a066277b062fb6d5795c074c31564509aaa162255506b86b7e98d1a040a7
Instruction ID: 3991a7fd62e5702c15118d3989ba8504deb82e56a1094405c201ebb25a63e8f7
Opcode Fuzzy Hash: a471a066277b062fb6d5795c074c31564509aaa162255506b86b7e98d1a040a7
Instruction Fuzzy Hash: 6C016272A0C74682EB609F22B8E017A6392FB99BC0F084074FA8DC7B45DF3ED5148710

Function 00007FF69E5AFCA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF69E5AFEE4

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction ID: 845456f393ca7188a4364d8f5e9df261b8fc11355c09dba00e65dc3424734c29
Opcode Fuzzy Hash: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction Fuzzy Hash: 0E310A22B0869145E7709A26D8657A96B91FB64BF4F148235FE6C87FC6CE3DD5018320

Function 00007FF69E5B5AF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF69E5B5D45
RaiseException.KERNEL32 ref: 00007FF69E5B5D56

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction ID: 656b3e1de08ce869fa0921b6a4d572d0ef2412e5f24264e0ea50f6a1fa9528f7
Opcode Fuzzy Hash: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction Fuzzy Hash: A8B170B3A10B848BEB29CF29C89636C37A1F744B48F198961EB5D877A4CF3AD451C710

Function 00007FF69E598DF4 Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E5985E0: GetDC.USER32 ref: 00007FF69E5985EC
Part of subcall function 00007FF69E5985E0: GetDeviceCaps.GDI32 ref: 00007FF69E5985FD
Part of subcall function 00007FF69E5985E0: ReleaseDC.USER32 ref: 00007FF69E59860A

GetObjectW.GDI32 ref: 00007FF69E598E48

Part of subcall function 00007FF69E5990B0: GetDC.USER32 ref: 00007FF69E5990D9
Part of subcall function 00007FF69E5990B0: GetObjectW.GDI32 ref: 00007FF69E599107
Part of subcall function 00007FF69E5990B0: ReleaseDC.USER32 ref: 00007FF69E5991BB

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID:
API String ID: 1061551593-0
Opcode ID: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction ID: 3db713e274dd151251a257cc5426ac98764687284512cbc8e3d01e6801bbc6a3
Opcode Fuzzy Hash: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction Fuzzy Hash: A4818B76F08A0596EB20CF6AD4A06AD7371FB98B88F505072EE0D97B64DF3AE144C350

Function 00007FF69E59A2CC Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF69E59A315
GetNumberFormatW.KERNEL32 ref: 00007FF69E59A371

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction ID: 1c56c5be9a51fbd97960f2f752c749e9b6cdea18b830941f3607c6cd46936155
Opcode Fuzzy Hash: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction Fuzzy Hash: 2A11AF36A08B8195E771CF11E8A03E97360FFA8B44F848071EA4C83664DF3DD145C714

Function 00007FF69E58126C Relevance: 1.7, APIs: 1, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E5824C0: CreateFileW.KERNELBASE ref: 00007FF69E58259B
Part of subcall function 00007FF69E5824C0: GetLastError.KERNEL32 ref: 00007FF69E5825AE
Part of subcall function 00007FF69E5824C0: CreateFileW.KERNEL32 ref: 00007FF69E58260E
Part of subcall function 00007FF69E5824C0: GetLastError.KERNEL32 ref: 00007FF69E582617

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5815D0

Part of subcall function 00007FF69E583980: MoveFileW.KERNEL32 ref: 00007FF69E5839BD
Part of subcall function 00007FF69E583980: MoveFileW.KERNEL32 ref: 00007FF69E583A34

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: File$CreateErrorLastMove$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 34527147-0
Opcode ID: b0aa1eb98be44e56a116eefab8112d55a52bc6a2967c977d5e0ac11a1da27cd0
Instruction ID: 03d2dbcf037e77c52c724aeb3796840457d838d16abeae62d69dfbb5fb31c479
Opcode Fuzzy Hash: b0aa1eb98be44e56a116eefab8112d55a52bc6a2967c977d5e0ac11a1da27cd0
Instruction Fuzzy Hash: 6891E126B28A4282EB20DB62D5A42BE6361FB64BC4F405072FE0DC7B95DF3ED545C720

Function 00007FF69E584EB0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF69E584EE2

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 5e1f820920c456f15e44ae9d5f0cc3b6f822566f542002a6e47536c5256bfc9c
Instruction ID: 03186ad97148ea80979197bdcfb897e1299f38692a242a9b716c743151b515f2
Opcode Fuzzy Hash: 5e1f820920c456f15e44ae9d5f0cc3b6f822566f542002a6e47536c5256bfc9c
Instruction Fuzzy Hash: 7D01BC3195D58286FA318720A4B03B53791DBB9306F4401B9E98C83391CF2EA888CB30

Function 00007FF69E5A8C1C Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF69E5A8DD3

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction ID: 17d405fa118c67ec67f5dee8557acbecb120c928d1952d5e5a1cade20a4e0ed4
Opcode Fuzzy Hash: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction Fuzzy Hash: B2812921A58342A2EBB88A2590E867D23A0EF70764F9415B1FD09CB795CF3FE845C730

Function 00007FF69E5A89A0 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF69E5A8B3A

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction ID: be92698aa4922de70abfac7605ab550f8934b9ccb1d472dc45f9e0a57a5bf6b0
Opcode Fuzzy Hash: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction Fuzzy Hash: 7C716821A4C24666FB788E1850EC27D2390EF61734F9815B1FD09C76C6CE2FE8468730

Function 00007FF69E58C96C Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

gj, xrefs: 00007FF69E58C97B

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction ID: 2d562ea8a414c7e1cb13ff806069009172c2dae40775b7e3ffbcfe5f98ded0c0
Opcode Fuzzy Hash: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction Fuzzy Hash: 5B51A037B286908BD724CF25E450A9EB3A5F388798F445126FF4A93B09CB39E945CF40

Function 00007FF69E5AC838 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF69E5AC874

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction ID: 9d63504eb6c51edaf27a3531d99f3e911e11cc7828a67e2572ea4eec1388064a
Opcode Fuzzy Hash: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction Fuzzy Hash: 8A41DD22714A45CAEF54CF2AE4A42A973A5F768FD4B4D9036EE0D9B754DE3DD042C310

Function 00007FF69E5B0D20 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF69E5B0D24

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction ID: 83aa2e12759fd137f8ee1246bc2f56228d852b03429ba625a43e4295f0746296
Opcode Fuzzy Hash: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction Fuzzy Hash: B1B09224E17A02C2EA182B156CE229822A4FF68710F9890B9E10C81320DE3E20E54720

Function 00007FF69E593964 Relevance: .9, Instructions: 931COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df1e6e81a57214c8643d36be1bb9cde3812740f73d4ab830297bee2ffae98a2
Instruction ID: cd352741b2c5448d6d0105d08a3b2c47e0e896b5bbca422bf0a36b435c967e2f
Opcode Fuzzy Hash: 1df1e6e81a57214c8643d36be1bb9cde3812740f73d4ab830297bee2ffae98a2
Instruction Fuzzy Hash: B0823AF3A096C186D725CF24D4A42FC3BA1E765B84F598176EA4E87386DE3ED845C320

Function 00007FF69E5776C0 Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction ID: 0ff64523e5f3d95b03f12fec37e383a356d42d2d02613d4b16f2bbcf44611f8c
Opcode Fuzzy Hash: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction Fuzzy Hash: 85628D9AD3AF9A1EE303A53954131D2E35C0EF74C9551E31BFCE431E66EB92A6832314

Function 00007FF69E5953F0 Relevance: .9, Instructions: 891COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a45c88a368d7276059de07aefbbc35b61cea5d64746511b72f3674958eea04
Instruction ID: ff4a91557aa00ce9c80935b80cb685cda3f621588a79eeb25ac86d0f320ef0c2
Opcode Fuzzy Hash: 83a45c88a368d7276059de07aefbbc35b61cea5d64746511b72f3674958eea04
Instruction Fuzzy Hash: 0B8201F2A096C08AD724CF28D4A46FC7B61F765B48F488176EA4D87789CE3ED459C720

Function 00007FF69E58BB90 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction ID: 666887a51333aba031dc729ca6457258857df7809d947dfce564e49b6f3e4d9f
Opcode Fuzzy Hash: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction Fuzzy Hash: FE22E3B3B246508BD728CF25C89AE5E3766F798744B4B8228DF0ACB785DB39D505CB40

Function 00007FF69E594B98 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction ID: 121bbf9b4c48372c2de3d1acb463c809fabe35a2037d9deaed6f0ac2c7d2c1c6
Opcode Fuzzy Hash: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction Fuzzy Hash: 8A32C1B2A042918BE728CF24D5A06FC37A1F764748F458179EA4A87B84DF3DEC65C760

Function 00007FF69E577288 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction ID: 95c07dafa5b8f43b83bc8e1e6c49cf789cb77cde71e8571c2957481e545f6f10
Opcode Fuzzy Hash: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction Fuzzy Hash: 83C19DB7B281908FE360CF7AE440A9D3BB1F39878CB519125EF59A3B09D639D645CB40

Function 00007FF69E592D58 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction ID: 6b6d66e71c7d5cfae7a3e0ab860151688760a97ceb09b2018533ec3941760f4b
Opcode Fuzzy Hash: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction Fuzzy Hash: 50A147B7A0818186EB39CA24E4A47FD2781EBB5744F954175FE4D87786DE3EE881C320

Function 00007FF69E58AF18 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction ID: b01671107573ef81d0a2d6a894dfeb245d3a4e06516059b014d3be7fb77aace1
Opcode Fuzzy Hash: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction Fuzzy Hash: C2C11577A291E04DE302CBB5A4748FD3FF5E71E30DB4A4151EF9666B4AC5295201DB30

Function 00007FF69E57A310 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction ID: 5d92906aa16a9269a5b5e1f089ca0ad52325863e5d12e5566c5b21a2f9b2e573
Opcode Fuzzy Hash: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction Fuzzy Hash: 14914262B1858196EB21DF29D4A12FD6721FFA5788F441031FF4E87B4AEE3AD646C310

Function 00007FF69E58B534 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction ID: 559008f1826d8a66b33f98a60dda4fe7c30696e17cafa180fbc158c84227afb3
Opcode Fuzzy Hash: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction Fuzzy Hash: FF61A927B281D048EB61CF3185604FD7FB5E729784B458072EF9A93646CE3EE105CB20

Function 00007FF69E5921D0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction ID: 80f1ae3f04473bc08974d4041bd8a1d3d3786b9be2781d2256f2ac3b95a52297
Opcode Fuzzy Hash: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction Fuzzy Hash: AB5111B3B181514BE7288F28F0647AD3751FBA8B48F848134EB4987689DE3EE945CB10

Function 00007FF69E592AB0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction ID: 9bd6b1dfac51902a3381e8bc35ad27c0e6a4f24a596118bd0d5e386d71bd088e
Opcode Fuzzy Hash: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction Fuzzy Hash: DD31D2A2A185814BD728DE16A6A02BE67D1F764340F448139EF4AC7B42DE7DE445C710

Function 00007FF69E58DC70 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4fac86f8f1a6b9d8c17b4c2881c5c96027003405599c7815143c772f625e0d
Instruction ID: f85b697a6e942d6ac5fffba54125b646f1dfd126096cbc5e1af171854ea45638
Opcode Fuzzy Hash: 6a4fac86f8f1a6b9d8c17b4c2881c5c96027003405599c7815143c772f625e0d
Instruction Fuzzy Hash: 5DF0DA72F3C00743FB78002858AA33910DADB31310F5448B5F31BC62C5DDAFA8811329

Function 00007FF69E5A3354 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction ID: 3f73ccdbb12b8fbba202d2d2758b56ca31afe7daaf288ea0db479e6a07cd1cf8
Opcode Fuzzy Hash: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction Fuzzy Hash: 4BA0016194C842E0E6648B10A8F00746620FB60714F5810B2F00D810A59E2EA401C220

Function 00007FF69E57D7D0 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 98COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57D964

Strings

::$ATTRIBUTE_LIST, xrefs: 00007FF69E57D7FC
::$EA_INFORMATION, xrefs: 00007FF69E57D828
::$DATA, xrefs: 00007FF69E57D812
:$I30:$INDEX_ALLOCATION, xrefs: 00007FF69E57D849
:$TXF_DATA:$LOGGED_UTILITY_STREAM, xrefs: 00007FF69E57D875
::$INDEX_ALLOCATION, xrefs: 00007FF69E57D83E
::$FILE_NAME, xrefs: 00007FF69E57D833
::$BITMAP, xrefs: 00007FF69E57D807
::$INDEX_ROOT, xrefs: 00007FF69E57D854
::$REPARSE_POINT, xrefs: 00007FF69E57D88B
::$LOGGED_UTILITY_STREAM, xrefs: 00007FF69E57D85F
::$EA, xrefs: 00007FF69E57D81D
::$OBJECT_ID, xrefs: 00007FF69E57D880
:$EFS:$LOGGED_UTILITY_STREAM, xrefs: 00007FF69E57D86A

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: :$EFS:$LOGGED_UTILITY_STREAM$:$I30:$INDEX_ALLOCATION$:$TXF_DATA:$LOGGED_UTILITY_STREAM$::$ATTRIBUTE_LIST$::$BITMAP$::$DATA$::$EA$::$EA_INFORMATION$::$FILE_NAME$::$INDEX_ALLOCATION$::$INDEX_ROOT$::$LOGGED_UTILITY_STREAM$::$OBJECT_ID$::$REPARSE_POINT
API String ID: 3668304517-727060406
Opcode ID: 9722f19d9730c17eaeca2eefbf6c05556aeae8c55d78850e8e2a1aeae63cce70
Instruction ID: 5848505ff407897f79ee7dd8c2aab1219548ff139e836c904ddf922394d05df6
Opcode Fuzzy Hash: 9722f19d9730c17eaeca2eefbf6c05556aeae8c55d78850e8e2a1aeae63cce70
Instruction Fuzzy Hash: 45413B76B15F01A8EB208F60D4A03E833B5FB28794F445176EA4C87768EF3AD565C360

Function 00007FF69E5A2A10 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF69E5A2A26
GetModuleHandleW.KERNEL32 ref: 00007FF69E5A2A33
GetModuleHandleW.KERNEL32 ref: 00007FF69E5A2A48
GetProcAddress.KERNEL32 ref: 00007FF69E5A2A60
GetProcAddress.KERNEL32 ref: 00007FF69E5A2A73
CreateEventW.KERNEL32 ref: 00007FF69E5A2A9F
DeleteCriticalSection.KERNEL32 ref: 00007FF69E5A2AEB
CloseHandle.KERNEL32 ref: 00007FF69E5A2AFD

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF69E5A2A2C
WakeAllConditionVariable, xrefs: 00007FF69E5A2A66
SleepConditionVariableCS, xrefs: 00007FF69E5A2A56
kernel32.dll, xrefs: 00007FF69E5A2A41

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction ID: c562f8f01d990e9be1cbb9062ec6615a06391b386f96a65fc50a3ec43f2b54aa
Opcode Fuzzy Hash: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction Fuzzy Hash: 71212168E5DB43A1FA749B51E9F517423A0EF78790F5810B5F90EC26A0DE7EA485C330

Function 00007FF69E586A0C Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 444COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5870A6

Part of subcall function 00007FF69E572004: std::_Xinvalid_argument.LIBCPMT ref: 00007FF69E57200F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5870B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5870B8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5870C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5870D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5870DC

Strings

DXGIDebug.dll, xrefs: 00007FF69E586A18
\\?\, xrefs: 00007FF69E586A57, 00007FF69E586A66
UNC, xrefs: 00007FF69E586BBF

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: DXGIDebug.dll$UNC$\\?\
API String ID: 4097890229-4048004291
Opcode ID: fb1ac769355281392679e6cccb69878fe575312718547a0a82cc4cd56cbd4b61
Instruction ID: 46e629c43eba884a8c0d53effc0e4f8207dfa78a2b46b60b581fc512c050ebe3
Opcode Fuzzy Hash: fb1ac769355281392679e6cccb69878fe575312718547a0a82cc4cd56cbd4b61
Instruction Fuzzy Hash: 2E120122B28B4284EF20CB64D0A41BD6371EBA1B98F504271EB5D87BE9DF7ED545C360

Function 00007FF69E59A440 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E57129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF69E571396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59A72F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59A735
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59A73B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59A741
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59A747
EndDialog.USER32 ref: 00007FF69E59A7BA

Strings

GETPASSWORD1, xrefs: 00007FF69E59A773
Software\WinRAR SFX, xrefs: 00007FF69E59A52B, 00007FF69E59A53A

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 431506467-1315819833
Opcode ID: 7882e024c9b819478201ce71fd32b12efab10176d06f444255a33135c55d9ff8
Instruction ID: c1630139faea4b72e76f6f2cc4d79aa037a8b923e0e14fb439818a9ce1ba9b41
Opcode Fuzzy Hash: 7882e024c9b819478201ce71fd32b12efab10176d06f444255a33135c55d9ff8
Instruction Fuzzy Hash: 22B1D2A6F1974285FB209B64D4A52FC2372EF55394F404275EE1CA6ADAEE3EE045C320

Function 00007FF69E596E80 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF69E597E9B), ref: 00007FF69E597080
CreateStreamOnHGlobal.COMBASE ref: 00007FF69E5970B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E59717B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E597181
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E597187

Strings

</html>, xrefs: 00007FF69E596F72, 00007FF69E596F81
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF69E596F2C, 00007FF69E596F3B
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF69E596ED5, 00007FF69E596EE4
<html>, xrefs: 00007FF69E596F13

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Global$AllocCreateStream
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2868844859-1533471033
Opcode ID: b0a568968ba406e2562f5405558042a856f124114ebc2f236df8f8f8fbeda86d
Instruction ID: ce0f780843be91928121d5bf2ab604911717bd77ac1843e7c26949491f4d49c9
Opcode Fuzzy Hash: b0a568968ba406e2562f5405558042a856f124114ebc2f236df8f8f8fbeda86d
Instruction Fuzzy Hash: 3F81E662F18A0285FB20DBB5D4A01FC2371EF69794F844176EE1D976A9DE3ED50AC320

Function 00007FF69E5AE650 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E5AE7CD

Strings

nan, xrefs: 00007FF69E5AE6B8
INF, xrefs: 00007FF69E5AE6C3
nan(snan), xrefs: 00007FF69E5AE6F0
NAN(IND), xrefs: 00007FF69E5AE6FB
NAN, xrefs: 00007FF69E5AE6B1
inf, xrefs: 00007FF69E5AE6D6
NAN(SNAN), xrefs: 00007FF69E5AE6E5
nan(ind), xrefs: 00007FF69E5AE706

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction ID: 16dc00ee50215fe432193ffa2e14ed848367ebb563239a68fa10b758935faf75
Opcode Fuzzy Hash: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction Fuzzy Hash: FC41C132A05B4189F720CF65E8A17E933A4EB24398F044576EE4C87B54DE3ED065C364

Function 00007FF69E59F390 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF69E59F3CF
GetClassNameW.USER32 ref: 00007FF69E59F3FC
GetWindowLongPtrW.USER32 ref: 00007FF69E59F41D
SendMessageW.USER32 ref: 00007FF69E59F437
GetObjectW.GDI32 ref: 00007FF69E59F452
SendMessageW.USER32 ref: 00007FF69E59F487
DeleteObject.GDI32 ref: 00007FF69E59F490
GetWindow.USER32 ref: 00007FF69E59F49E

Strings

STATIC, xrefs: 00007FF69E59F402

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassDeleteLongName
String ID: STATIC
API String ID: 2845197485-1882779555
Opcode ID: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction ID: 32b381f6b20d5054401851de3f3d255f24be3f2d9af5ba72af9a54705c363457
Opcode Fuzzy Hash: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction Fuzzy Hash: A831D465B08B4282FA709B12A5A07F923A1FFA8BC0F854071ED4D87B45DF3EE4468760

Function 00007FF69E59AE90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF69E59AEAE

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ItemTextWindow
String ID: LICENSEDLG
API String ID: 2478532303-2177901306
Opcode ID: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction ID: 5247a403b2e2d5cb71d714303912d20c90e1ec14489b59e2553cf71c8c459f7a
Opcode Fuzzy Hash: 35fefc179f922e98870b8a3b257cf5e504c5ed53f195972dc606f5139ed8380b
Instruction Fuzzy Hash: 8D41B269F0861282FB709B11E8B47B92361EFA4B84F4481B5F90D83B95CF3EE585C320

Function 00007FF69E58B9B4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF69E58BA12
GetProcAddress.KERNEL32 ref: 00007FF69E58BA2D
GetCurrentProcessId.KERNEL32 ref: 00007FF69E58BACA

Part of subcall function 00007FF69E58DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF69E58DDDF

Strings

CryptUnprotectMemory, xrefs: 00007FF69E58BA1F
CryptUnprotectMemory failed, xrefs: 00007FF69E58BAC1
CryptProtectMemory failed, xrefs: 00007FF69E58BA80
Crypt32.dll, xrefs: 00007FF69E58B9F0
CryptProtectMemory, xrefs: 00007FF69E58BA08

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: 6794cfd2df2083ddb130d433e4ca33b69faefb70ddab7dfcfa84983386d80e8a
Instruction ID: cbbbbf755426bba48d6e0fc17b93fde571fe2c74345b3b1e368de5393b8b5d68
Opcode Fuzzy Hash: 6794cfd2df2083ddb130d433e4ca33b69faefb70ddab7dfcfa84983386d80e8a
Instruction Fuzzy Hash: 39316D28E1DB0690FA748B11E8F817527A4EF64B90F4851B6F84D833A4EE3FE5818320

Function 00007FF69E5987D8 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E598DB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E598DC2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E598DCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E598DDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E598DE0

Strings

, xrefs: 00007FF69E5988BE
, xrefs: 00007FF69E598A55

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: d36d35de43213f8ad8c7125845a4b947406c7f49c70316df392fd487e7cb45ba
Instruction ID: 8aab97aacb275e4a91d88ec78d8def9f790dd63252d0547597192e1ef632af6d
Opcode Fuzzy Hash: d36d35de43213f8ad8c7125845a4b947406c7f49c70316df392fd487e7cb45ba
Instruction Fuzzy Hash: 52F1F2A2F15B4250EE249B64D5E41FC2362EB64BA8F805271EB2D977D5DF7EE080C360

Function 00007FF69E5A57EC Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF69E5A598A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69E5A5CAD
abort.LIBCMT ref: 00007FF69E5A5CE1

Strings

csm, xrefs: 00007FF69E5A5933
csm, xrefs: 00007FF69E5A59B1
csm, xrefs: 00007FF69E5A58D1

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction ID: 2f04c8d473aa254281317a52bac2c59852f7e7ac555ec9d5e6e6696267fc17b6
Opcode Fuzzy Hash: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction Fuzzy Hash: 2AE1BFB29487828AE7309F64D4E07AD7BA0FB64768F140175EB8D87696CF39E485C720

Function 00007FF69E584F38 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E584E24: SysAllocString.OLEAUT32 ref: 00007FF69E584E5F

VariantClear.OLEAUT32 ref: 00007FF69E585125

Strings

WQL, xrefs: 00007FF69E58502A
Windows 10, xrefs: 00007FF69E58510A
Name, xrefs: 00007FF69E5850F9
SELECT * FROM Win32_OperatingSystem, xrefs: 00007FF69E585017
ROOT\CIMV2, xrefs: 00007FF69E584F7B

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: AllocClearStringVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 1959693985-3505469590
Opcode ID: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction ID: c580a2f1d7ac8c3b4c81ca6f182c2ff64f0d864ddf9ae28b9c6812a947974c89
Opcode Fuzzy Hash: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction Fuzzy Hash: 89715A76A14A0595EB20CF25E8E05AD37B0FBA8B98F045172EE4E83BA4DF3ED544C310

Function 00007FF69E5A72EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF69E5A74F3,?,?,?,00007FF69E5A525E,?,?,?,00007FF69E5A5219), ref: 00007FF69E5A7371
GetLastError.KERNEL32(?,?,00000000,00007FF69E5A74F3,?,?,?,00007FF69E5A525E,?,?,?,00007FF69E5A5219), ref: 00007FF69E5A737F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF69E5A74F3,?,?,?,00007FF69E5A525E,?,?,?,00007FF69E5A5219), ref: 00007FF69E5A73A9
FreeLibrary.KERNEL32(?,?,00000000,00007FF69E5A74F3,?,?,?,00007FF69E5A525E,?,?,?,00007FF69E5A5219), ref: 00007FF69E5A73EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF69E5A74F3,?,?,?,00007FF69E5A525E,?,?,?,00007FF69E5A5219), ref: 00007FF69E5A73FB

Strings

api-ms-, xrefs: 00007FF69E5A7391

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction ID: 834e987f893f110b70b3e3915617aa11f5103dead2a36438a9eb7dd832a3bd00
Opcode Fuzzy Hash: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction Fuzzy Hash: A531C521A5A64291EE319B06A8A057523D4FF64BB0F5A4576FD1DCB3A0EF3EE0508730

Function 00007FF69E5A1604 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF69E5A1573,?,?,?,00007FF69E5A192A), ref: 00007FF69E5A162B
GetProcAddress.KERNEL32(?,?,?,00007FF69E5A1573,?,?,?,00007FF69E5A192A), ref: 00007FF69E5A1648
GetProcAddress.KERNEL32(?,?,?,00007FF69E5A1573,?,?,?,00007FF69E5A192A), ref: 00007FF69E5A1664

Strings

AcquireSRWLockExclusive, xrefs: 00007FF69E5A163E
KERNEL32.DLL, xrefs: 00007FF69E5A1624
ReleaseSRWLockExclusive, xrefs: 00007FF69E5A1653

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction ID: 197d5e66d058b2bc8f0b93f02e79f99f3bc3ce1d1f11e686e4c2cf87d3196fe8
Opcode Fuzzy Hash: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction Fuzzy Hash: A3115260E4AB42A1FD744B01A6E02741295EF287A0F4C54B5E81ECBB51EE7EB484C630

Function 00007FF69E58ED24 Relevance: 9.1, APIs: 6, Instructions: 120timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E5851A4: GetVersionExW.KERNEL32 ref: 00007FF69E5851D5

FileTimeToLocalFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF69E575AB4), ref: 00007FF69E58ED8C
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF69E575AB4), ref: 00007FF69E58ED98
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF69E575AB4), ref: 00007FF69E58EDA8
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF69E575AB4), ref: 00007FF69E58EDB6
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF69E575AB4), ref: 00007FF69E58EDC4
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF69E575AB4), ref: 00007FF69E58EE05

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction ID: 6073244009921c2a117563b5bda35da68fc6f705701152534cf3f86945935f66
Opcode Fuzzy Hash: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction Fuzzy Hash: 67518DB2F106518AEB14CF64D8900AC77B1F758B88B64803AEE0D97B58DF39E545C710

Function 00007FF69E58F010 Relevance: 9.1, APIs: 6, Instructions: 80timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF69E58F074

Part of subcall function 00007FF69E5851A4: GetVersionExW.KERNEL32 ref: 00007FF69E5851D5

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF69E58F096
FileTimeToSystemTime.KERNEL32 ref: 00007FF69E58F0A2
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF69E58F0B2
SystemTimeToFileTime.KERNEL32 ref: 00007FF69E58F0C0
SystemTimeToFileTime.KERNEL32 ref: 00007FF69E58F0CE

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction ID: bb91184798d98d4f887038f23c57ecf5a55f74c3b80da768c84d98b6de6f05df
Opcode Fuzzy Hash: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction Fuzzy Hash: 7F315962F10A51DEFB14CFB5E8911AC7370FB18758B54502AEE0EA3A58EF38D895C720

Function 00007FF69E587918 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E587C8C

Strings

sfx, xrefs: 00007FF69E5879F3, 00007FF69E587A02
rar, xrefs: 00007FF69E587A9B, 00007FF69E587AAA, 00007FF69E587B67, 00007FF69E587B7C
exe, xrefs: 00007FF69E5879AF, 00007FF69E5879BE
.rar, xrefs: 00007FF69E587969, 00007FF69E587978

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: .rar$exe$rar$sfx
API String ID: 3668304517-630704357
Opcode ID: 97aafd44a7caf21700e2098a6ceb5321661423453e734b1945fa1e7d2bcd8431
Instruction ID: 49f109b913df0098c25bc38e15d5755490a29441b84d0aea07527439386cdbb6
Opcode Fuzzy Hash: 97aafd44a7caf21700e2098a6ceb5321661423453e734b1945fa1e7d2bcd8431
Instruction Fuzzy Hash: 10A1B122A24A0650EB20DB25D8E52BC2361FF64BA8F445271FE1DC76E5DF3EE591C360

Function 00007FF69E5A5CE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF69E5A5D58

Part of subcall function 00007FF69E5A5210: abort.LIBCMT ref: 00007FF69E5A5223

_CallSETranslator.LIBVCRUNTIME ref: 00007FF69E5A5DA3
abort.LIBCMT ref: 00007FF69E5A5FD1

Strings

RCC, xrefs: 00007FF69E5A5D74
MOC, xrefs: 00007FF69E5A5D6C

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction ID: 489f5d57e92919ef0289188aa2c81216c41778be4aee4123f3c0e306fcc664f2
Opcode Fuzzy Hash: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction Fuzzy Hash: 5191D2B3A08B818AE720CB64E4906AD7BA0FB14798F144179FF4C97B59DF39D195CB20

Function 00007FF69E5A4F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF69E5A4FAB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF69E5A5040
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF69E5A2F5E), ref: 00007FF69E5A508F

Strings

f, xrefs: 00007FF69E5A4FBE
csm, xrefs: 00007FF69E5A5026

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction ID: bca7acd3903fadc011fbc426f25f5c47e94344b4d1fd3e3b0999e6b16ba368d6
Opcode Fuzzy Hash: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction Fuzzy Hash: FF51F572B4960286DB24CF11E490E393796FB60BA8F5080B4FA5E87748DF7AE841C770

Function 00007FF69E57CEE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF69E57D03D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57D0D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57D0D7

Part of subcall function 00007FF69E57DE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF69E57CF4B), ref: 00007FF69E57DE27
Part of subcall function 00007FF69E57DE04: GetLastError.KERNEL32 ref: 00007FF69E57DE88
Part of subcall function 00007FF69E57DE04: CloseHandle.KERNEL32 ref: 00007FF69E57DE9B

Strings

SeRestorePrivilege, xrefs: 00007FF69E57CF5E
SeSecurityPrivilege, xrefs: 00007FF69E57CF3F

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo_noreturn$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2102711378-639343689
Opcode ID: 87299e3d8371150436d20a5d335114172b85ee8c064b133af49689baa0f6dc88
Instruction ID: 41ea17a9320ac298fe713f65735f35a4c7a0a610deb3d7bcfbff65d552cfb35b
Opcode Fuzzy Hash: 87299e3d8371150436d20a5d335114172b85ee8c064b133af49689baa0f6dc88
Instruction Fuzzy Hash: AC510262F0864285FB20DB60D8E52BD2361EFA57A4F0051B1EE4D93696EE3EE495C320

Function 00007FF69E597B28 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF69E597B6F
GetWindowRect.USER32 ref: 00007FF69E597BC0
ShowWindow.USER32 ref: 00007FF69E597C96
ShowWindow.USER32 ref: 00007FF69E597CC3

Strings

RarHtmlClassName, xrefs: 00007FF69E597C4B

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: 7f8a0b662af83a4f47b362c37f36e9414f73daccdb18f375bc1ce0a7ee57f15d
Instruction ID: 29079828c108c5d2f0b387c70641298dad24550427dae90b4f2f8cfeec606d33
Opcode Fuzzy Hash: 7f8a0b662af83a4f47b362c37f36e9414f73daccdb18f375bc1ce0a7ee57f15d
Instruction Fuzzy Hash: 5051B766A08B4186EB34DF21E4A437A63A1FFA5780F444476FE4E83B65DF3EE0458720

Function 00007FF69E59FED4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00007FF69E59FF60
REPLACEFILEDLG, xrefs: 00007FF69E59FF34, 00007FF69E59FF99

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction ID: cb9904cae2edbca8c8662bacdd2bf6f671317f92678b6f68bea361051cee8b25
Opcode Fuzzy Hash: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction Fuzzy Hash: EE21EA69908B4791FA319B15B8E41B463A1FB69B88FA400B6F94DC7364DE3EE1C4C370

Function 00007FF69E5ABFB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF69E5ABFD0
GetProcAddress.KERNEL32 ref: 00007FF69E5ABFE6
FreeLibrary.KERNEL32 ref: 00007FF69E5AC00B

Strings

CorExitProcess, xrefs: 00007FF69E5ABFDF
mscoree.dll, xrefs: 00007FF69E5ABFC7

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction ID: be0276ba96ff04e92c0fc9a8bdd19d0975655a331b5a94de61c7097090af8b8c
Opcode Fuzzy Hash: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction Fuzzy Hash: 0FF06221E19A4291EF648F11F4E027D63A4FFA8794F482075F94F86664DE3EE484C720

Function 00007FF69E5B45C0 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E5B4605

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction ID: 9547fe2ba74311729c1de10e9517eced7dee723a583073f17a6001ca728f6b4e
Opcode Fuzzy Hash: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction Fuzzy Hash: EF81E022E1865245F7309F6588E06BD27A4FB65B98F0841B5FD0E93795EF3EA842C730

Function 00007FF69E583AF8 Relevance: 7.7, APIs: 5, Instructions: 164filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF69E583BBB
CreateFileW.KERNEL32 ref: 00007FF69E583C24
SetFileTime.KERNEL32 ref: 00007FF69E583CEC
CloseHandle.KERNEL32 ref: 00007FF69E583CF6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E583D2C

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: 6680a8ae6a6522cd62912201e70e8bb28995b8f6d908c9164d6c450c0857e8b8
Instruction ID: d18b00f661b2c506067a163fcba54191c7849c5e3650a216805bf38e366a5aba
Opcode Fuzzy Hash: 6680a8ae6a6522cd62912201e70e8bb28995b8f6d908c9164d6c450c0857e8b8
Instruction Fuzzy Hash: F551D272F28A4259FB70CB65E8A02BD2371EF687A8F044675EE1D867D5EE3994058310

Function 00007FF69E5B3F34 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF69E5B4767), ref: 00007FF69E5B3F91
WideCharToMultiByte.KERNEL32 ref: 00007FF69E5B406D
WriteFile.KERNEL32 ref: 00007FF69E5B4093
WriteFile.KERNEL32 ref: 00007FF69E5B40D2
GetLastError.KERNEL32 ref: 00007FF69E5B410A

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction ID: b09c01ba75accd9741ad5d7a6edb7809b3d691e88bb2ea594ed0f962d106afdb
Opcode Fuzzy Hash: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction Fuzzy Hash: FA51D232E18A5185E720CF65D4A03AC3BB1FB68798F088135EE4E97B98DF39D545C720

Function 00007FF69E5A1E00 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF69E584DF4), ref: 00007FF69E5A1E87
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF69E584DF4), ref: 00007FF69E5A1F09
SysAllocString.OLEAUT32 ref: 00007FF69E5A1F16

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: b7eca4d0914b4f3ce7b9457829877c74e6e00994a5cd88f9d96bed53318f8e63
Instruction ID: 149e91873aca1036381bb2f0b0f901813005519e409f980ab4793797366df73a
Opcode Fuzzy Hash: b7eca4d0914b4f3ce7b9457829877c74e6e00994a5cd88f9d96bed53318f8e63
Instruction Fuzzy Hash: C141D261A4968689EB249F2195A02B82391EF28BF4F184674FA6DC77D5DF3EE041C330

Function 00007FF69E5AF414 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF69E5AF536

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction ID: 9979987131eab0d9e870c353cbf26bfc6c2cc433e65e4e62a4bd1cd6867247eb
Opcode Fuzzy Hash: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction Fuzzy Hash: 5641B362B09A4292FE759F12A8A05756395FF28BE0F094575ED1DCBB44EE3EE4408330

Function 00007FF69E5B56D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF69E5B56FF
_set_statfp.LIBCMT ref: 00007FF69E5B571A
_set_statfp.LIBCMT ref: 00007FF69E5B5736
_set_statfp.LIBCMT ref: 00007FF69E5B5772

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: c6c6cc99c0ab9a0ea7c8811c1ab678a96b11d8cfdfc575b72218f8c8d619b62a
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: 1B118BB6F18A0781F67D1124E5E23790143FF653E0E5C42B0FA7ECA6D68E2EE4444225

Function 00007FF69E59FE24 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF69E59FE41
GetMessageW.USER32 ref: 00007FF69E59FE58
TranslateMessage.USER32 ref: 00007FF69E59FE63
DispatchMessageW.USER32 ref: 00007FF69E59FE6E
WaitForSingleObject.KERNEL32 ref: 00007FF69E59FE7C

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction ID: a7df5429aa1997e8c4a2a905b899232fa683813d8f26758da971894dde169d30
Opcode Fuzzy Hash: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction Fuzzy Hash: C4F04F25F3884682F7608770E4E4A7A2351FFB4B05F885071F54EC1994DE2DD189C720

Function 00007FF69E5A625C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF69E5A6286
abort.LIBCMT ref: 00007FF69E5A64EA

Strings

csm, xrefs: 00007FF69E5A62AB
csm, xrefs: 00007FF69E5A641A

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction ID: 661f324d993b64708820dab6b4e1cad5e174696721d95db8841cdc0a6a45c902
Opcode Fuzzy Hash: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction Fuzzy Hash: 1171C1725086818ADB708F25D0E077D7BA1FB25BA8F1481B6EA4C87A85CF7DD491C760

Function 00007FF69E5A80F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E5A811B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E5A82ED

Strings

, xrefs: 00007FF69E5A8276
*, xrefs: 00007FF69E5A8221

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction ID: 471fcae6f0a32f66db53f99f1c75b5a92040e9f47ed3c041c46d2e2035f5948c
Opcode Fuzzy Hash: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction Fuzzy Hash: E651597298CA429AE7748E2894EC37C3BA1FF25B28F9411B5E64981299CF3ED441C735

Function 00007FF69E5B1758 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF69E5B17CB
MultiByteToWideChar.KERNEL32 ref: 00007FF69E5B1894
GetStringTypeW.KERNEL32 ref: 00007FF69E5B18AE

Strings

$%s, xrefs: 00007FF69E5B175A

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction ID: b953608fd8a082e80044797fb5c5231419f9d6a9cfe119fa06ee552bb0db8116
Opcode Fuzzy Hash: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction Fuzzy Hash: 22419222F14B818AEB718F25D9902A97391FB64BA8F4802B5FE1D877C5DF3DE4418360

Function 00007FF69E5A66A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E5A5210: abort.LIBCMT ref: 00007FF69E5A5223

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF69E5A674A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF69E5A6776

Strings

csm, xrefs: 00007FF69E5A6876

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction ID: da755dd22ca61997f5e73198de55bb60375c5ff8341fce69b82cdc67782f0e17
Opcode Fuzzy Hash: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction Fuzzy Hash: 4F518D7769874287D630AB56E0906AE77E4FB98BA0F040174EB8D87B55CF3DE460CB20

Function 00007FF69E5B4360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF69E5B4446
WriteFile.KERNEL32 ref: 00007FF69E5B4479
GetLastError.KERNEL32 ref: 00007FF69E5B449B

Strings

U, xrefs: 00007FF69E5B4424

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction ID: 9984cfef199bf843deaf75977d5e2c7b9e02914306443638a3fee6527e489654
Opcode Fuzzy Hash: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction Fuzzy Hash: 1741B322A18A8182DB308F25E4943B96761FBA8794F484131FE4DC7744EF7DD451C710

Function 00007FF69E5990B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF69E5990D9
GetObjectW.GDI32 ref: 00007FF69E599107
ReleaseDC.USER32 ref: 00007FF69E5991BB

Strings

, xrefs: 00007FF69E599153

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction ID: 54087dd895260cfbcf109146c813def204994fec05f8f19a81d7a91164fd5178
Opcode Fuzzy Hash: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction Fuzzy Hash: FB317039B0874686EB14CF12B86872AB7A0F798FD1F018436ED4A93B54CE3DD089CB10

Function 00007FF69E58E870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,00007FF69E59317F,?,?,00001000,00007FF69E57E51D), ref: 00007FF69E58E8BB
CreateSemaphoreW.KERNEL32(?,?,?,00007FF69E59317F,?,?,00001000,00007FF69E57E51D), ref: 00007FF69E58E8CB
CreateEventW.KERNEL32(?,?,?,00007FF69E59317F,?,?,00001000,00007FF69E57E51D), ref: 00007FF69E58E8E4

Strings

Thread pool initialization failed., xrefs: 00007FF69E58E900

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction ID: d5f4193d98c55b0b3ef823f24aa59c9a85cbc4ef7f5ceb2c195faa852720ef62
Opcode Fuzzy Hash: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction Fuzzy Hash: E321A532E1A64186F7608F24D4A47AD32A2EBA4B0CF18C074DA0D8A295CF7F9455CBA4

Function 00007FF69E5985E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF69E5985EC
GetDeviceCaps.GDI32 ref: 00007FF69E5985FD
ReleaseDC.USER32 ref: 00007FF69E59860A

Strings

, xrefs: 00007FF69E598610

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction ID: bef1ba3ba31a35badfbccc53ef10f9f2181da8d4befb851f0b1a8b8ad4f47aa0
Opcode Fuzzy Hash: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction Fuzzy Hash: DBE08C24F0864182EB2857B6B5D902A2361EB4CBD0F168036EA1B83794CE3DC4C48310

Function 00007FF69E57D1A8 Relevance: 6.2, APIs: 4, Instructions: 238timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32 ref: 00007FF69E57D46C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57D554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57D55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57D560

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileTime
String ID:
API String ID: 1137671866-0
Opcode ID: 627c5a9f6122236fca581521dc96f53263a68227a0f7261b17c8441fee41a660
Instruction ID: b5b9b6942a4fd0ecb269aabcee7e67f2f7173809ca59db71e1b336f2beb4ab7c
Opcode Fuzzy Hash: 627c5a9f6122236fca581521dc96f53263a68227a0f7261b17c8441fee41a660
Instruction Fuzzy Hash: 5BA10662A1878281EA30DB24D4E02BD6371FFA5794F409171FA4D83AE9DF3EE554C720

Function 00007FF69E590548 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF69E5905FC
SetLastError.KERNEL32 ref: 00007FF69E590697

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 5ed787d55209b7c8df3ee471615d716fc40756d92c62d9d0f6fb7c7bc11a0d97
Instruction ID: 0d8bc2fe45b40f81fbfd06c7db9db84ad6516556403fcc520df6481cf4b8b153
Opcode Fuzzy Hash: 5ed787d55209b7c8df3ee471615d716fc40756d92c62d9d0f6fb7c7bc11a0d97
Instruction Fuzzy Hash: 4F51E372F14A4699FB209B74D4A52FC2321EBA4BD8F404572FA1C97BD6DE2ED140C360

Function 00007FF69E599D90 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF69E599DBC
GetLastError.KERNEL32 ref: 00007FF69E599E08
CreateDirectoryW.KERNEL32 ref: 00007FF69E599F10
LocalFree.KERNEL32 ref: 00007FF69E599F20

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: ccc7d28b294f4e6884a1db5a4544c49550100c2123dc1ad4bd8ddaa1afcd3233
Instruction ID: 6f4c5fb37d986b16cfc91a83ed0adc6fadf33262e0e45ce2eff8ecaf34328f14
Opcode Fuzzy Hash: ccc7d28b294f4e6884a1db5a4544c49550100c2123dc1ad4bd8ddaa1afcd3233
Instruction Fuzzy Hash: 6E519432A18B4686E7608F21E4A43ADB374FB94B84F505076FA4D97B58DF3ED444CB20

Function 00007FF69E5ADB5C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E5ADBAF
WideCharToMultiByte.KERNEL32 ref: 00007FF69E5ADC81
GetLastError.KERNEL32 ref: 00007FF69E5ADCA4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E5ADCD6

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction ID: 3962c483f5a37ff45a9496b56a0d54eed7d45594c2e5bf4bf0615288978e2957
Opcode Fuzzy Hash: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction Fuzzy Hash: FE419332A4864246F771AE1090F0379A690EFA0BB8F5481B1FB5D87A95DF6ED8418B30

Function 00007FF69E583980 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00007FF69E5839BD
MoveFileW.KERNEL32 ref: 00007FF69E583A34
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E583AEB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E583AF1

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: FileMove_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3823481717-0
Opcode ID: 23c5bd100aa8ad673c958e7e4297408591e81b8e6a21f45797f9c77ad4370286
Instruction ID: 3f2813775cfa2a29063226fbc24ef1c4e9f7d877456553f8dfbf5aada3854057
Opcode Fuzzy Hash: 23c5bd100aa8ad673c958e7e4297408591e81b8e6a21f45797f9c77ad4370286
Instruction Fuzzy Hash: 4941BE62F24B5184FB10CF75E8E51AC2372FB54BA8B005271EE5DA6A9ADF7AD441C320

Function 00007FF69E5B0B78 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF69E5AC45B), ref: 00007FF69E5B0B91
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF69E5AC45B), ref: 00007FF69E5B0BF3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF69E5AC45B), ref: 00007FF69E5B0C2D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF69E5AC45B), ref: 00007FF69E5B0C57

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction ID: 5acf7b1dc4acfd742e753a21ead44528e3033954d11654bb07d92fc803cf375e
Opcode Fuzzy Hash: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction Fuzzy Hash: 8A216131F18B51C2E6749F1264A0029B6A4FBA4BD0B4C4174EF8EA3BA4DF3DE4528314

Function 00007FF69E5AD440 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF69E5A7F28,?,?,?,00007FF69E5A9D35), ref: 00007FF69E5AD44A
SetLastError.KERNEL32(?,?,?,00007FF69E5A7F28,?,?,?,00007FF69E5A9D35), ref: 00007FF69E5AD4B2
SetLastError.KERNEL32(?,?,?,00007FF69E5A7F28,?,?,?,00007FF69E5A9D35), ref: 00007FF69E5AD4C8
abort.LIBCMT ref: 00007FF69E5AD4CE

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction ID: 54e17f95754000576aedeec8304c3f8d398f640294bb278230401e16f266b4bc
Opcode Fuzzy Hash: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction Fuzzy Hash: 1B012910F4960642FA787721A6F627812A1EF647A4F1448B8F91E83BD6ED6EB8004331

Function 00007FF69E598590 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF69E598598
GetDeviceCaps.GDI32 ref: 00007FF69E5985AE
GetDeviceCaps.GDI32 ref: 00007FF69E5985C2
ReleaseDC.USER32 ref: 00007FF69E5985D3

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction ID: bdd2e452dc599074f4c8a5586d53665cc4fd83e9413d48cf8451b091817cc0b9
Opcode Fuzzy Hash: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction Fuzzy Hash: 3DE01B64E0570542FF285B7168F91391250DF58B41F05847BE91FC6370DD3E90C5C724

Function 00007FF69E57E34C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E57E549

Strings

DXGIDebug.dll, xrefs: 00007FF69E57E35A

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DXGIDebug.dll
API String ID: 3668304517-540382549
Opcode ID: a2f12a1f2d19e067356e31001473a209d979b1ab48dc4af4c4bd396c09c0d7d4
Instruction ID: abe45f5dc80b25423ac00685aa37b55b28b4533652887babcead285477ada139
Opcode Fuzzy Hash: a2f12a1f2d19e067356e31001473a209d979b1ab48dc4af4c4bd396c09c0d7d4
Instruction Fuzzy Hash: 7371CD72A14B8182EB24CB25E5903ADB3A5FB68794F008236EBAD47B95DF39D061C310

Function 00007FF69E5AE1F4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E5AE237

Strings

e+000, xrefs: 00007FF69E5AE2DF
gfff, xrefs: 00007FF69E5AE362

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction ID: 0ddbec444af008c73628ed2d893a20db4d8595dc73fa67059605f0c3cefda347
Opcode Fuzzy Hash: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction Fuzzy Hash: BA512862B587C146E7348B75999136D6B92EB60BA0F08C271E79CC7BD5CE2EE484C720

Function 00007FF69E589408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E5895A8: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69E5895E6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E58959C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF69E5895A2

Strings

SIZE, xrefs: 00007FF69E589443

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: 6775c6e5e0b050535fa3d5d92d2e2625b9409ae7efec724ba4f308c615c90b07
Instruction ID: bec0d08f2a368c4e860432bd2b32f89da3fd4a039c757f2a88025020a95609ec
Opcode Fuzzy Hash: 6775c6e5e0b050535fa3d5d92d2e2625b9409ae7efec724ba4f308c615c90b07
Instruction Fuzzy Hash: A441E962A2878255EE30DB14E4E13BD7350EFA57A0F504272FB9D826D9EE3ED540C720

Function 00007FF69E5AC2C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69E5AC2EA
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF69E5A2CD5), ref: 00007FF69E5AC30B

Strings

C:\Users\user\Desktop\J4zGPhVRV3.exe, xrefs: 00007FF69E5AC2F9

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\J4zGPhVRV3.exe
API String ID: 3307058713-2084551466
Opcode ID: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction ID: e1c8e7d01eee8fa331dc4f0feeb807e8e957b6d038c15ce9532b0a55021781f8
Opcode Fuzzy Hash: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction Fuzzy Hash: E9417236A486528AEB34DF25A4A01BC7798EFA47E4F444076F94E87745DE3EE481C370

Function 00007FF69E599B40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69E57255C: GetDlgItem.USER32 ref: 00007FF69E5725AC
Part of subcall function 00007FF69E57255C: SetWindowTextW.USER32 ref: 00007FF69E5725C8

EndDialog.USER32 ref: 00007FF69E599C24
SetDlgItemTextW.USER32 ref: 00007FF69E599CAA

Strings

ASKNEXTVOL, xrefs: 00007FF69E599B72

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: d0a7277abea115b5451496591776496c59c44b7436eace80e69975e6a8ac9e23
Instruction ID: e81e8fc4978b6dd25d4eee6f6b9617b6a9f2399998e84481ead81284e5fac940
Opcode Fuzzy Hash: d0a7277abea115b5451496591776496c59c44b7436eace80e69975e6a8ac9e23
Instruction Fuzzy Hash: A9417461A1C64241FA309B12E9E02F963A1EFA5BC0F544075FE4D977A9DE3FE451C360

Function 00007FF69E589638 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF69E5896EA

Part of subcall function 00007FF69E590F68: WideCharToMultiByte.KERNEL32 ref: 00007FF69E590F99

Strings

@%s, xrefs: 00007FF69E5896CE
$%s, xrefs: 00007FF69E5896D7

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction ID: 3d79ce2cae15245b8e3fdebee96b7fcf95203c068750d6d6d29efb249721c9ae
Opcode Fuzzy Hash: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction Fuzzy Hash: 4831E572B28A4685EA708F26D4A06F933A0FB65784F400072FE4D97799DE3EE505C750

Function 00007FF69E5AEB04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF69E5AEB76
GetFileType.KERNEL32 ref: 00007FF69E5AEB8C

Strings

@, xrefs: 00007FF69E5AEBB7

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction ID: bb174aa425520c9507ad2e9f0b898445f478cd3e333ef45545fc7c162089fd52
Opcode Fuzzy Hash: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction Fuzzy Hash: BB21E622E48B8641EB708B2494E81382651EB65774F285377E66F877D4CE3ED8C1C330

Function 00007FF69E5A4078 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF69E5A1D3E), ref: 00007FF69E5A40BC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF69E5A1D3E), ref: 00007FF69E5A4102

Strings

csm, xrefs: 00007FF69E5A40EF

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction ID: d6206fa971bba88e991eed5c68680165dece0a85a82e43e527da5dbf769f28cc
Opcode Fuzzy Hash: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction Fuzzy Hash: 66114F36A08B4182EB208F15E49026A77E1FB98B94F184271EF8D4B754DF3DD955C710

Function 00007FF69E58EA5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF69E58E95F,?,?,?,00007FF69E58463A,?,?,?), ref: 00007FF69E58EA63
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF69E58E95F,?,?,?,00007FF69E58463A,?,?,?), ref: 00007FF69E58EA6E

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF69E58EA78

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction ID: b636eeeaa1e39a6ea40dbcfb8ab3d6aaf1d3c35ce4dcf7c54843c7a7fcb40abc
Opcode Fuzzy Hash: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction Fuzzy Hash: B3E01A25E1A84292F660A7209CE647C2212FF717B4F9453B1F13EC21E19F2EA985C320

Function 00007FF69E58A43C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF69E58A447
FindResourceW.KERNEL32 ref: 00007FF69E58A45D

Strings

RTL, xrefs: 00007FF69E58A453

Memory Dump Source

Source File: 00000004.00000002.1303898549.00007FF69E571000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF69E570000, based on PE: true

Associated: 00000004.00000002.1303751308.00007FF69E570000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304582479.00007FF69E5B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5CB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304793476.00007FF69E5D4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DA000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1304965670.00007FF69E5DE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff69e570000_J4zGPhVRV3.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction ID: a988f4716ea1e75d810014abe3be94c78193be98337d72adf8077676c291c874
Opcode Fuzzy Hash: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction Fuzzy Hash: 69D05E91F1A64682FF395B71A8A93341250DF29B41F4C60B8D90E86395EE3EE088C760

Analysis Process: rfusclient.exePID: 8384, Parent PID: 7380COMMON

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.1%
Total number of Nodes:	581
Total number of Limit Nodes:	7

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 6C5C12F0 Relevance: 1.3, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 6C5C134C

Memory Dump Source

Source File: 00000010.00000002.1454467778.000000006C491000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C490000, based on PE: true

Associated: 00000010.00000002.1454442643.000000006C490000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462067691.000000006C909000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C910000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C9DE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463002538.000000006CAC5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463028282.000000006CAC6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463052157.000000006CAC7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463077869.000000006CACB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c490000_rfusclient.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0f0a1001b89b84f6491e9884e2c5101c8f70ebde63eb11617a69f295c26737c1
Instruction ID: ad341e9fae59964566557a0cc0e801683704e9e754dde49d6a5d841cffbde80c
Opcode Fuzzy Hash: 0f0a1001b89b84f6491e9884e2c5101c8f70ebde63eb11617a69f295c26737c1
Instruction Fuzzy Hash: 14112A713093129BE700BF99EC8021BBBE4AF84B5CF64492EE5A48BA41D774D4458B93

Non-executed Functions

Function 6C494000 Relevance: 3.9, APIs: 3, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 6C4940AA

Memory Dump Source

Source File: 00000010.00000002.1454467778.000000006C491000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C490000, based on PE: true

Associated: 00000010.00000002.1454442643.000000006C490000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462067691.000000006C909000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C910000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C9DE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463002538.000000006CAC5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463028282.000000006CAC6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463052157.000000006CAC7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463077869.000000006CACB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c490000_rfusclient.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 4066271c455c3859fbf91f41c0605b002b416e63681231d83282026bba7db169
Instruction ID: a4c443233ac5225f8ab4447ff39a9f582abd8f683aacbd0e477e992d34de1998
Opcode Fuzzy Hash: 4066271c455c3859fbf91f41c0605b002b416e63681231d83282026bba7db169
Instruction Fuzzy Hash: 6251D0B4D143689FCB00CFA9D580A8EBFF4BF89344F11892EE854AB754D7719849CB92

Function 6C493D30 Relevance: 3.9, APIs: 3, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 6C493DDA

Memory Dump Source

Source File: 00000010.00000002.1454467778.000000006C491000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C490000, based on PE: true

Associated: 00000010.00000002.1454442643.000000006C490000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462067691.000000006C909000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C910000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C9DE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463002538.000000006CAC5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463028282.000000006CAC6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463052157.000000006CAC7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463077869.000000006CACB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c490000_rfusclient.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: b272989b79a9ad8d50c956e4d5c20406359c8ed87759fe18290b7eeeab629cc6
Instruction ID: f7da828254a4ba63692394e4f16da5c45feb498ff0346ab180a43725d5243d4f
Opcode Fuzzy Hash: b272989b79a9ad8d50c956e4d5c20406359c8ed87759fe18290b7eeeab629cc6
Instruction Fuzzy Hash: 7151D4B49043689FCB10DFA9C590B9EBFB5BF8A304F10852EE848AB754D7719849CB91

Function 6C4942D0 Relevance: 3.9, APIs: 3, Instructions: 121COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C49437A

Memory Dump Source

Source File: 00000010.00000002.1454467778.000000006C491000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C490000, based on PE: true

Associated: 00000010.00000002.1454442643.000000006C490000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462067691.000000006C909000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C910000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C9DE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463002538.000000006CAC5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463028282.000000006CAC6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463052157.000000006CAC7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463077869.000000006CACB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c490000_rfusclient.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 49bb9f98bb1162feb0809c1f02f684cd51700783f51fdae6a5c4d6c9985073c9
Instruction ID: 38e5ee6588b0eadb494e0e9ad56c704e068e301ac763e06d1d4dd290d4194c94
Opcode Fuzzy Hash: 49bb9f98bb1162feb0809c1f02f684cd51700783f51fdae6a5c4d6c9985073c9
Instruction Fuzzy Hash: 8651D0B4D143689FCB10CFA9C480A8EBFF4BF89348F11892EE854AB754D7749849CB91

Function 6C4945A0 Relevance: 2.7, APIs: 2, Instructions: 160COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 6C4945FE
memcpy.MSVCRT ref: 6C49464B

Memory Dump Source

Source File: 00000010.00000002.1454467778.000000006C491000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C490000, based on PE: true

Associated: 00000010.00000002.1454442643.000000006C490000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462067691.000000006C909000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C910000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C9DE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463002538.000000006CAC5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463028282.000000006CAC6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463052157.000000006CAC7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463077869.000000006CACB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c490000_rfusclient.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: b566a79082a20864ec48ce18a07ba42fe52525f7f581f36459f0e18856d36575
Instruction ID: 3a3e41ba0ea7f0963886311a200f30890889952943a76c172f0ab287294f2c47
Opcode Fuzzy Hash: b566a79082a20864ec48ce18a07ba42fe52525f7f581f36459f0e18856d36575
Instruction Fuzzy Hash: AA6117B260D7408ED710DF28C18175ABFE0BF9A388F104E6EE4D457B51D7B49289CB92

Function 6C493AE0 Relevance: 1.3, APIs: 1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1454467778.000000006C491000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C490000, based on PE: true

Associated: 00000010.00000002.1454442643.000000006C490000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462067691.000000006C909000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C910000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C9DE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463002538.000000006CAC5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463028282.000000006CAC6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463052157.000000006CAC7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463077869.000000006CACB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c490000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7d5a864b7d2adc5cb81aa365af7aa1c0648be807f1fe12531de5544211a6998
Instruction ID: 29e84b07db31600aaf3837548053841cdde40dfc43e5c9251badf71e482e1977
Opcode Fuzzy Hash: f7d5a864b7d2adc5cb81aa365af7aa1c0648be807f1fe12531de5544211a6998
Instruction Fuzzy Hash: 5931CCB450C3909BC350DF29C080B4BBFE5ABCA758F548A1DE9989B720D7B099498B82

Function 6C493760 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1454467778.000000006C491000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C490000, based on PE: true

Associated: 00000010.00000002.1454442643.000000006C490000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462067691.000000006C909000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C910000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C9DE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463002538.000000006CAC5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463028282.000000006CAC6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463052157.000000006CAC7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463077869.000000006CACB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c490000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95fe0dd965a7cc6ffef2f6bd46487a315f8b9788bd62589b0b2a2bbbd404ea5b
Instruction ID: 99d44d42527fde1235a04556ab20ae92a41563d7769275c316d7b2d02d1b0edf
Opcode Fuzzy Hash: 95fe0dd965a7cc6ffef2f6bd46487a315f8b9788bd62589b0b2a2bbbd404ea5b
Instruction Fuzzy Hash: 9C31E2B06087059FD710EF28C69466FBBE1AFC5348F018C2DA9D58BB54DB74D8498BD2

Function 6C4938C0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1454467778.000000006C491000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C490000, based on PE: true

Associated: 00000010.00000002.1454442643.000000006C490000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462067691.000000006C909000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C910000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C9DE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463002538.000000006CAC5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463028282.000000006CAC6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463052157.000000006CAC7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463077869.000000006CACB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c490000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9fb1b47724c6cd2d82529f345b3c1fded3da90be09d669b39ece6a82c7a952
Instruction ID: f4dedcb13ec7ac2721a71e5b04378f8fb63ef39ef325990b1edc51613cc18142
Opcode Fuzzy Hash: cb9fb1b47724c6cd2d82529f345b3c1fded3da90be09d669b39ece6a82c7a952
Instruction Fuzzy Hash: B431AEB06087058BD710EF29869476FBBE1AF85348F128C2DE9948BB54DB74D8498BD2

Function 6C547610 Relevance: 12.4, APIs: 3, Strings: 5, Instructions: 406
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 6C54778A

Strings

0123456789abcdef, xrefs: 6C5476F7
0123456789ABCDEF, xrefs: 6C5476EA
, xrefs: 6C5476EF
, xrefs: 6C547C15
+, xrefs: 6C547BE8

Memory Dump Source

Source File: 00000010.00000002.1454467778.000000006C491000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C490000, based on PE: true

Associated: 00000010.00000002.1454442643.000000006C490000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462067691.000000006C909000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C910000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C9DE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463002538.000000006CAC5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463028282.000000006CAC6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463052157.000000006CAC7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463077869.000000006CACB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c490000_rfusclient.jbxd

Similarity

API ID: strlen
String ID: $ $+$0123456789ABCDEF$0123456789abcdef
API String ID: 39653677-2690344263
Opcode ID: 1aeff95caf24cdfae5cadd27617e7e9463ba673a6dfeb35c7a121fbca9030fc1
Instruction ID: 765ff9f5a4d07905032b481a71d8b9d816f4e6f82d94363dd3161ed8e298ae98
Opcode Fuzzy Hash: 1aeff95caf24cdfae5cadd27617e7e9463ba673a6dfeb35c7a121fbca9030fc1
Instruction Fuzzy Hash: 180235706093418FD710CF29C880B1BBBE1BF89788F64896DE8D89BB55E775D944CB82

Function 6C53FC10 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 303
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SwitchToFiber.KERNEL32(?,?,?,?,6C491CE1,6C4A70E0,?,6C4A742C,?,?,?,?,?,?,?,?), ref: 6C53FCB9
memcpy.MSVCRT(?,?,?,?,?,6C491CE1,6C4A70E0,?,6C4A742C,?,?,?,?,?,?,?), ref: 6C53FD50
SwitchToFiber.KERNEL32(?,?,?,?,?,6C491CE1,6C4A70E0,?,6C4A742C,?,?,?,?,?,?,?), ref: 6C53FD7C

Strings

`, xrefs: 6C53FFFE

Memory Dump Source

Source File: 00000010.00000002.1454467778.000000006C491000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C490000, based on PE: true

Associated: 00000010.00000002.1454442643.000000006C490000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462067691.000000006C909000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C910000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C9DE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463002538.000000006CAC5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463028282.000000006CAC6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463052157.000000006CAC7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463077869.000000006CACB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c490000_rfusclient.jbxd

Similarity

API ID: FiberSwitch$memcpy
String ID: `
API String ID: 148397844-2679148245
Opcode ID: 208bfaacc619e6fe010be68e2ea322333ca8e8092eb17f1f002b7907f8aa22a9
Instruction ID: e4561150d28683cf74f19c5f5de35ddb1b6f3611e6e61d823e940aaf80e04bc0
Opcode Fuzzy Hash: 208bfaacc619e6fe010be68e2ea322333ca8e8092eb17f1f002b7907f8aa22a9
Instruction Fuzzy Hash: E0D105B1509711DFD700AF68C88571ABBF0AF81388F11895DE8D88BB54DB78E885CB93

Function 6C53F8F0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

e, xrefs: 6C53FB09
`, xrefs: 6C53FB68

Memory Dump Source

Source File: 00000010.00000002.1454467778.000000006C491000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C490000, based on PE: true

Associated: 00000010.00000002.1454442643.000000006C490000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462067691.000000006C909000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C910000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C9DE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463002538.000000006CAC5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463028282.000000006CAC6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463052157.000000006CAC7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463077869.000000006CACB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c490000_rfusclient.jbxd

Similarity

API ID:
String ID: `$e
API String ID: 0-2074502723
Opcode ID: fe4faa7540bf84a6a8cfc443daf1656a73b617aa7611d8d1147c750bc54399a2
Instruction ID: e0d24ec0980001038a00bf4bf30300beba8bd87c4bed03df2b7638c764502053
Opcode Fuzzy Hash: fe4faa7540bf84a6a8cfc443daf1656a73b617aa7611d8d1147c750bc54399a2
Instruction Fuzzy Hash: A671E7B150A312ABE700AF64D88535FBBE0AF80788F11991CE4C88BB50D779D848CB93

Function 6C854970 Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.MSVCRT ref: 6C854989
_unlock.MSVCRT ref: 6C8549B1
calloc.MSVCRT ref: 6C8549FF

Memory Dump Source

Source File: 00000010.00000002.1454467778.000000006C491000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C490000, based on PE: true

Associated: 00000010.00000002.1454442643.000000006C490000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462067691.000000006C909000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C910000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C9DE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463002538.000000006CAC5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463028282.000000006CAC6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463052157.000000006CAC7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463077869.000000006CACB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c490000_rfusclient.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: ab375ab5a348395aa2b1c41066fd2d73b620529a5e0c5ab71e7ee1146ade8483
Instruction ID: c04eb07575327be8012c2800858b3734e87dd351840acfe18cbe86f651777c0c
Opcode Fuzzy Hash: ab375ab5a348395aa2b1c41066fd2d73b620529a5e0c5ab71e7ee1146ade8483
Instruction Fuzzy Hash: A5116DB16042008FDBA1DF28D68074ABBE0BFC5214F95CA79C498CB749EBB0D464CB62

Function 6C58BFC0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 72
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 6C58C058
strcpy.MSVCRT(?,?,?,?,?,?,6C4AC146), ref: 6C58C089
strlen.MSVCRT ref: 6C58C093

Strings

B, xrefs: 6C58C01C

Memory Dump Source

Source File: 00000010.00000002.1454467778.000000006C491000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C490000, based on PE: true

Associated: 00000010.00000002.1454442643.000000006C490000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462067691.000000006C909000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C910000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C9DE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463002538.000000006CAC5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463028282.000000006CAC6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463052157.000000006CAC7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463077869.000000006CACB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c490000_rfusclient.jbxd

Similarity

API ID: strlen$strcpy
String ID: B
API String ID: 2790333442-1255198513
Opcode ID: 4ba7a7fbdb5e1fb455a86e6ce91e6e25cfcb0babc3a5bf7f06447db44d600155
Instruction ID: ac7200336bbea306d587ff0620dd886e4b8af331f56837bd7927195da2acaedf
Opcode Fuzzy Hash: 4ba7a7fbdb5e1fb455a86e6ce91e6e25cfcb0babc3a5bf7f06447db44d600155
Instruction Fuzzy Hash: A6217FB590A710DBD701AF68D98439FBBE0FF80388F55496DE8884B701E779D8488B92

Function 6C8DA400 Relevance: 5.1, APIs: 4, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 6C8DA49E
memmove.MSVCRT(?,?,?,?,?,00000000,00000000,?,?,6C497F62), ref: 6C8DA4BE
memset.MSVCRT ref: 6C8DA5B4

Memory Dump Source

Source File: 00000010.00000002.1454467778.000000006C491000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6C490000, based on PE: true

Associated: 00000010.00000002.1454442643.000000006C490000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462067691.000000006C909000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C910000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1462099404.000000006C9DE000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463002538.000000006CAC5000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463028282.000000006CAC6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463052157.000000006CAC7000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000010.00000002.1463077869.000000006CACB000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6c490000_rfusclient.jbxd

Similarity

API ID: memset$memmove
String ID:
API String ID: 3527438329-0
Opcode ID: 5a74f77cd490459cefcd466d8b282fdf3355fd9bc0bb731e19690729e66421c5
Instruction ID: 84ce1329dd08103bc4c061b54dc18402770e29575604a28658f7fd023dd0a457
Opcode Fuzzy Hash: 5a74f77cd490459cefcd466d8b282fdf3355fd9bc0bb731e19690729e66421c5
Instruction Fuzzy Hash: 055118B16097028FC314DF29D58065BFBE1AFC8754F218E2EE8988B715D731E949CB92

Analysis Process: rutserv.exePID: 8624, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.4%
Total number of Nodes:	116
Total number of Limit Nodes:	11

Executed Functions

Function 0096E6AC Relevance: 25.1, APIs: 3, Strings: 11, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Error #18 @, xrefs: 0096EAFE
Error #16 @, xrefs: 0096EA4D
Error #17 @, xrefs: 0096EAAA
Error #11 @, xrefs: 0096E873
Error #20 , xrefs: 0096EC65
D, xrefs: 0096E75C
Error #19 @, xrefs: 0096EB9C
Error #9 @, xrefs: 0096E7C3
Error #10 @, xrefs: 0096E81D
WinSta0\Default, xrefs: 0096E8AC
winsta0\default, xrefs: 0096EB1F, 0096ED7D

Memory Dump Source

Source File: 00000015.00000002.3736780225.000000000096E000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0096E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_96e000_rutserv.jbxd

Similarity

API ID:
String ID: D$Error #10 @$Error #11 @$Error #16 @$Error #17 @$Error #18 @$Error #19 @$Error #20 $Error #9 @$WinSta0\Default$winsta0\default
API String ID: 0-473263953
Opcode ID: 332eb89461f7e6dca3c1234883ecfd2d86ffee68eea63170579401084ce72abd
Instruction ID: 7f2d1353efe5ef6b7de2c71271b1a284c292d3cabee9e89fc201ad61a9f87bb1
Opcode Fuzzy Hash: 332eb89461f7e6dca3c1234883ecfd2d86ffee68eea63170579401084ce72abd
Instruction Fuzzy Hash: 8D126474E0020DAAEF21FBB9CD86FFE73A9EF84304F144466F515E7182DA3599448B26

Function 00CFB958 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeW.KERNELBASE(\\.\PIPE\RManFUSServerNotify32,00000003,00000000,0000000A,00100000,00100000,00000064,00000000), ref: 00CFB98A

Strings

Error - CreateNamedPipe, xrefs: 00CFB99C
\\.\PIPE\RManFUSServerNotify32, xrefs: 00CFB985

Memory Dump Source

Source File: 00000015.00000002.3736780225.0000000000CFB000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00CFB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_cfb000_rutserv.jbxd

Similarity

API ID: CreateNamedPipe
String ID: Error - CreateNamedPipe$\\.\PIPE\RManFUSServerNotify32
API String ID: 2489174969-2026626902
Opcode ID: d2c29d324ef5a8a19fb34fb4185aaac88573c5a796197cb538bed4a413e25d56
Instruction ID: 93fb58591805371df290f4dc3057473204be347400a0d0bdee4218fcc8531d2d
Opcode Fuzzy Hash: d2c29d324ef5a8a19fb34fb4185aaac88573c5a796197cb538bed4a413e25d56
Instruction Fuzzy Hash: 6A21B031A4430D7ADBA0EBA5CC57BBE7BACEB49710F204565B714E61C1D7B09E009762

Function 00A03498 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StartServiceCtrlDispatcherW.ADVAPI32(?), ref: 00A034AB

Memory Dump Source

Source File: 00000015.00000002.3736780225.0000000000A03000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00A03000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_a03000_rutserv.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: 98e5cf078ae31f6cd5fba4387475a058bc730f82d003d76bd15f2e45dbe7db4e
Instruction ID: a6e51e79df131d435c1ce0065d03167cc101f1f670eb8463047653809700378e
Opcode Fuzzy Hash: 98e5cf078ae31f6cd5fba4387475a058bc730f82d003d76bd15f2e45dbe7db4e
Instruction Fuzzy Hash: 4FD012722493096EEB10AFB568C6B277A8CAB48324F400555F90CCA282E555D9104661

Function 00CFBC1C Relevance: 6.1, APIs: 4, Instructions: 130
pipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002,?,?,?,?,00000000,00000000), ref: 00CFBC4D
CreateNamedPipeW.KERNELBASE(00CFD2D4,00000003,00000000,00000014,00000400,00000400,00000064,0000000C), ref: 00CFBCCE
ConnectNamedPipe.KERNELBASE(00000000,00000000), ref: 00CFBCF0
ReadFile.KERNELBASE(00000000,?,00000004,?,00000000,00000000,00CFD28F), ref: 00CFBD44

Memory Dump Source

Source File: 00000015.00000002.3736780225.0000000000CFB000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00CFB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_cfb000_rutserv.jbxd

Similarity

API ID: NamedPipe$ConnectCreateFileInitializeRead
String ID:
API String ID: 3263518074-0
Opcode ID: ff4d570c6ae650a1e676a6f18794ad6ab65621c5c46d40d339b3c880392cab9c
Instruction ID: 76d07e7fd488e5acca0e61f429aab945f7e8363d083f36f0b537442ad1a5583d
Opcode Fuzzy Hash: ff4d570c6ae650a1e676a6f18794ad6ab65621c5c46d40d339b3c880392cab9c
Instruction Fuzzy Hash: 8D41287064030DAAEBA0ABB4CD87FBD7AAAFB0A754F104625F711E60D1D774DE008663

Function 004F9A90 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000000,?,004F9B49,?,?,004F9D88), ref: 004F9AF6

Strings

gfff, xrefs: 004F9ADA
gfff, xrefs: 004F9AB1

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000004F9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 004F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4f9000_rutserv.jbxd

Similarity

API ID: Sleep
String ID: gfff$gfff
API String ID: 3472027048-3084402119
Opcode ID: 888901aff9deea6df1e7c8a3e91a1d0e9e8703c9112e22ccce21950e1acbe30c
Instruction ID: 7302c9af5c956ebbdcc6d97d8faf393a3cf44faa0518e0f4369dc01b85608f12
Opcode Fuzzy Hash: 888901aff9deea6df1e7c8a3e91a1d0e9e8703c9112e22ccce21950e1acbe30c
Instruction Fuzzy Hash: 4701447170455D8BDB6C9D3EB8817383292F781305F54422BEB02CE78DDAA9AC81928B

Function 00A21C0C Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNELBASE(0000000A,00000000), ref: 00A21D1E

Memory Dump Source

Source File: 00000015.00000002.3736780225.0000000000A21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00A21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_a21000_rutserv.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2727ec1cbdaa82edac8666c864722ff5419babf6e5a087d5957990f3868bdbbb
Instruction ID: a14b3a8a9deebc95870d1add03f71c960a4e4ec8238984bc04ebd9ae1bd2f90a
Opcode Fuzzy Hash: 2727ec1cbdaa82edac8666c864722ff5419babf6e5a087d5957990f3868bdbbb
Instruction Fuzzy Hash: 1E417B34A04258EFDB14DB6CEA81E9DBBF5FF65310F2584A4E800AB692D734EE40DB10

Function 007D3994 Relevance: 1.6, APIs: 1, Instructions: 105
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DispatchMessageW.USER32(?,?,?,00000000,00000000,00000000,00000001,?,00000000,00000000,00000000,00000000), ref: 007D3A87

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000007D3000.00000020.00000001.01000000.0000000D.sdmp, Offset: 007D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7d3000_rutserv.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 62016760372329833ce7b2af68cfdfbce09201828acd2e5e19a22a1e0e855ac4
Instruction ID: b6feade911ad87e79cf9c4cde340520bc0a723e20c5948dcbf9aedd4853ba59e
Opcode Fuzzy Hash: 62016760372329833ce7b2af68cfdfbce09201828acd2e5e19a22a1e0e855ac4
Instruction Fuzzy Hash: C721F62134434266EA316A280C0EB6EB7B94FD2B04F24841BF4D5AB3C2C6AD9E464233

Function 004F9A01 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlUnwind.KERNEL32(?,?,?,00000000,?,?,?,?), ref: 004FA5E6

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000004F9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 004F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4f9000_rutserv.jbxd

Similarity

API ID: Unwind
String ID:
API String ID: 3419175465-0
Opcode ID: ace11f3268fa6a9968ede61cdcca24a46aba445d01eaddc212d20e60206f9b1f
Instruction ID: de7f1381e100d42a5acc2a051d5fe7f7a0c189a359bc4fab84ed34795eba4c8e
Opcode Fuzzy Hash: ace11f3268fa6a9968ede61cdcca24a46aba445d01eaddc212d20e60206f9b1f
Instruction Fuzzy Hash: 9E3171F0604308AFE720DB14C888F3B7BE5EB88754F59855EE6488B355C638EC52C72A

Function 004F9A5D Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlUnwind.KERNEL32(?,?,?,00000000,?,?,?,?), ref: 004FA5E6

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000004F9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 004F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4f9000_rutserv.jbxd

Similarity

API ID: Unwind
String ID:
API String ID: 3419175465-0
Opcode ID: 5be57559cb84f84dcb44712443ca2b759af96ee36382466d67350c1c24fc52d2
Instruction ID: 86d356fafc204906276c7f3eb9c8fcbfa0f3fadc7e4e3e3a9e50b31f0e903cca
Opcode Fuzzy Hash: 5be57559cb84f84dcb44712443ca2b759af96ee36382466d67350c1c24fc52d2
Instruction Fuzzy Hash: 9A214FF0205309AFD720DB14C889F3B7BA5EB88754F59855AF6488B355C738EC12CB66

Function 004FA512 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlUnwind.KERNEL32(?,?,?,00000000,?,?,?,?), ref: 004FA5E6

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000004F9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 004F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4f9000_rutserv.jbxd

Similarity

API ID: Unwind
String ID:
API String ID: 3419175465-0
Opcode ID: 410aca9243cd2af71d5715fc6f58373b5054cf3b33820fbaa902d463fde30263
Instruction ID: 9251e3f6a3e83bc767b93e8a60ff7865faec9d2c1dcb81720b2e352895657432
Opcode Fuzzy Hash: 410aca9243cd2af71d5715fc6f58373b5054cf3b33820fbaa902d463fde30263
Instruction Fuzzy Hash: E6214DF0205309AFD720DB14C889F3B7BA9EB88754F59855AF6488B355C738EC12CB66

Function 004FB1C0 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00002188,00000000,?,?), ref: 004FB21A

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000004F9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 004F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4f9000_rutserv.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 5c0c1313547f1f69d687f25643739165d8e44f67254618d91102e763fdeb9bca
Instruction ID: 67be0535c71e52f3ac3d8078131382842c127ea252e81f9ef4a6cd3d9036f34a
Opcode Fuzzy Hash: 5c0c1313547f1f69d687f25643739165d8e44f67254618d91102e763fdeb9bca
Instruction Fuzzy Hash: F1018F72604218AFC710CA9DE884AAEB7ECEB5A364F10416BF608D7351DB78DD01C7A8

Function 004FB1BE Relevance: 1.5, APIs: 1, Instructions: 44
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00002188,00000000,?,?), ref: 004FB21A

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000004F9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 004F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4f9000_rutserv.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 69c7c2feca684956dd9dcd815e81bcc39072084898a12a593b660830433b318b
Instruction ID: 10de5853214a8e6936bcd2e42ee1459b1262a29d3990f03282e50b367fb7d779
Opcode Fuzzy Hash: 69c7c2feca684956dd9dcd815e81bcc39072084898a12a593b660830433b318b
Instruction Fuzzy Hash: 13F08172704218AFD710CA9DEC44AAEB7ECEB1A364F10416AF618D7351D734DD0187A8

Function 0063BC70 Relevance: 1.5, APIs: 1, Instructions: 29
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 0063BC90

Memory Dump Source

Source File: 00000015.00000002.3736780225.000000000063B000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0063B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_63b000_rutserv.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: bb3a6f2699d4b03585f6e6bc3a532f26737bfb789d2208326c78886eafeaaae2
Instruction ID: 328e944bc3b182af53cdfcabc3279bea3fb6dc9cbdfc2c97d65d14d13c2f8546
Opcode Fuzzy Hash: bb3a6f2699d4b03585f6e6bc3a532f26737bfb789d2208326c78886eafeaaae2
Instruction Fuzzy Hash: 8AF0BEA05001814ACF20EB60C0D57593B82AF82308F0870C6F9484F357CB919854C7A3

Function 004FB764 Relevance: 1.5, APIs: 1, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysReAllocStringLen.OLEAUT32(?,?,?,004FAE59), ref: 004FB77E

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000004F9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 004F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4f9000_rutserv.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 8a583c88b67b7963baee3385ca5795d6421fa43ceb2648ca13ce8a6a3b7466e5
Instruction ID: a96be6f8ca2f644e67de92775c7285e9b971891298b6c7ff207bb7bd58c9a255
Opcode Fuzzy Hash: 8a583c88b67b7963baee3385ca5795d6421fa43ceb2648ca13ce8a6a3b7466e5
Instruction Fuzzy Hash: 45E08CB81402099EEA149A15C801B3B3669EBD2306BADC99EAB014B340DB3D8C4086BC

Function 0063BD36 Relevance: 1.5, APIs: 1, Instructions: 19threadCOMMON

Download Yara Rule

APIs

SetThreadPriority.KERNELBASE(?), ref: 0063BD4D

Memory Dump Source

Source File: 00000015.00000002.3736780225.000000000063B000.00000020.00000001.01000000.0000000D.sdmp, Offset: 0063B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_63b000_rutserv.jbxd

Similarity

API ID: PriorityThread
String ID:
API String ID: 2383925036-0
Opcode ID: dda65b633ecd3018f4ec4dc30ddd40dd4a93c85f73c49caf315b1c3543191353
Instruction ID: 7781a26caf36b4907f483db363115c0071cf9bf25f62944b25ff2d14acc79f35
Opcode Fuzzy Hash: dda65b633ecd3018f4ec4dc30ddd40dd4a93c85f73c49caf315b1c3543191353
Instruction Fuzzy Hash: D9D022623004202F8328E6EDA881CABA2CEDB8E2167088223F105C3228DB25CC0183E0

Function 004FB4C8 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(?,00000000,?,004FB623), ref: 004FB4D3

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000004F9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 004F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4f9000_rutserv.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 4d776db86785b5970fd1d9522e98babea852ea4b0d6e2be24cd6eecddb2789c7
Instruction ID: 6073292716d0863b27410ec37b5f91a675c0be42268a0663b65b73c839def6ac
Opcode Fuzzy Hash: 4d776db86785b5970fd1d9522e98babea852ea4b0d6e2be24cd6eecddb2789c7
Instruction Fuzzy Hash: 7BC012781456095DAA042B72890663B1B18ED52309790009BBF1085101E62DC441145D

Function 004FB238 Relevance: 1.5, APIs: 1, Instructions: 10threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 004FB24D

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000004F9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 004F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4f9000_rutserv.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 68139243feba271a73bf3ff0c8ecfa9e6415c92f71219f5e596785b6c57e1e08
Instruction ID: dd3ca6e053e707ce189e7d34698b8fd5fe6c6fc9f5ffcc2aba31cd29b719d09e
Opcode Fuzzy Hash: 68139243feba271a73bf3ff0c8ecfa9e6415c92f71219f5e596785b6c57e1e08
Instruction Fuzzy Hash: 8FC09BF12013058FC32026BD9DCC71E3558D70930DF50146E731689557CB7C4445C718

Function 00CFBA3C Relevance: 1.5, APIs: 1, Instructions: 6pipeCOMMON

Download Yara Rule

APIs

DisconnectNamedPipe.KERNELBASE(000000FF,00CFBA3E), ref: 00CFBA2F

Memory Dump Source

Source File: 00000015.00000002.3736780225.0000000000CFB000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00CFB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_cfb000_rutserv.jbxd

Similarity

API ID: DisconnectNamedPipe
String ID:
API String ID: 797972925-0
Opcode ID: b37bdc661ee5ffe07f8d1e8af4847e16227e0cd8209221d767f349547ca5fa19
Instruction ID: e3e867bc7f9ecc7c238f7d6ef7b2c2d20cabe2981c734858ecbbeb119ed29fa1
Opcode Fuzzy Hash: b37bdc661ee5ffe07f8d1e8af4847e16227e0cd8209221d767f349547ca5fa19
Instruction Fuzzy Hash: CFA0112A88800ABB8A00A2A0800883C2B28AA0A2803A08E00A202E2080C220C8002220

Function 009D9A54 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

IdThread (unknown), xrefs: 009D9A6D

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000009D9000.00000020.00000001.01000000.0000000D.sdmp, Offset: 009D9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_9d9000_rutserv.jbxd

Similarity

API ID:
String ID: IdThread (unknown)
API String ID: 0-2043411369
Opcode ID: a6e0865bc8e947145b56777337aff580c6cd860a501755050e3e1455675ce1f2
Instruction ID: dd5f5859cb92bfe40e2d64131c9c7aa226b2c0f5725a85f9becf04748b39978a
Opcode Fuzzy Hash: a6e0865bc8e947145b56777337aff580c6cd860a501755050e3e1455675ce1f2
Instruction Fuzzy Hash: ED41F030654244EFD701EF68DA55A19BBF9FB4A704F6284E2F804DBB61C734EE10DA10

Function 009FDBC8 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

loopback, xrefs: 009FDC88

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000009FD000.00000020.00000001.01000000.0000000D.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_9fd000_rutserv.jbxd

Similarity

API ID:
String ID: loopback
API String ID: 0-3546420730
Opcode ID: 4cdf467043a40f8dfe32179f26bc1d8caf9578bf624a3b4807e545c3195c74d9
Instruction ID: 8338923bab5770e04ddbe770f00c4b006547f68df5d5bc6183cf4e7450c55fcf
Opcode Fuzzy Hash: 4cdf467043a40f8dfe32179f26bc1d8caf9578bf624a3b4807e545c3195c74d9
Instruction Fuzzy Hash: B8414A74A0020CAFDB01EF99C8819AEB7FAFF89304F6085A5FA04D7651D734AE41CB54

Function 013FCA30 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

TProcessMessagesThread.Execute, xrefs: 013FCA3E

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000013FC000.00000020.00000001.01000000.0000000D.sdmp, Offset: 013FC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_13fc000_rutserv.jbxd

Similarity

API ID:
String ID: TProcessMessagesThread.Execute
API String ID: 0-3632000192
Opcode ID: 17aa164330db3aa85e9e013577acbc8648bdcf507b0b08a5a33ab5409e76face
Instruction ID: 61b8d406e0c073087230eb3fb2bdbbc556c7f076fb17bfc4e153d1617718d9f0
Opcode Fuzzy Hash: 17aa164330db3aa85e9e013577acbc8648bdcf507b0b08a5a33ab5409e76face
Instruction Fuzzy Hash: 04218C74A44208EFDB00DFA9D981E59B7F5FF49324F2082A9F914DB3A1C631AD00DB90

Function 008A211D Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000008A2000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8a2000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9c4f118e78073d66c62e2ef8253f4fd5c821372e6942729b464ba30dabba53
Instruction ID: 8ec119fd257bb7d4c8a61ca5c15b35016c1681911c9b0e8b8e8981bafd51836c
Opcode Fuzzy Hash: 5e9c4f118e78073d66c62e2ef8253f4fd5c821372e6942729b464ba30dabba53
Instruction Fuzzy Hash: F7E1752100E3C15FE7279B789AA51A0BFB1FE17214B1E45DBC4C0CF9B3D218591AE76A

Function 008A2654 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000008A2000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8a2000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f9868cf96b3d10d66838eb38efb5436b1e3896023d13f523ff296aeb7fa8cb
Instruction ID: 9f68410840d9591827ae5697d66370dbc9099de515e256836f91f580b8a56486
Opcode Fuzzy Hash: e5f9868cf96b3d10d66838eb38efb5436b1e3896023d13f523ff296aeb7fa8cb
Instruction Fuzzy Hash: A1714634A00208EFDB24EB9CC581AADB7F5FF4A310F2441A5E804EB762D774AE45DB41

Function 008A28D4 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000008A2000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8a2000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b65c51050bae19cd8e2189b3dc3e075e47b938bc863fe3f53ed49af6244691d
Instruction ID: 11a0fa87d02dce23adb1ed159dc1efb0e1e60402316b68e2464bd82544846ef8
Opcode Fuzzy Hash: 5b65c51050bae19cd8e2189b3dc3e075e47b938bc863fe3f53ed49af6244691d
Instruction Fuzzy Hash: 5AF08C51308AA44AFA22B63D5400AEEAF81FF07B58F2C0454F8D9CFB02C6058D46D3AA

Function 008A2478 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000008A2000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8a2000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed63f5db13a078d2879c901016d78b82a16f6bab0b1bc7097485690a34d34332
Instruction ID: 0a67ba357e8d066496951e0e0b2f2e5feb3e7454d965ab92307eb18af5fba9f5
Opcode Fuzzy Hash: ed63f5db13a078d2879c901016d78b82a16f6bab0b1bc7097485690a34d34332
Instruction Fuzzy Hash: C4E0D83230D3042FB719997EBC52917BA8DE38A664711843EF105C2A51E86548108068

Function 008A299C Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000008A2000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8a2000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851b2e6584a988663f165c13b020c156baa9f2ae03865eba9317844e96c49c4c
Instruction ID: befadc6af4ea0f0a164b0d615048cbc2d54c6af618129819209aa4a69235f794
Opcode Fuzzy Hash: 851b2e6584a988663f165c13b020c156baa9f2ae03865eba9317844e96c49c4c
Instruction Fuzzy Hash: 4CE01A76208208AFB315CB59E951C66BBECFB8EB6476245B6F504C7A10E631AC10D9A0

Function 008A2934 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000008A2000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8a2000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167fc22ae6243b5f55fa7f65709fc90d34debaab50f6181aceb7d766e3f5b7ad
Instruction ID: 6cbcde3b58b83b401147d3103380e1af46c6acb6f041f0d3e4fc503ae9276cb9
Opcode Fuzzy Hash: 167fc22ae6243b5f55fa7f65709fc90d34debaab50f6181aceb7d766e3f5b7ad
Instruction Fuzzy Hash: C2E0C263B0192087D228E76E0882B667A82DF4AAE0F0C413AA985C7756E61A4C1003DD

Function 008A28B0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000008A2000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8a2000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca0a5ceaff39ac834cd7d2f86684fade5cceb7543df8f52c2701c3fd9291ccc9
Instruction ID: 53d18f16af2ef5ec0d38c868381838a6c72b5062b47b4bf6fd8c17532e46f4c4
Opcode Fuzzy Hash: ca0a5ceaff39ac834cd7d2f86684fade5cceb7543df8f52c2701c3fd9291ccc9
Instruction Fuzzy Hash: 54C09B721051086FD100D64EDCC1D5AF7DCF719350F444172F60C87512957278508975

Function 006398B6 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3736780225.0000000000639000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00639000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_639000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c2ac574abf55ae21cbf6035824376078acdc7e53a90bdab73b1b59692627a7
Instruction ID: dcab931c4a539a2eadd99cff47283e157d11fd23f3196920210e5ae52d992c9a
Opcode Fuzzy Hash: c8c2ac574abf55ae21cbf6035824376078acdc7e53a90bdab73b1b59692627a7
Instruction Fuzzy Hash: 6BB001747001158F9F80DB28C688905B7E1BF8932131583E0A409CB336DA30EC85CF81

Function 008A28A4 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000008A2000.00000020.00000001.01000000.0000000D.sdmp, Offset: 008A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_8a2000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb62eaa0e35f85b5f3830afb278fe4f426ab4c8b7f5af162427d8c068c74e05
Instruction ID: 4d4aa6572ec6e9df40fdb23cd5b767b3e4c06784fdb70189a62f10ff06af3175
Opcode Fuzzy Hash: 0bb62eaa0e35f85b5f3830afb278fe4f426ab4c8b7f5af162427d8c068c74e05
Instruction Fuzzy Hash: E29002255100404AD500E718D445B783290BB41340FC949F0600596822855468505902

Function 009DB080 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000009DB000.00000020.00000001.01000000.0000000D.sdmp, Offset: 009DB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_9db000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a294ce3d42f9c71eba4acb16325737864769557c784ef27caf3e9eeca4a51fc
Instruction ID: 9144f19558e7eec2ff19f6467ecaab13505bb0ecaba21d3db13a065a4ef06dd8
Opcode Fuzzy Hash: 0a294ce3d42f9c71eba4acb16325737864769557c784ef27caf3e9eeca4a51fc
Instruction Fuzzy Hash:

Non-executed Functions

Function 013FC064 Relevance: 6.4, Strings: 5, Instructions: 194COMMON

Download Yara Rule

Strings

closed_by_user, xrefs: 013FC0F7
network_load, xrefs: 013FC1D7
ra_session_id, xrefs: 013FC0B7
show_duration_in_sec, xrefs: 013FC183
error_code, xrefs: 013FC138

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000013FC000.00000020.00000001.01000000.0000000D.sdmp, Offset: 013FC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_13fc000_rutserv.jbxd

Similarity

API ID:
String ID: closed_by_user$error_code$network_load$ra_session_id$show_duration_in_sec
API String ID: 0-946321287
Opcode ID: ad69b4704a60d5f2398f984d1624b5ffc8a136024060da521a3e04cf888ccb1a
Instruction ID: e91886fa820f385e8d106acff314b4d7c19c02a79bda00d19f53b402868c4f20
Opcode Fuzzy Hash: ad69b4704a60d5f2398f984d1624b5ffc8a136024060da521a3e04cf888ccb1a
Instruction Fuzzy Hash: F181F835A0020DDFDB10EB94D895ADDB7F5FF88304F2085AAE905A7256DB70AE0ACF51

Function 013FC3DC Relevance: 6.4, Strings: 5, Instructions: 154COMMON

Download Yara Rule

Strings

closed_by_user, xrefs: 013FC476
ra_session_id, xrefs: 013FC434
show_duration_in_sec, xrefs: 013FC4E4
error_code, xrefs: 013FC4AD
network_load, xrefs: 013FC51B

Memory Dump Source

Source File: 00000015.00000002.3736780225.00000000013FC000.00000020.00000001.01000000.0000000D.sdmp, Offset: 013FC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_13fc000_rutserv.jbxd

Similarity

API ID:
String ID: closed_by_user$error_code$network_load$ra_session_id$show_duration_in_sec
API String ID: 0-946321287
Opcode ID: d53246473255d14942e1093299999222fc63d8158e6ba5cfbbeb7bae905454fb
Instruction ID: e8c9df6b2db0733995a60e44d4d8be4654ce46ed0071a6159e6859d192147b3b
Opcode Fuzzy Hash: d53246473255d14942e1093299999222fc63d8158e6ba5cfbbeb7bae905454fb
Instruction Fuzzy Hash: 1D61D734A4020DDFCB44DF95C588ADDBBB5FF49304F6055A9E901AB265DB70AE4ACF40

Function 006393A0 Relevance: 5.1, Strings: 4, Instructions: 84COMMON

Download Yara Rule

Strings

END, xrefs: 0063940D, 00639466
INLINE, xrefs: 006393C8, 0063943D
INHERITED, xrefs: 006393B4, 0063942D
OBJECT, xrefs: 006393DE, 0063941D

Memory Dump Source

Source File: 00000015.00000002.3736780225.0000000000639000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00639000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_639000_rutserv.jbxd

Similarity

API ID:
String ID: END$INHERITED$INLINE$OBJECT
API String ID: 0-4145825852
Opcode ID: 4532f47643d57de2ea17421b0a1a056e1cf945b83d08ce141df42742412202b6
Instruction ID: 25d35a7d7ddcb82412c65dac0bf4290598f4e2fac1134eb1702669a8924f2aad
Opcode Fuzzy Hash: 4532f47643d57de2ea17421b0a1a056e1cf945b83d08ce141df42742412202b6
Instruction Fuzzy Hash: C72148646082049BDB60EF68D08159D7BD7DF5A354F208058F8849B347C6B6EC078FF5

Function 0063939F Relevance: 5.1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

Strings

END, xrefs: 0063940D, 00639466
INLINE, xrefs: 0063943D
INHERITED, xrefs: 006393B4, 0063942D
OBJECT, xrefs: 0063941D

Memory Dump Source

Source File: 00000015.00000002.3736780225.0000000000639000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00639000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_639000_rutserv.jbxd

Similarity

API ID:
String ID: END$INHERITED$INLINE$OBJECT
API String ID: 0-4145825852
Opcode ID: 0f6209d93c28aff651d1929d26024db009661849a48d88634394e53cd7c25851
Instruction ID: 988d122a77b0c21d35db9d83830a4a3c60dc39ee0e1fe2d8a0635ea3d764f116
Opcode Fuzzy Hash: 0f6209d93c28aff651d1929d26024db009661849a48d88634394e53cd7c25851
Instruction Fuzzy Hash: 071114686082049BDB60EF68D08159DBBD7DF5A355F208058F8805B347C6A6AC079FF5

Analysis Process: rfusclient.exePID: 8720, Parent PID: 8624COMMON

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	27
Total number of Limit Nodes:	2

Executed Functions

Function 00E5D598 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(\\.\PIPE\RManFUSServerNotify32,40000000,00000003,00000000,00000003,00000000,00000000,00000000,00E5D632), ref: 00E5D5C5
CloseHandle.KERNELBASE(000000FF,00E5D639), ref: 00E5D62A

Strings

Error - CreateFile, xrefs: 00E5D5D3
Error - NotifyServer - WriteFile, xrefs: 00E5D60F
\\.\PIPE\RManFUSServerNotify32, xrefs: 00E5D5C0

Memory Dump Source

Source File: 00000017.00000002.3736170423.0000000000E5D000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_e5d000_rfusclient.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: Error - CreateFile$Error - NotifyServer - WriteFile$\\.\PIPE\RManFUSServerNotify32
API String ID: 3498533004-2744967546
Opcode ID: 2c476d0d60d816c126f234abef018cdd8fbe2e01ec8b565d3e82c40c4e62af18
Instruction ID: 4e9b0220343306854a114ac0b355fcbc7f2f6f8ff930ba1b94929cef2f3f6984
Opcode Fuzzy Hash: 2c476d0d60d816c126f234abef018cdd8fbe2e01ec8b565d3e82c40c4e62af18
Instruction Fuzzy Hash: A5118E70A48308FFD760EBE49C02B5977A8DB49711F2059A6FA14F72C0D6B09A058BA5

Function 008D4294 Relevance: 1.6, APIs: 1, Instructions: 105
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DispatchMessageW.USER32(?,?,?,00000000,00000000,00000000,00000001,?,00000000,00000000,00000000,00000000), ref: 008D4387

Memory Dump Source

Source File: 00000017.00000002.3736170423.00000000008D4000.00000020.00000001.01000000.0000000B.sdmp, Offset: 008D4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_8d4000_rfusclient.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: d15c3d830721558d5729fb6870acdb083b7e6d08b68983c07b1d54298cea673d
Instruction ID: d3eec212d325f5e26db963b66d650a17e4faf4242b1796c21dea8688f91c060b
Opcode Fuzzy Hash: d15c3d830721558d5729fb6870acdb083b7e6d08b68983c07b1d54298cea673d
Instruction Fuzzy Hash: D921052134438427EA353A2D1C07F7E979AEF92B08F145A1FF591E73C2CAB59846426A

Function 00E5D637 Relevance: 1.3, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(000000FF,00E5D639), ref: 00E5D62A

Memory Dump Source

Source File: 00000017.00000002.3736170423.0000000000E5D000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_e5d000_rfusclient.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 85f8a527de5d3f3d0e77299ba621c860796bf597329a1e3df30f4d13ac857b20
Instruction ID: 8140210c79176e047f7d0141ccab7e95c5699643a9df34a5ba38638e242f02ae
Opcode Fuzzy Hash: 85f8a527de5d3f3d0e77299ba621c860796bf597329a1e3df30f4d13ac857b20
Instruction Fuzzy Hash: 62A0222288C20AFECA80E3E0888088C332C0A0C3C0F303CC8F303E2000C2308A002330

Function 006291E0 Relevance: .0, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000017.00000002.3736170423.0000000000629000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00629000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_629000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d335ad67eb5eb214e9d0e7db7e76042e91f6d0ff048dfc5b425ac8b39ad81c
Instruction ID: 38e0dbfaa95885eba2c9780d31ea6be6144f1c727f41329efe645d9cd84eca84
Opcode Fuzzy Hash: 61d335ad67eb5eb214e9d0e7db7e76042e91f6d0ff048dfc5b425ac8b39ad81c
Instruction Fuzzy Hash: 92E0C236F106354B9B60A96E688118AE3D69FE8370719443DAC40D7301C5309C018BE0

Analysis Process: rfusclient.exePID: 8728, Parent PID: 8624COMMON

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	20
Total number of Limit Nodes:	1

Executed Functions

Function 0062AF00 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00000EC8,00000000,?,?), ref: 0062AF5A

Memory Dump Source

Source File: 00000018.00000002.3736180777.000000000062A000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0062A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_62a000_rfusclient.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: e2787dc1d424f22c332985e9d9eff38e7fbace8541aefd61d99fd901b8763789
Instruction ID: b9c620d6022f5722629a2e0179d1399005b755c316f766fca35f164f234d82af
Opcode Fuzzy Hash: e2787dc1d424f22c332985e9d9eff38e7fbace8541aefd61d99fd901b8763789
Instruction Fuzzy Hash: B301F772700664AFCB00CF9DF980A8ABBEDEB18350F008026F908D7391C6B0DD058B65

Function 0062AEFE Relevance: 1.5, APIs: 1, Instructions: 44
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_00000EC8,00000000,?,?), ref: 0062AF5A

Memory Dump Source

Source File: 00000018.00000002.3736180777.000000000062A000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0062A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_62a000_rfusclient.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: f7c0141731fef44cc2da01b1202d6bdc063c9491da4bf0ebe5fca736f386992a
Instruction ID: 5429ddc24f4b77b64b5998ddab865f825205f025df3c9ea31782be6d2415e751
Opcode Fuzzy Hash: f7c0141731fef44cc2da01b1202d6bdc063c9491da4bf0ebe5fca736f386992a
Instruction Fuzzy Hash: 57F0A472704564AFD710CB9DBD80A9AB7EDDB18360F104026F918E7390D670DD058BA5

Function 0062AF78 Relevance: 1.5, APIs: 1, Instructions: 10
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 0062AF8D

Memory Dump Source

Source File: 00000018.00000002.3736180777.000000000062A000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0062A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_62a000_rfusclient.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: be306e993a4723bc4ae7df2c5855592058a0ce5e906ee87ac57f7cd1300bfa35
Instruction ID: 437ec704f6257d8084a9a470c8fdea73101d928d298ec412fd70cd85926788bc
Opcode Fuzzy Hash: be306e993a4723bc4ae7df2c5855592058a0ce5e906ee87ac57f7cd1300bfa35
Instruction Fuzzy Hash: A9C04CB12416104FD35067B66F8875962596748245F542429B506A6162DBBC484CCB14

Function 00763B6C Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.3736180777.0000000000763000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00763000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_763000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 506ca95aca2352e6d7b8fd11812dc66dd430de7c5309a4097e11c573a527db34
Instruction ID: eac2a611933be825d55069183417778183941145f2ec75eb03a2f5b1b5c92c7e
Opcode Fuzzy Hash: 506ca95aca2352e6d7b8fd11812dc66dd430de7c5309a4097e11c573a527db34
Instruction Fuzzy Hash: EF31F7B09047549ED320DBB5C8817AB7BE69F09304F04C82DF89AD7681DB79A644CBA9

Function 007639D6 Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.3736180777.0000000000763000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00763000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_763000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce0eb90d790fcad060993e6702aaf49c0a33c14230e5ae9e16a3abf9203a12a5
Instruction ID: c41d82b00de2e95702383ed9a3133d7a8d81a44e32e31afdf4bb775f2f66047b
Opcode Fuzzy Hash: ce0eb90d790fcad060993e6702aaf49c0a33c14230e5ae9e16a3abf9203a12a5
Instruction Fuzzy Hash: FA119074604244EFD701CFA5C955959BBF5EF4A710F2184E4F84197362C738AF00EA60

Function 007639D8 Relevance: .1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.3736180777.0000000000763000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00763000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_763000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4102605badd00784048ea4a329421d9777454ead65b754ebde1f96f37088b2da
Instruction ID: bdb7f1346893d40c97ef5633b2db523d164e7d95489ac888e638268174a8d1be
Opcode Fuzzy Hash: 4102605badd00784048ea4a329421d9777454ead65b754ebde1f96f37088b2da
Instruction Fuzzy Hash: B911BF74A08244EFD701CFA5C955D59BBF9EF4A710F2284E4F8419B362C738AF00EAA0

Function 00763AD0 Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.3736180777.0000000000763000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00763000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_763000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecfe84cba4e19567a51d69854b7ee067800ad10c62711e84eb12de1b0d1b4f98
Instruction ID: 4474c46d78a3bc9869185a4fe6696f949b76af4fb6b2be82248608886b740b65
Opcode Fuzzy Hash: ecfe84cba4e19567a51d69854b7ee067800ad10c62711e84eb12de1b0d1b4f98
Instruction Fuzzy Hash: 94D05B5274193047D11067AD1D43B95B5458F82FA1F084130BD45CF395EA0A4D1541E9

Function 00763E88 Relevance: .0, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.3736180777.0000000000763000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00763000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_763000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3d1ebd5290f40acf8a8fe20081544375cd2ca86df4495658b6f3dd05f38d2b0
Instruction ID: b3c7692fc987200ebe253531d411efc58328210ad519b5c1691249f0d0ff8356
Opcode Fuzzy Hash: f3d1ebd5290f40acf8a8fe20081544375cd2ca86df4495658b6f3dd05f38d2b0
Instruction Fuzzy Hash: 34C04C617001008FC7589E68D4D854233E49B4821571080909405CB196D765CD92C790

Function 00938B90 Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.3736180777.0000000000938000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00938000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_938000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f341b01ab4fae816cc24c3ba62c3b5522551ee3937a410d14ff0020c247fc16e
Instruction ID: d8fed4a71d0c9b58f021b92a079018616ea2b0c5f349e0da850bc75107949f5f
Opcode Fuzzy Hash: f341b01ab4fae816cc24c3ba62c3b5522551ee3937a410d14ff0020c247fc16e
Instruction Fuzzy Hash: B2B0123200010CB78F013E81EC01C497F5DAB12360B00C011FE0808121C6339570A798

Function 00763E9F Relevance: .0, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.3736180777.0000000000763000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00763000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_763000_rfusclient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947539e41f307acbe254c9d4a8b751d141d5621d97260492b6574b5385a57b66
Instruction ID: 55fbb55b3d9373766050e50b85e820bb7c030dbed71f05cc01140f363563b51e
Opcode Fuzzy Hash: 947539e41f307acbe254c9d4a8b751d141d5621d97260492b6574b5385a57b66
Instruction Fuzzy Hash: D5A002EA6445C57C565162E58D1A9761A199AC37007CD18C47C935545685EF1E02C332

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report J4zGPhVRV3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\417380.rbs

C:\Program Files (x86)\Remote Manipulator System - Host\EULA.rtf

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\MessageBox.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\VPDAgent.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\emf2pdf.dll

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\fwproc.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\pdfout.dll

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\printer.ico

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\progressbar.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\properties.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\rppd.lng

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\srvinst.exe

C:\Program Files (x86)\Remote Manipulator System - Host\Printer\common\vpd_sdk.dll

Windows Analysis Report
J4zGPhVRV3.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre